or send him a PRISM :))

@LucasKauffman or this youtube.com/watch?v=g8huXkSaL7o

@RoryMcCune <3 Monty Python

@LucasKauffman Rory is smaller than three times Monty Python?

@Adnan it's LOVE

it's a little heart

@Lucas Two things I don't have :(

@Adnan Adnan, meet the Internet. Internet, meet Adnan.

When you step back and think about it, it's kind of amusing that we live in a day in age where grow men communicate with little emoticon heart shapes, and nary a second thought about it.

@Xander how's your Internet? :))

@Xander I know my way around the internet! I've watched .3gp porn videos @28.8 kbps

LOL

those days

I remember that as well

the days when I still was using Limewire

to download perfectly legal audio files which did not have any copyright on theml

@LucasKauffman Oh yeah! 3gp! Where each breast is one pixel.

@LucasKauffman and what do you use now to download perfectly legal audio files which did not have any copyright on theml

@Adnan meh we used to connect to other computers that were running BBS via analogue modems and hope their mom doesn't pick up the phone because we really wanted those stamp sized 16 color boobs for our floppy disk collection

@TildalWave Reasonable, at the moment. I'm currently running with two ISPs to give me better availability. Was going to switch from my unstable cable to stable DSL, but now looks like I may not be able to get the speed I need out of the DSL, so trying to figure out a long term solution that doesn't cost me an arm and a leg.

@TildalWave torrent

@TildalWave Oh., the flobby disk collection! I still keep till this day. Daaamn

Fucking nostalgia.

@LucasKauffman What torrent? I'm talking pre-TCP/IP man!

@TildalWave He meant me

@Adnan oh duh

@TildalWave He's just stoopid. He doesn't know how to reply.

ah yea that was for @Adnan

@TildalWave good old IPX

@LucasKauffman The only reason I know IPX is because of Red Alert 2

@Adnan hahha, oh yeah.

Back when I were a lad we used to tunnel IPX over TCP/IP to play games over the Internet

'cause they didn't support IP

I used to be a great fan of IPX. Just worked for local LANs

back in @RoryAlsop's day this was done by tying a string between two cans

@LucasKauffman ha, they didnt get the string till much later.

@LucasKauffman well I'm not too sure they'd invented cans then

lol, so... they would just hold up their hands in circle, and pretend?

nahh smoke signals

@RoryMcCune they already had fire back then?

pretty sure they did yeah but you might need to ask him, to check

@LucasKauffman yeah, prometheus stole the fire from him.

BTW has anyone added "Rory Alsop is old" to the memes question yet?

@RoryMcCune I was just thinking the same

@LucasKauffman lol

it seems I tend to repeat myself.

@LucasKauffman I actually spilled my beer reading this one

BLASPHEMY

@LucasKauffman I licked it of off the floor. Don't worry

@LucasKauffman sacrilege ;)

@Adnan redemption

@TildalWave mosiomorphia

@Adnan you should sing 25 hail Stellas and 10 hail Jupilers

@TildalWave Stagnoplatontion

@LucasKauffman I am drinking Stella

@Adnan ah well that's good

the only beer you can spill is heinekenµ

One of the guys at Nummirock on Saturday

@LucasKauffman even that one only on chicken wings and ribs on BBQ

I hate heineken

@LucasKauffman it's not so easy for us to hate any brewery... you have like 2000 different ones to choose from in the 50 miles radius

:p

The important things in a relationship (audio not quite sfw...)

@RoryMcCune with foreign subtitles! I like it

@LucasKauffman I remember using two wireless bridges to connect token ring and 10base2 ethernet...

@AviD I want a t-shirt with that on

@LucasKauffman ah hah hah hah hah - I hadn't spotted that one going in

(that's what she said...)

@RoryAlsop :p

@RoryAlsop You're getting as bad as Avi.

well, I thought I'd land that one before anyone else

Got an offsite for a couple of days, so going to spend some time with t'wife and some whisky, perhaps - later all

@RoryAlsop Have fun!

@ScottPack ymean, as good as Avi.

@RoryAlsop enjoy!

I just thought of an awesome way to deal with dynamic IP without dynDNS

I'm gonna make a script that will be executed by cron and will verify if it's the same IP every few minutes and will send me an e-mail with the new IP if it has changed.

Awesome.

@Simon so, like dyndns, just hella manual and not in realtime...

@AviD You're such a downer.

whaaaaat? I think its cool!

@AviD Is the sarcasm loop still around or what?

hehe, was looking for a pic, but cant find it now...

this will do nicely:

I always say, if you're gonna reinvent the wheel, do it in styyyyle ;-)

@AviD Win

Hello. I would like to ask a question about the security of storing passwords on a home computer. Is security.SE the right place for that?

@Thomas Might want to try it out here in chat first, but sure.

@Thomas Heya. Yes, as long as its not something like "what program should I use" or "what buttons do I press".

@AviD I was gonna say that

@Iszi @Thomas or what @Iszi said :-)

Hi BTW

but try and make it entertaining!

@M'vy heh, minecraft?

yeah

double-entendre earns double-points

@AviD made it kinda look like me

minus the outfit ofc

My question is basically how secure it is to store hashes of passwords on a home computer. The thing is that I remember all the different passwords that I use, but I sometimes get the various sites mixed up. So I was thinking about just hashing all of them and putting them in a file. That way if I forget a password, I generate the hash of all of those I remember and compare to the file.

I know that this will not be perfectly secure, but how secure is it would be my question

@Iszi double-rainbow earns rory points!!

@AviD Don't be exaggerating. It would represent my solution without the canoe.

@Simon yeah, I was suggesting your solution needed more canoe.

@Thomas From a usability standpoint, that relies on the false assumption that you'll eventually get the right password.

@Thomas well provided you don't use something like MD5 or a flawed hashing function it should be good. Maybe not very friendly to use though

@Thomas interesting approach. without getting into the answer, I would just suggest that this, while possibly not without benefits, is a bit Rube-Goldbergian...

there are simpler, more direct solutions, so why do you want to go this way?

Rub-Goldbergian?

@Iszi: Yes, it assumes that I remember all the different passwords that I use

I'm just mentioning this now, because it would help if you add that context into the question...

So, do you all think that the question is appropriate?

@M'vy oops, Rube.

Strictly speaking in terms of usability, you'd be better off with a good encryption solution like Keepass. From a security standpoint, I can't say necessarily whether the hashes would be more secure at rest than properly encrypted data or not, but probably slightly towards "yes".

@Thomas its definitely on topic. Not sure you'll get the answer you're looking for, though.

@Iszi save it for the q&a, big boy ;-)

@Iszi: Ok, I can see that there are better ways, I was just curious to hear about how the secure the idea is

@Thomas probably as secure as the hashing function

@Thomas Taking the "A" of "CIA" into account, probably washes out to about even with KeePass. Hashing is +C -A compared to encryption. Perhaps -I, for that matter.

You might wanna take into account the fact that someone who knows one of your password could find all the site where you're using it if they get their hands on said-file

@M'vy That's better than someone who figures out your one vault password finding all the passwords to all the sites, though.

@Iszi technically they should not now thqt password. Unless you screwed something

On the other hand, some site still stores password as plain text

@M'vy "something" like your mom?

@Iszi Tsk

@M'vy Good point

@ScottPack Is your-mom a subset of double-entendre, or should we be listing that in the room topic separately?

@Thomas I find it easier to remember one password, and hash it with the domain name of each site to create per-site passwords.

Ok, I posted a question.

@Thomas In the end, all you're doing is brute-forcing your own password - the same thing you'd do manually at the target website, but without the potential for account lockout or imposed password reset.

@DarthAndroid: Interesting way. So you use the hash as password?

@Iszi: exactly.

Yes. basically, password = hash(concat(domain name,password input box))

@DarthAndroid: So you get some pretty long passwords?

Yup. So it doesnt' work for sites that have 8-character maximums.

@Thomas I stick with my original answer, then. From a usability standpoint, you're definitely better served by something like KeePass. Security-wise, the risk @M'vy mentions probably negates benefits gained by using hashing vs. encryption.

It also encourages me to really, really rethinking whether I want to use that site.

Ahhh - that's better

@Iszi: Ok.

But it means I don't have to worry about a) memorizing lots of different passwords, or b) need to have a database with me to access my passwords

@DarthAndroid you still need to be able to compute the hash

There's an implementation called pwdhash (pwdhash.com), which has plugins for major browsers

and a javascript implementation for when you're not somewhere where you have extensions

@DarthAndroid And then you're down to trusting the owners of pwdhash.com, which I'm not sure whether I'd rather trust them or LastPass.

hm

@DarthAndroid: I like your idea. I guess you could just use the first 8 characters of the hash ?

(I do neither - KeePass + TrueCrypt + Dropbox)

@Thomas But then your password suffers from very low entropy (not that any 8 character password is very high) since it's only 8 alphanumeric single-case.

@Iszi: Ok, I don't know what entropy is.

Huh? I don't have to trust them at all. It's javascript, so I can glance over the source. I've done similar with the extension I use in chrome, because it's also javascript

@RoryAlsop that was quick ;-)

@Thomas Then you probably shouldn't be rolling your own cryptography. For that matter, nobody should - except @ThomasPornin of course.

@AviD heh

@DarthAndroid And you do that every time, from every computer you use it at?

@Iszi: I know that ...

Nope. I rehosted the files.

(though, it's not particularly hard to do quick checks with view-source... it's <200 lines, most of which are comments).

And it's rare that I use my passwords outside of my own computer anyways.

@DarthAndroid No more immune to interception/modification than the original, unless it's on a pen drive.

It's SSL-hosted, so any interception/modification means I've got much, much bigger issues

either someone has brute-forced my SSL key or coerced a CA to resign my domain

or the local system is compromised, and there are much easier ways to capture my password

99% of the use falls under the browser extension on my personal computers though, and I a) know that that's not updating and b) has trusted code.

I'm much more worried about lifehacker's database being compromised than those scenarios, and this provides me the security I want against such a situation.

Using KeePass + Dropbox narrows the attack vectors down to local system only, even more so if you take Dropbox out of the equation and use a pen drive (which you'll probably want anyway, to carry a portable copy of KeePass).

Of course, as I mentioned, your method could be protected similarly if you carry the JavaScript on a write-protected pen drive.

@Iszi I'm not sure whether your-mom ⊂ double-entendre or your-mom ⊂ single-entendre

would you consider that double-entendre are also single-entendre? or are they mutually exclusive?

either way, its still ⊂ rory.