The DMZ

D3C4FF

12:02 AM

@Adnan Appropriate for all occasions :D

D3C4FF

12:22 AM

@ anyone that hates THC-Hydra, check this: code.google.com/p/patator

D3C4FF

1:32 AM

@copy @paste @copy @paste @copy @paste @copy @paste @copy @paste @copy @paste @copy @paste @copy @paste @copy @paste @copy @paste @copy @paste @copy @paste @copy @paste @copy @paste @copy @paste @copy @paste @copy @paste @copy @paste @copy @paste @copy @paste @copy @paste @copy @paste @copy @paste @copy @paste

HIIIIIIIIIIIIIIIIIIIIIIIIIIII

Hello there

How are you

Great

That's great!

Xeno asked if I want to create one course for opensecuritytraining.info after I corrected one mistake

Uni is no stress

How about you?

D3C4FF

1:45 AM

@copy I'm pretty great. I'm looking forward to lunch where i shall consume burgers and cider. Then spend the rest of day reading :)

copy

That sounds awesome, are you going to read fiction or security-related books?

D3C4FF

@copy Probably end up reading manuals for things :P But it'll be security related whatever i end up reading

@copy Whatcha studying at uni?

copy

IT Security Bachelor at Ruhr Uni Bochum (Germany). To be honest, I haven't gotten into much practical security yet, I am mostly spending my time programming

D3C4FF

@copy That's not bad, it'll give you a solid foundation. What kind of security stuff do you want to do once you finish?

copy

No idea, but I'm tending toward something with reverse engineering

Maybe research, I don't know :-/

D3C4FF

1:59 AM

@copy RE from a malware perspective or RE from hardware or RE for other?

copy

Malware

D3C4FF

@copy Cooool :)

copy

Yeah

I still have some time to figure it out

AJ Henderson

3:41 AM

hey, anyone still up to run an idea past

I'm still not really buying the value of storing a password in a recoverable format since phishing seems to be the only possible benefit (and maybe a little tiny tiny bit for keylogging) but have an idea that would vastly improve it

Terry Chia

@AJHenderson I just woke up so... :P

AJ Henderson

what about having the password returned in an encrypted state to be stored in a cookie on the client

the key is stored on the server, the cookie is preserved offsite and thus inaccessible to a hacker

and you still get almost all of the benefits of a centralized store

you have to trust the initial connection, but that's probably a fair limitation since the user has to set the password at some point

(in other news, I did have to laugh a little when someone suggested that because several big banks are doing it, it must be secure)

so I guess the two things are a) am I missing something other than the very minor key logger angle and the almost completely ineffective phishing angle for why you would want to store the passwords in a centrally reversible form and b) any obvious problems with the distributed cookie approach as an alternative

Terry Chia

@AJHenderson I don't really understand your idea.

Could you explain it a little more?

AJ Henderson

ok, so basically, as I understand it, the idea behind storing the password rather than a hash is so that only select characters can be asked for

thus complicating key loggers

but it exposes a central point of failure problem

because if the user db and encryption key are compromised, it is game over for the entire userbase

to offset that, the idea would be that on the first login, the server would generate a symetric key for the user

it would encrypt the password they provided and return it in a cookie that identifies the computer in the future

the server then keeps only a salted hash of the password

in the future, when the user connects

the cookie is provided to the server

the server can then decrypt the password with the stored user key

and it can ask for select characters

the user provides them and it can validate the user

the cookie is of no use on it's own and can't be compromised as the server key is unknown, the server being compromised can't leak all the passwords at once as the passwords are unknown

the central point of failure is removed

but most of the benefit remains

if the DB and encryption key is compromised, then it is still possible for an attacker to make up their own cookies

but that's still better than the original case as the attackers don't get the real passwords

and would still be able to access any account in a similar situation under the original

Terry Chia

4:04 AM

@AJHenderson How is this more effective than encrypting the passwords and storing it in the bank's db using a HSM? The attacker won't be able to do anything at all with a database compromise and the bank should have sufficient physical measures in place to protect the HSM itself.

Your scheme is overly complicated imo.

2

AJ Henderson

perhaps, but I also don't particularly trust an HSM. It raises the bar, but not enough for a single point failure of an entire system where billions are on the line

Terry Chia

You suggest one symmetric key per user or one key per machine that the user uses? If it's the latter, I can imagine storage space being an issue.

AJ Henderson

one key per user

should be sufficient

D3C4FF

@TerryChia Seconded

AJ Henderson

an HSM can't prevent a rogue program that has access to it from spitting out all the passwords since it is still going to answer a decryption operation

sure it would take a steeper compromise, but why risk it

what measureable benefit do you get in exchange

or even without a rogue program, there has to be some subroutines to spit out at least parts of passwords that could be compromised from a system reasonably close to the web

too many ways to avoid the HSM and still get a systematic failure, even if it takes more than a simple DB dump

unless there is a substantial provable gain

and I just can't see it

but anyway, it appears to be past my bedtime

@TerryChia for that matter, you could probably do one master key for everything

but using separate keys seems like a better idea since it isn't much extra work and again limits the points of failure some

Terry Chia

4:12 AM

@AJHenderson See, I can take this even further and poke holes in your scheme. What is to stop an attacker from compromising the bank's system to the extent where he can just insert a backdoor or replace the entire authentication system with something much weaker? There has to be some point at which you need to say "Stop, this is enough." You can always use the HSM as a simple oracle. Input the encrypted password as well as the password the user submits. The HSM spits out a yes/no.

D3C4FF

5:09 AM

@RoryAlsop whats your interest/experience in lockpicking like?

Terry Chia

6:10 AM

@D3C4FF Man, that pill thing is really going in the direction of movie technology.

Adnan

@D3C4FF Me me me me! I have interest and modest experience in lockpicking!

I have 10% of my answers that I really like. This is one of them.

0

A: Should magnetic locks automatically release in the event of a fire alarm?

This is a very interesting question, I've come across this when a client was designing a fire-code-compliant office space. The client's work was related to the defence industry and the office space had two rooms with highly classified contents. Now, of course, if you're a 3-letter government age...

I like it so much that I have to whore it a bit.

this.josh

You have photo key kit then?

Very nice research in producing usuable mechanical keys from photos posted online

Adnan

@this.josh If you're talking about cloning kits, then no.

this.josh

Cloning from a picture, not a physical copy

Adnan

@this.josh I can file a pin tumbler key from a picture, yes.

It's actually a very easy process.

this.josh

6:24 AM

what is standard these days nine pin with six position?

Terry Chia

@Adnan -1 as it doesn't have hand drawn circles.

D3C4FF

@TerryChia I know right. Creepy (and as far as i can tell, totally useless??)

@Adnan I'll bug you about that in a minute then :P

@Adnan Great answer :D

Adnan

@this.josh Where I live, pin tumbler locks are pretty much extinct.

this.josh

Really, you mean in commercial areas, or in commercial and residential?

Adnan

@this.josh Everywhere. The standard here is disc-detainer lock

@this.josh The only pin tumbler locks I saw here are drawer locks and bike locks.

this.josh

6:29 AM

sounds practically uncivilized

Adnan

@this.josh Why?

this.josh

Do they still have "fire engine" keys for gates, what about "postal" keys? I need sources of vulnerable keys

What civilized place wouldn't have a nice population of vulnerable keys?

D3C4FF

@Adnan ~99% of all residential uses pin-tumblers in australia, and probably 80% of commercial uses master-keyed pin-tumblers

Adnan

@D3C4FF Sorry :(

D3C4FF

@Adnan Why? It makes my job super easy whenever we do on-site pen-testing :D

Adnan

6:33 AM

@this.josh You can get a practice lock.

this.josh

Oh well a cordless power drill is still my lockpick of choice.

2

D3C4FF

@this.josh BORING

this.josh

But low effort.

D3C4FF

Greatest security failure ever: Buildings that have 'master keys' to the building, stored in a keysafe, that the fire department has a 5 pin key for. That 5-pin key is the same for ALL buildings.

Adnan

@this.josh The core of lockpicking is NDE (Non-Destructive Entry)

@D3C4FF The fail starts with the whole master key system.

this.josh

6:36 AM

Well where is the fun in that?

Adnan

Oh, they make picking so easy!

D3C4FF

@this.josh If i have to use destructive entry, i prefer a car body puller because it is stealthy in comparison to a high speed drill

If i have to drill something, i prefer to use tungsten-carbide/diamond tipped cordless dremel tools.

I can bypass a Next-Gen Bi-lock in under two minutes using a dremel ^_^

this.josh

If I can't find a vulnerable key I don't want to be sitting outside of some locked area furiously concentrating on an arcane skill while checking for roving guards.

D3C4FF

@Adnan I know. Its great. :D

Adnan

@D3C4FF What's the English name for that thing that actually locks the door and the lock just moves that thing?

D3C4FF

6:40 AM

@Adnan As part of the lock? Or as a bypass tool

?

AviD

@Gilles oh ye of little faith on your community. you answer is now not only the highest scoring one, it is the only one with a positive value.

Adnan

@D3C4FF It's part of the lock system. You know, when you rotate the key, it pushes that thing that actually locks the door and prevent it from opening.

this.josh

car body puller? dent remover?

D3C4FF

@Adnan The bolt? O_o

@this.josh Yeah

AviD

I think its just missing a bit about the difference in risk between hashing and symmetric encryption, but other than its perfect.

this.josh

6:41 AM

high tension spring driven thing?

D3C4FF

@Adnan toool.nl/images/a/a6/Drumm-geminy.pdf We've got a bunch of these installed nearby recently... Very interesting locks :)

@Adnan A 'deadbolt'? I'm not sure what you mean...

Adnan

@D3C4FF Okay, I guess the bolts then. I've seen some doors where the bolt "falls" when you try to drill the lock, it falls inside the door and into a hole in the ground, locking the door and the only way to access them is by burning through the door, or by moving them from the room below.

this.josh

havn't hard drives been answered.. modern drives are mostly sealed with filtered inlets for cooling

Stack Exchange

If that fails, just multiply every number by a thousand. 'The 2nd St speed limit were set at 2,500 mph, it would likely have prevented 1,000 of the intersection's 3,000 serious accidents last month.'

Adnan

@this.josh I'm very curious. Is English your native tongue?

this.josh

6:51 AM

That is information I am not prepared to give away.

D3C4FF

@Adnan Hasn't happened to me before, if its a dead bolt (ie one that's just a long bar basically) there might be problems, but then you'd be better off pulling rather than drilling the lock.

this.josh

I do intentionally mix dialects of english to obfuscate my identity.

2

D3C4FF

If its one of those hilarious |> auto-locking wedge things, then lo-and-behold, pwnage awaits.

Shimmmmmy shimmy shimmy to the break of dawn yeah

Adnan

@this.josh This is funny.

D3C4FF

@Adnan This statement is agreed with

Lucas Kauffman

6:56 AM

Drowning a hard drive

D3C4FF

@LucasKauffman Is lulzy

(and pointlessly time-consuming?!?)

Lucas Kauffman

I keep imagining someone violantly pushing a hard drive underwater

D3C4FF

@LucasKauffman Waterboarding a harddrive. "Tell me your secrets now!!"

Adnan

@D3C4FF It'd be funny to torture a hard rive with a hammer in order to extract information from it.

@D3C4FF Also, I VTCed your pill question, it's screaming "not constructive"

Adnan

7:14 AM

@Lucas New Hannibal episode released!

Is this Strapakowsky guy trying to rep-train?

Lucas Kauffman

7:33 AM

@Adnan well in the opposite direction maybe

Adnan

Jesus!! What's wrong with him?! 7 question just today

Gilles

7:58 AM

@AJHenderson the HSM wouldn't answer decryption operations, only verification operations. So the attacker would be reduced to online guesses.

@StackExchange what town has a .002th Street?

Rory Alsop

Morning all.

@D3C4FF - keen amateur/hobbyist. I have used lock picking in physical penetration tests, and I have taught various folks, but most of my lock picking nowadays is at lock pick villages at conferences

Adnan

@RoryAlsop Is there anything you haven't taught?

Rory Alsop

Hahaha - water boarding a hard drive; toilet diving- you guys are on a roll today:-)

@Adnan - did you watch the video of my Abertay talk - there's a pic in there of my youngest daughter trying to pick a lock. As an example of how easy it is:-)

Gilles

@RoryAlsop you've taught waterboarding hard drives and toilet diving‽

6

Adnan

@RoryAlsop Standard pin tumbler, yes, it's easy.

Rory Alsop

8:05 AM

Now that's a weird mental picture @Gilles...

Adnan

@RoryAlsop Then check this out

Rory Alsop

@Adnan - yes. I was watching some of the guys at the bsides London lock pick village working on some much more complicated locks. Too challenging for me at the moment.

@adnan - yes. Read that, hence my comment re toilet diving :-)

Adnan

@RoryAlsop Oh, I didn't see that. I think I should go eat.

Terry Chia

@Gilles Where can I sign up? For the first one, not the second.

Adnan

@TerryChia They're a bundle course. The second one is a requirement for the first one.

Terry Chia

8:12 AM

A wild @Polynomial appears.

Polynomial

And disappears again. For a minute :P

Adnan

8:33 AM

@D3C4FF Oh, forgot to mention this. There's an interesting exception here. Any fire-proof room (server room, vault, etc.) that is at least 50% closer to a any room than a fire exit, must open from the outside in case of fire.

That's why fire-proof rooms are built in the corners away from the other rooms, or next to a fire exit.

Rory Alsop

8:49 AM

Hmmm - what does 50% closer mean...

That is an ambiguous sentence

TildalWave

9:10 AM

@RoryAlsop I guess that's 2x further away from fire exit than any room adjacent to the server room? Which is again ambiguous, but that's how regulations often are, just in case one of the employees knows the inspector ;)

TildalWave

9:35 AM

@RoryAlsop That news made me ROFL. Loudly! I think I lost my password laughing :))

AviD

I think @D3C4FF pill question will need to be closed soon - for tastelessness :-)

TildalWave

@TildalWave Passwords should only be stored in volatile memory. I think your doctor should probably put you on a very strict password policy.... — AviD 1 min ago

@AviD well I hurt from the inside from laughing that hard :))

AviD

ah thaaaank you thank you

password-based overflow....?

TildalWave

@AviD running key cipher anyone?

AviD

It's time to switch to passphrases. I'll be back in 20 minutes.

Terry Chia

9:45 AM

@AviD Man you really outdid yourself this time.

AviD

9:56 AM

@TerryChia yeah, I'm in a shitty mood.

Adnan

10:13 AM

@RoryAlsop Here's an example. If you have an office room, and the closest fire exit is 20 meters away, any fire-proof room that is 10 meters (or less) away from that office room should be opened from the outside in case of fire.

Rory Alsop

That makes sense @adnan

Adnan

@RoryAlsop But usually, people don't want to open their server rooms, so they get around this by using a normal room with fire-proof cabinet.

Rory Alsop

10:28 AM

@adnan - until you get to a certain scale, then the whole lockdown or unlock process is automated

In my quest to get 1k on SF I have come up against a problem. Too many people with too many good answers who can type faster than me... There are some smart folks over there (@ScottPack)

Terry Chia

1

Q: How do you research for new vulnerabilities?

I've been asked this question, and I really don't know how would I do it. My answer was to take known vulnerabilities and try to exploit them on a different way, but this is not really a new vulnerability, rather a new attack based on a known vulnerability. So my question is, how is the process ...

research

Anyone else who reads this question as "new vulnerabilities as in new type of attacks like buffer overflow, XSS etc" rather than "new XSS vulnerability in application XYZ"?

Adnan

@RoryAlsop I have a solution for you. Find a border-line off-topic (that has a potential to be migrated to SF) tag on Stackoverflow, then stay active there. You'll get many upvotes very easily on Stackoverflow, then flag the question for off-topic.

Repeat.

Terry Chia

23 hours ago, by Terry Chia

@Adnan STOP GAMING THE SYSTEM DAMMIT!

:P

Rory Alsop

Hahahaha. That requires planning. And a bit of sneakiness.

And I don't have the appetite for either. It's sunny outside. I'm going to take a walk for lunch - my route may have about 22 portals on it:-)

Better use of time...

Terry Chia

@RoryAlsop Wait, you don't sit in front of your computer all day planning your next move in SE domination?

Rory Alsop

10:37 AM

Hmmmm. Let me see how much of that activity I do....

Well, I am near a computer a lot of the time. And sometimes it is a pc.

But no. I have odd time fragments, like when I have just bought a coffee or lunch, and I'll sit for ten minutes going through my top 10 sites seeing if I can do anything.

My mod sites first, then my top interests

sF is quite far down the list, as I haven't been a server admin for over 15 years

So I am a tad out of date

Terry Chia

@RoryAlsop You should get around to earning 10k rep on 10 sites. :P

Be a nice goal for you.

Adnan

@SSH users, how can I setup an SSH client in a way that I give it the public key of my host and prevent from connecting to that host if the public key changes?

I want to make sure that I'm always connected to my server and not to an SSL stripper.

Rory Alsop

@Terry - I have 5k on 5 sites. That's a start;-)

And 1k on 20....

But 10k on only 2 - this may take some time

Right - lunchtime walk. Later all.

Antony Vennard

11:12 AM

@Adnan Most SSH clients do this automatically if the "host fingerprint" changes. Usually with a big ugly warning!

@Adnan cafe.elharo.com/security/verifying-ssh-host-fingerprints

4

Q: Where is the SSH Server Fingerprint generated/stored?

I installed openssh-server and created a key with ssh-keygen. I then attempted to test it using local port forwarding by doing ssh -L 8080:www.nytimes.com:80 127.0.0.1. However, the key fingerprint that this command provides is not the key fingerprint I get when I do ssh-keygen -l. Even if I dele...

ssh

To be precise, you have connected to the server and possibly sent it your public key by this stage (I can't remember the SSH protocol order right now) but it doesn't matter, because even if this is the case it is your public key!

Hennes

Mechanical snail

-1

Q: Chrome Running in root problem

I installed google chrome but I want to run it as a root so i did it using the comment number 3(by haqking)following link Ubuntuforum Now the Google chrome is working fine but I am not able to lock it in side launcher as its not showing up there and once i minimize it there is no way to get it b...

launcher google-chrome root root-permission

Adnan

11:58 AM

@AntonyVennard I already receive that warning when I generate a new key. The thing is, I want to prevent the connection from being established unless I manually copy the new fingerprint from the host and familiarize the client with it.

Rory Alsop

12:16 PM

@Mechanical - oh dear:-)

Adnan

@AntonyVennard After some search, I found that most SSH clients (including PuTTY) can be configured to enforce a list of known hosts. Pretty sweet!

Scott Pack

12:34 PM

G'day Bruces.

Adnan

@ScottPack 'Bruces' hmm.. first time I hear this one.

Scott Pack

australianhistory.org/australian-slang-atod

►

AJ Henderson

12:49 PM

@TerryChia are there any HSM's that can do verification of only particular characters though?

Terry Chia

@AJHenderson @ThomasPornin mentioned that programmable HSMs exists.

Adnan

@ScottPack Monty Python.. they never disappoint.

Scott Pack

Troof.

AJ Henderson

1:08 PM

@TerryChia I guess that makes me feel a little better though I still don't like the information leakage from a partial match, but as long as they program a lock out in to the verification process, it should be ok

I'm still not convinced there is enough evidence to support it being a worthwhile tradeoff, but I at least think it could be implemented in a reasonably secure manner now

Terry Chia

1:38 PM

UI-fi: The genre that imagines and creates cool, futuristic, and completely unusable user interfaces,

Tweeted by SecurityHumor on May 31, 2013 at 1:34 PM

So Metro? :P

Scott Pack

amazon.com/Venturer-Military-Excursion-Organizer-Bags/dp/…

Adnan

2:05 PM

@Ladadadada Just FYI. Banks here give you a list of passwords on a small paper. When you want to use your online bank, you enter your full account number and your full password. After a successful initial authentication, you're asked to enter the password A3 (the small paper is basically a lookup table), then you enter the password next to A3. That password is invalidated by the system and you're never asked for the same password again.

Once you use all your password, you get a new one by mail.

Another method also used here is to give the user a list of password, the first login you'd use the first password, the second login the second password, and so on.

It is by law that banks operating here must provide two-factor authentication.

Terry Chia

@Adnan Is the paper-based method really more secure than something like HOTP/TOTP? I think it's incredibly inefficient...

If they are worried about phone app solution being compromised by malware, just provide a hardware token.

Adnan

@TerryChia I don't think it's "incredibly inefficient". Before regulating this, there were 2 different studies on the method by two different institutions. One national and other one from another EU country.

Both studies reached the same result. This method offers the best compromise between usability, functionality, security, and cost.

Almost every citizen has a bank account which is used to authenticate you for tax websites, police, and customs.

Now imagine the process of managing all of these.

Rory Alsop

I quite like my tokens - I have 3 different kinds from three different banks. One is a standard RSA type, one has a keypad as well, and one is a full chip and pin card reader

Terry Chia

@Adnan Do you have links to said studies? I'm interested in reading them as I find it hard to believe paper-based solutions are the best compromise. Especially since I doubt the token in that image I shown cost a whole lot especially when purchased in bulk.

That said, Singapore is in the process of implementing a national 2FA framework... Can't say it's going along well.... onekey.sg/your-onekey/register.html

Adnan

@TerryChia I'll try to find them, though it would be easier to find the news article about them.

@TerryChia But I really don't see your side of the argument against the paper-based solution. Why do you think it's bad?

Terry Chia

2:21 PM

@Adnan I don't think it's insecure. I just find it hard to believe that managing that whole system - generating the random passwords, printing the passwords, mailing them etc, is more efficient than simply issuing a hardware token to each customer.

Or heck, just SMS-ing a one-time password works as well.

Xander

@TerryChia The benefit is that the initial incremental cost per customer is zero. With hardware tokens, you have to purchase one for each customer whether they use them on not. With this system, the cost is a slip of paper. For customers who use online banking, you have to send them new slips of paper every now and again, but I'm willing to bet that's still significantly cheaper than a bazillion hardware tokens. I think the cost of the rest of the system is probably a wash.

Rory Alsop

The setup with most UK banks is that high net worth individuals get the more expensive kit...

Terry Chia

@Xander See, that's what I want to read the study. ;) I'm mostly going by gut feeling here. Won't the paper-based solution lead to more helpdesk headache though? I think a slip of paper is easier to misplace so a lot more people calling in for new slips of paper, which would require the whole generation/printing process as well as invalidating the old passwords.

Plus heck, the token solution gives people the impression that bank XYZ is taking security seriously. I'm sure that's worth something.

Adnan

@TerryChia Ah! "which would require the whole generation/printing process as well as invalidating the old passwords." Come on!

Terry Chia

@Adnan Hmm?

Adnan

2:33 PM

@TerryChia You're making it sound like there are little people in the server rooms sitting with some magnet and reversing each bit to modify the database.

Terry Chia

Huh - why is this post marked as edited by community? security.stackexchange.com/posts/36748/revisions

Xander

@TerryChia Yeah, but that can all be automated. Heck, you could have a IVR option for it, so it doesn't take a call center employee two minutes to handle. And hardware tokens get lost too. Don't get me wrong, I'm not saying that this is demonstrably better than hardware tokens or a SMS-based system, but I can envision how it may be cheaper.

Adnan

@TerryChia Edited by anonymous and accepted by the owner.

Terry Chia

@Adnan Ahhh. Makes sense.

@Adnan hehe

Adnan

@Xander Yup, in fact it was so cheap and easy to implement, it took the whole banks in the country less than 1 year to switch, back in the early 2000s

Terry Chia

2:36 PM

@Adnan @Xander Well, I can see the cost angle. Reading the actual studies will be nice though. Nothing like actual facts and figures to change my mind. :)

@Adnan You said -

29 mins ago, by Adnan

It is by law that banks operating here must provide two-factor authentication.

Xander

@Adnan LOL! Yeah, but remember, cheaper is relative. Do you think they could have implemented any other two-factor auth solution faster? Knowing how banks work, I'm willing to bet not.

Terry Chia

Is the 2FA method itself specified in the law?

Adnan

@TerryChia Yup, thats what I said

Xander

@TerryChia Yeah, data rulz.

Adnan

@TerryChia No. The law says that banks must provide secure methods including not making the user's chosen password as a single point of failure. It didn't really specify much.

So the banks went with the cheapest solution.

Terry Chia

2:39 PM

It would be interesting to see a psychological study of hardware tokens though. Something along the lines of "Does using a hardware token encourage users to think that the banking solution is more secure than it's competitors using paper-solutions?"

@Adnan I see.

Adnan

But, you see, think about it. This system is implemented in the early 2000s, in some developed places they still get their ATM cards skimmed and they don't have 2FA at all.

I say that's a pretty good step.

Antony Vennard

@Adnan Ah okay, that's quite cool! You'd not get very far through the protocol before the warning, but I suppose not even connecting out is a more secure approach anyway :)

Rory Alsop

Of course chip cards are a very useful step - if everyone used them, skimming would be a fair bit harder

Adnan

@RoryAlsop Do you guys use the EMV for ATM cards as well?

Rory Alsop

eMV?

Adnan

2:48 PM

EMV

EMV stands for Europay, MasterCard and Visa, a global standard for inter-operation of integrated circuit cards (IC cards or "chip cards") and IC card capable point of sale (POS) terminals and automated teller machines (ATMs), for authenticating credit and debit card transactions. It is a joint effort between Europay, MasterCard and Visa to ensure security and global interoperability so that Visa and MasterCard cards can continue to be accepted everywhere. Europay International SA was absorbed into MasterCard in 2002. JCB (formerly Japan Credit Bureau) joined the organization in December...

Rory Alsop

Yes, I didn't know it was called that. We use that for all debit and credit cards

Adnan

Oh, I'm super excited! I'm planning my summer vacation. UK is a definite stop.

@RoryAlsop Does Scotland require a separate Visa?

Rory Alsop

To the UK? No.

We are all one big happy family

Aim to get to Edinburgh end of July or early August - the worlds biggest festival of festivals is on then

Google Edinburgh Festival and you'll see

Adnan

@RoryAlsop Holy shit!

Rory Alsop

Hahaha - good response

Adnan

2:59 PM

@RoryAlsop Is it called Fringe 2013?

Because according to their program they start on 02.08.2013

Rory Alsop

The Fringe is another part of the festival

Adnan

@RoryAlsop If one part took a 300-page pdf to describe, then what the hell happens in the rest?!

I WANNA GO SEE IT!

Rory Alsop

Www.edinburghfestivals.co.uk

Fringe is the biggest bit

Adnan

@RoryAlsop Hmm.. I don't wanna be a total tourist. I also wanna see parts of Scotland that aren't made ready for tourism.

Dinner time. Later all.

Scott Pack

3:28 PM

I see some of you jerks are horning in on my destruction dominance.

Rory Alsop

DOMINATE DESTRUCTION @SCOTTPACK!

Scott Pack

I'll have to see if I can add anything this afternoon.

> With great power comes great liability.

5

Rory Alsop

3:51 PM

Heh - only noticed that the second time I read it

Stack Exchange

Blog - Stack Exchange: Welcome Tim Post, our latest Community Manager

Shog9 on May 31, 2013

Community management at Stack Exchange is an… Interesting job. Parts sociologist, cat-wrangler, therapist, software analyst and cheerleader, this small band of dedicated people work daily to make sure each individual community has the tools and support you need to be as awesome as you are. Of course, we don’t do it alone: from the very start, Stack Exchange attracted some amazingly helpful and insightful folk who’ve donated their time and effort to help out – and I’m pleased to announce that we’re adding one of them, Tim Post, to our full-time staff of Community Managers. …

TildalWave

4:46 PM

@ScottPack damn, didn't see you nagging here and added my own 2 cents to it :P

how come you guys can have all the Friday fun before I manage to also? :(

Rory Alsop

Cos it's Friday

David

5:02 PM

Happy Friday, everyone!

Lucas Kauffman

It's friday

TildalWave

Now you tell me!

now I want beer... loads of it

David

GET SUM GURL

TildalWave

@David LOL sum gurl doesn't allow me... beer will have to do ;)

David

mmmmmmm free blueberry muffins @ work

GET SUM, GURL*

better, @TildalWave?

TildalWave

5:20 PM

@David heh yeah the intent is ... gender soon won't matter anyway ;)

David

@TildalWave wat

TildalWave

@David me + beer = yay!

David

gay* ?

lol

TildalWave

@David oh bugger didn't think of that

OK... me+beer=success

David

^_^

Lucas Kauffman

5:23 PM

@TildalWave just had a st. bernardus

Scott Pack

@TildalWave I had a pretty good brown ale at lunch.

And now I'm waiting for the AC repairman to show up. Dude was supposed to be here 2.5 hours ago.

TildalWave

@LucasKauffman hehe I'll have "Bernard"

Lucas Kauffman

where is that from?

TildalWave

@LucasKauffman Prague

Lucas Kauffman

what does it taste like?

David

5:28 PM

@LucasKauffman PLAGUE

TildalWave

it's def one of my favorites... they have white, dark and medium (not mixed white + dark)... at least from those that I've tried... they're considered among the best European beers by a lot of people, and I wouldn't argue that

David

news.cnet.com/8301-13578_3-57587003-38/… "A federal judge has ruled that Google must comply with the FBI's warrantless requests for confidential user data, despite the search company's arguments that the secret demands are illegal."

Lucas Kauffman

@TildalWave I wonder if I can get my hands on that

TildalWave

@LucasKauffman Tastes like a beer should taste like, dunno... is there a word for that? I'd say it has a slight wood like overtone, possibly form barrels it's stored in... not too heavy in any respect... it's easy to drink, which I don't mind abusing every now and then hehe

@LucasKauffman bernard.cz/en/index.shtml I'm sure you could get it in Belgium also

@ScottPack and you only had a single beer in the meantime? man! your repairman had more!

Scott Pack

@TildalWave Allegedly there was work to be done without access tot he house, so he was going to show up around 11. I was going to come home after lunch and hang out while everything got taken care of.

Lucas Kauffman

5:45 PM

@ScottPack wonder how much he will charge you :P

"It took me like 4 hours to fix that"

Scott Pack

@LucasKauffman It's being billed to the home warranty company.

Lucas Kauffman

@ScottPack the what?

Scott Pack

Home warranty. We paid a deductible and that covers the whole gorram thing.

Xander

6:00 PM

@ScottPack Going to be in your neck of the woods next week. Sort of, anyway. If you consider "several hours away, but in the same state" to be in your neck of the woods. What's the weather like there these days?

Scott Pack

@Xander Warmish. Depends significantly depending on the where.

@Xander Which part?

Xander

@ScottPack Dayton

Scott Pack

@Xander I think it's about 3 hours. You going to go see the museum while you're there?

Xander

@ScottPack The USAF museum? I'd like to, if I have time. It's a trouble-shooting visit to a client, and they can be iffy in terms of how much free time I end up with.

Scott Pack

@Xander I hear it's really cool, haven't been though.

Do you often get up this way?

Xander

6:07 PM

@ScottPack Nope, never been to Dayton. Been to Cleveland once, but that's the extent of my Ohio experience.

@ScottPack Yeah, I really dig that sort of thing. Military museums, and flight museums in particular.

Scott Pack

@Xander Ok. I'll be moving to Columbus in a couple of months. If Dayton was a regular event for you we could schedule beers.

Xander

@ScottPack That'd be cool...I'll definitely let you know if I get back up that way.

Scott Pack

Yay.

Next week looks like pretty good weather for them. Low 70s.

Much better than the upper 80s we've been having the past few days.

Xander

@ScottPack Excellent. :-)

@ScottPack Yes. That's what we've had too.

Scott Pack

I find bright sun and hot rather uncomfortable. I think partly sunny and 72 is probably my ideal climate.

Xander

6:12 PM

@ScottPack I grew up in Seattle, so overcast and 65 is more my speed.

Scott Pack

I had a friend spend 18 months at Fort Lewis. I'll never forget the night he called me on his way home simply giddy about the fact that, for a brief moment, the clouds parted and he got to see the sun for the first time in 45 days.

Xander

@ScottPack LOL! That's pretty typical for non-natives. There are occasionally streaks long enough to wear even the natives out. However, it's sunny from July though September, so you just have to be there at the right time of year if that's what you like.

Scott Pack

That's pretty funny. "But we have an entire sunny season! It's a whole 3 months!" :)

Xander

As the joke goes, how do you tell what the weather's going to be like in Seattle? You look out the window...If you can see Mt. Rainier, it's going to rain. If you can't see Mt. Rainier, it's already raining.

Scott Pack

I can see that. Certainly a bit different from where you are now.

Xander

6:22 PM

Yup. I've spent most of my adult life in Dallas however, so Charlotte is a bit of an in-between. It's a relatively reasonable compromise, if a bit too hot and humid.

More shade and less concrete than Dallas, which helps.

Scott Pack

No. Doubt.

Rory Alsop

6:43 PM

No

Diggity

...

Mellon

Scott Pack