The DMZ

Sean W.

01:52

Has anyone here taken training from SANS? Was it worth it? I'm a recent college grad, and I'd like to specialize in web pentesting.

Scott Pack

I've gone through SEC 503 and SEC 560. Both great courses.

copy

Those are pricey, probably not worth their price for a student/graduate

Scott Pack

Personally? Yeah, that shit's expensive. The OnDemand is probably a better deal, but still quite pricey.

Simon

Does it look really good on a curriculum vitae?

Scott Pack

02:08

@RoryAlsop can speak the best to things like that, but GIAC certificates are respected technical certificates.

Sean W.

@co

Sean W.

02:23

@copy @ScottPack @Simon The problem I'm facing is that all of my security knowledge is self, but I can't get recruiters to take me seriously without proven skills. I was looking into graduate programs, but even infosec programs seem to focus more on the business side than the technical, and they far more expensive than any training. I'm also interested in the CV appearance.

Simon

@SeanW. I can't help you out with that because I'm not yet at that point. I'm pretty sure I'm gonna have the very same problem too.

Scott Pack

The Great and Powerful Rory did a presentation recently about getting started, you just have to force yourself through the Scottish brogue.

@SeanW. Where does your heart lie? Systems? Networks? Operations? Programmer? Paper Pushing?

Sean W.

@ScottPack That's the thing, I've done all of the above at one point (I had an internship pushing paperwork for the account lifecycle...was that boring as hell), but I prefer the challenge of breaking things. :)

Scott Pack

Define what you mean by that.

I mean, the first trick to finding a job is finding what you actually want to do. If you want to do pen-testing, for instance, some places do hire junior members straight out of school. In that case your biggest bang for the buck might be one of the Big4 auditing firms. We have a number of their former (and current) employees here.

Might I pimp myself and point out this question that might be useful?

5

Q: Fresh Graduate Going into Penetration Testing

As a fresh graduate I'm wondering what my chances are of joining a great pen-testing group. Is there a risk that a career in pen-testing may one day not be needed? If so, how applicable will skills from a pen-testing job be towards getting another job in the IT field?

Sean W.

In using various web apps, I've previously noticed issues such as open URL forwarding via a GET parameter. That lead me to try things like WebGoat, where I could explore these problems without legal issues.

Scott Pack

02:34

I don't work in Pen Testing, so take this accordingly, but I would actually value work experience outside of Information Security when hiring someone.

Oh. You're a coder. One of those people.

You might get more utility out of pulling on @AviD's ear then. :)

Sean W.

And I've actually had a few smaller firms tell me in interviews that they liked my knowledge of the full stack. Unfortunately, those firms have also gone radio silent after telling me that they are not sure exactly when they'll need someone, depending on customer's requirement.

Scott Pack

I still go back to the fact that I actually consider security a career advancement from many other fields. I mean, by my reasoning you gain a high level of proficiency in one thing, augment it with a differing outlook.

Contracting companies are always scary like that, yeah.

Where are you based?

Sean W.

Southwest ohio. Not a great area for any kind of IT work I'm discovering...everybody seems to outsource like mad around here.

Scott Pack

So Cinci or are you considering Dayton south?

Sean W.

Cinci

Scott Pack

02:45

I'm in Athens right now.

Sean W.

Hell, I'd take a job as a Jr linux sysadmin just to have something to do, but so many HR bots reject my application (probably due to lack of keywords for their favorite stack) before it ever reaches a human...much less a technically minded one...but now I'm just ranting...thank you all for your thoughts

Scott Pack

Hey, no worries. I'm all about helping people get jobs. I got into this field by pure accident. One of my students was on the security team and they had a student position open.

Too bad you weren't around a few months ago. We had two positions open on our Linux team.

This just got announced. I dunno if it interests you at all.

ohiouniversityjobs.com/postings/6809

It's on the line crew. So they do all the cabling and such.

Before too much longer I'll be moving up to Columbus. It's worth noting that I have a tendency to post jobs that I want to get filled.

Sean W.

03:11

Thanks. I'm actually from Columbus. The job market does seem slightly better there. Due to a crazy series of events, I'm stuck in Cinci, so I'm focusing on that area until I get really desperate.

Scott Pack

Trust me. I'm completely in the "Moving Sucks" camp right now.

Sean W.

Yeah...my prof submitted a paper while moving...I'm still not sure how he managed that...

Scott Pack

Moving to Athens was totally fine, but that was one small apartment to another small apartment. Now I'm moving a 2.5 story house with a family. Sucks.

That's what I'm working on right now. I think I have all the data I need to actually write my thesis.

Sean W.

You know the crazy thing? I've had more than one IT firm ask for a complete application (and all the PII that goes with it) via plain email...

Scott Pack

Well..yeah? You can't expect people to do things right.

You can only tell them what they should do and hope they at least listen, even if they don't do it.

Sean W.

03:20

I suppose thats why InfoSec is so in demand right not. Laptop's dying; thanks for the chat!

Scott Pack

No worries. So long as you can withstand the general overwhelming sarcasm, snark, and perviness we're always welcome for chatter.

Simon

You must also be able to withstand the fact that you are NOT Scott Pack's friend.

Scott Pack

He's at least close enough to buy me beer.

This is, after all, the last few days of Brew Week.

Stack Exchange

05:55

They have a telescope pointed RIGHT AT US!

Lucas Kauffman

07:09

Morning ^^

Rory Alsop

07:56

Morning

Tinned_Tuna

10:00

morning

Polynomial

aftermorning

Rory Alsop

10:15

Forenoon

Lucas Kauffman

Afternoon

in my timezone anyway :p

lynks

11:00

midday

Rory Alsop

Heh. Yup. And it's raining and windy. Must be summer today.

lynks

im going to walk through the park to the good sandwich shop today

rather than across the duel-carridgeway to the bad sandwich shop

i know what youre thinking

Rory Alsop

Bad sandwich! Bad! You go sit on naughty step!

lynks

youre thinking...lynks, why don't you walk through the park to the good sandwich shop every day

the park sounds like a much nicer walk than the duel-carridgeway

and good sandwiches are certainly preferable to bad sandwiches

Rory Alsop

The bad sandwiches ambush you?

Quality of staff?

lynks

11:04

unfortunately the reasons are mundane.

the bad sandwich shop is closer by a factor of 12 or so, and cheaper by a factor of 2

the end.

but first im going to play skyroads.

Adnan

11:44

@lynks! Yaaay! You're here!

Rory Alsop

12:02

Hahaha - mellon

Adnan

@RoryAlsop Oh come on, that wasn't melloning.

ManishEarth

mellon? O_0 I got the reference, but I don't see how it fits here :S

Lucas Kauffman

The importance of grammar: Telling a girl 'I love the feel of your waist' is very different from 'I love the feel of your waste'

6

Terry Chia

@LucasKauffman That's more spelling/pronunciation though.

Adnan

@LucasKauffman Ahaaa.. I was wondering what you meant when you said that to me last night

Rory Alsop

12:15

@manish/@adnan - it was just a wee joke on just how delighted Adnan was by Lynks' presence

ManishEarth

ah

Lucas Kauffman

-1

Q: Recommend Pub.key crypto book/paper that illustrates notions with MS CryptoAPI

Could you advise public key cryptography book/reference that illustrate concepts with help of MS CryptoAPI. MSDN is good but MSDN organized by functions. I need books style: to consider some topic, use cases with illustrations with chain of MS cryptoAPI functions.

cryptography windows

think the poor guy doesn't understand what I mean :(

lynks

12:32

@Adnan I am here in body, but clearly not in mind - I just tried to open my house with my remote car key.

Adnan

@lynks Well, you're on your computer, so it obviously worked.

@LucasKauffman I'm pretty sure he's using a text generator to post comments. To me, they seem almost like random words.

lynks

I fully walked up to the door, got out the clicker, pointed it at my front door, and pressed the button.

Adnan

Speaking of which. The poetry generator

Polynomial

@Adnan Do we have another Andrew? ;P

Adnan

Damn! It makes much better lyrics than Nicky Minaj, Justine Beiber, and One Direction combined.

Polynomial

12:36

I'm pretty sure Andrew's full name was Andrew Markov.

Simon

Morning.

Adnan

The small light loudly drives the hood.
Love is a noisy girl.
The car runs like a noisy light.

Holy shit! That's my new favorite website!

Polynomial

@Adnan the Beiber song generator: for(int i=0; i<SONG_LENGTH; i++) { printf(i % 4 == 3 ? "BABY " : "OOOH, "); }

9

Adnan

@Simon Morning!

@Polynomial Hehehehehehe

Simon

@Adnan Where have you been? It seems that you haven't been on this chat much this week!

Rory Alsop

12:38

Hahaha @poly - nice

Polynomial

;)

Adnan

@Simon Lots of work!

Simon

@Polynomial Doesn't he say "NOOOOOOO" at one point?

Rory Alsop

Ooh, exhaustion!
Where is the dead jackhammer?
All rains fight misty, small corners.

Adnan

Girls grow!
Lads grow like lively winds.
Pirates grow!
Wow, courage!

Polynomial

12:39

@Simon Yes, when Garry Glitter took his virginity.

Adnan

This is intentionally funny. I can't be convinced it's random

Simon

@Polynomial I had to google image him, damn.

Adnan

But then again, I'm looking at the source code.

Polynomial

@Simon I believe he's still in prison in the Philippines.

Simon

@Polynomial Oh, he actually has a background in pedophilia or what?

Adnan

12:41

Okay, this is the last one

Polynomial

@RoryAlsop I imagined that sung in the style of Fall out Boy

Adnan

Death, death, and faith.
Grow quietly like a sunny sun.
Why does the wave endure?
Lord, death!
Misty, rough pirates swiftly pull a sunny, stormy moon.

Polynomial

@Simon Yes, that's why he's in jail :P

Simon

@Polynomial Ewwww.

Polynomial

"I chimed in with a haven't you people ever heard of, closing the god damn door, no, it's much better to face these kinds of things with a sense of poisoned rationality..."

your ear-bug for the day

Rory Alsop

12:42

@poly - the title is probably something like "after turning down my street just before rush hour, the roadblock ruined everyone's day"

Polynomial

@RoryAlsop sounds like the most passive emo band name ever :P

Rory Alsop

On my car stereo, fall out boy consistently have to have scrolling titles

Polynomial

@RoryAlsop One day I'm going to start a band called "As I turned down Angela's rainy street, just before her heart's funeral, the roadblock ruined everyone's day"

Rory Alsop

Dooooo eeeeeet

Do it today

Polynomial

all of our songs will be about puppies and rainbows, but as if we were depressed about them

Rory Alsop

12:45

You don't need to bring out any music, just have an emo MySpace page

Polynomial

haah

one that immediately plays Black Veil Brides on full volume when you open it

Rory Alsop

Hanahahahahahaha - yess

Polynomial

with black text on a black background so you have to Ctrl+A to see anything

Lucas Kauffman

0

Q: Illustrate public key notions with MS CryptoAPI. And give references

Illustrate public key notions with MS CryptoAPI. And give references on authoritative scientific sources[mandatory for good answer]. I want to map my crypto knowledge on CryptoAPI.

cryptography windows

he still doesn't understand I think...

Polynomial

Oh, it's so tragic
I lost my remote,
A frog caught in my throat,
As I try...
To imagine,
How much of MLP,
I will surely not see,
As I answer the call,
On the front of my door,
-- Oooh, Amazon!

there we go, we already have our first song

@RoryAlsop all of the album covers will be staged black-and-white happy couple photos of one of the band members with some girl they don't even know.

Lucas Kauffman

12:51

All boobs desire cold, rough boobs.
The small jug swiftly desires the breast.
Lick is a sunny breast.
The stormy tit quietly desires the tit.
The big jug swiftly desires the boob.

Terry Chia

Ah, it's poetry night around here?

Polynomial

@LucasKauffman A true mammorial to boobs!

2

Rory Alsop

@poly - do you want to do our next album cover? Same idea, but with more leather and fire.

Polynomial

@RoryAlsop can it just be a picture of me sat on the toilet? because that would be hilarious.

Adnan

@LucasKauffman The same page?

Rory Alsop

12:53

@terry- yep. Scroll up a wee bit for the website

Polynomial

"Photo credit: some dude that isn't even on the band"

Terry Chia

@Polynomial I think Mellon would love that.

Lucas Kauffman

Dead, big smokes swiftly lead a warm, lively explosion.
Why does the sex die?
Love, life, and endurance.
Clear, lively explosions roughly fight a dead, sunny sex.

Simon

How can this dude post so many bad questions?

Lucas Kauffman

@Adnan I'm enjoying this poetry

Polynomial

12:53

@LucasKauffman sounds like a Michael Bay movie.

Lucas Kauffman

@Simon the same bad question

Adnan

@LucasKauffman Oh, you should see the vulgar wordlist I made.

Rory Alsop

@Poly - yes, But with leather and fire

Simon

@LucasKauffman Yeah, that too.

Polynomial

@RoryAlsop hahahahaha that'd rock. just a dude dressed in leather, on the can, with fire photoshopped around him

Adnan

12:54

@LucasKauffman I think I'm gonna fork it and add a rhyming functionality. That'd make it perfect!

Polynomial

@RoryAlsop Album name: "FROM THE BOWELS OF HELL"

Lucas Kauffman

@Polynomial fire filled bowels?

Adnan

@Lucas But you know what's even more fun? walkingdead.net/perl/euphemism

Simon

Am I the only one who manages to lose his mouse pointer for a few seconds when I'm in a dual screen?

Terry Chia

Can't recall if I posted this here yet:

> 27-inch Dell UltraSharp U2711 2560x1440 LCD Monitor w/3-year Advanced Exchange Warranty for $549 with free shipping (normally $999 - use $450 coupon code SDW7RZ4J1P20BM)

Incredibly amazing deal imo, for those who need a new monitor. :P

Polynomial

12:58

@Simon frequently.

@TerryChia I can vouch for the Dell UltraSharp series being good.

Adnan

> I couldn't believe my luck as she started flinging the pumpkin.

Lucas Kauffman

The last time I had this much fun, I was
getting the peach.

@TerryChia ooooh

Terry Chia

@Polynomial Yeah, and this is basically at half price - almost nearing the price of the Korean monitors on ebay.

Lucas Kauffman

@TerryChia oh btw how cheap is singapore on decent laptops?

Terry Chia

@LucasKauffman Probably freaking expensive. Huge markup on loads of stuff here compared to the USA.

Adnan

12:59

> Well, I know what I'll be doing this weekend; playing the blazing French cave!

Terry Chia

What's your idea of a decent laptop?

Polynomial

@TerryChia I've got a 2407WFP, which is really nice.

Adnan

@TerryChia Any laptop that is not mine

Polynomial

my brother has the 2407WFP-HC, and my dad got the 2408WFP

not cheap mind

Lucas Kauffman

@TerryChia minimum: full HD screen, i7 quad core, 8 GB memory (preferably an SSD)

Terry Chia

13:04

@LucasKauffman Just get a retina MBP :P I'm really biased towards Apple laptops though, had really bad experiences with other manufacturers.

Heck, a MBA would fit your requirements nicely (except for the full HD screen part).

Lucas Kauffman

@TerryChia I can get the above specs for about 750 euro here :p an MBP would set me back about 2k and wouldn't even have full hd screen

Terry Chia

@LucasKauffman Woah, 2k euro for a MBP??

Lucas Kauffman

@TerryChia aye

let me check the latest prices

Terry Chia

That's about 3.3k SGD. O_O The retina MBP here with the i7 processor cost only 2568 SGD.

Lucas Kauffman

15 inch MBP -> 1829, with retina -> 2229

Rory Alsop

13:07

Think I might just delete all kaponirs questions - they have no value here and are messy. Any thoughts?

Terry Chia

@LucasKauffman Ahh 15". I was looking at the 13" one.

The base 15" MBP is 2988SGD.

Which is actually quite cheap compared to your prices.

Dang I thought SG was expensive.

Lucas Kauffman

@TerryChia I checked Dell to compare, the same laptops in Singapore are about 200 euro more expensive in Singapore compared to here

except apple it seems

tempted to by a macbook now

Terry Chia

@LucasKauffman Interesting...

But manufacturers like Dell constantly have discounts, unlike Apple.

Lucas Kauffman

true

Terry Chia

Lightweight isn't in your requirements?

I can't imagine myself lugging around a laptop heavier than Ultrabooks nowadays.

Lucas Kauffman

13:14

@TerryChia I'm not taking my laptop everywhere anyway

Adnan

Guys guys guys! This is urgent!

Anybody knows a good file recovery application that restores files and folders with the same original structure?

lynks

Next laptop for me will either be the razer blade, or a system76

Adnan

On Windows

Terry Chia

@lynks Damn, the Razer blade looks sweet.

Adnan

I accidentally fucked up by removing uncommitted changes (very important stuff)

lynks

13:19

@TerryChia i'll be coding the hell out of that little screen

its a mini touchpad screen thingy

Simon

No idea sorry :(

Terry Chia

@lynks Dude, I write code on my 11" MBA. :P

@Adnan Ouch, that sucks. :( No clue though.

lynks

@TerryChia I mean the little touchpad next to the keyboard, on the blade

and I mean writing stuff for it, no idea what...but stuff

Terry Chia

@lynks Ahhh

Adnan

Oh, come on you guys! None of you had to recover some files before?!

God damn it! I fucked up pretty bad! I have a release in 2 hours!

lynks

13:22

@Adnan sorry, I dont use windows so much

Adnan

@lynks a linux application is alright as well. The file system is NTFS though

lynks

@Adnan in the few cases where I have had to retrieve individual files, I just used grep

TildalWave

13:48

@Adnan NTFS? Google for undelete there's some tools for that

Lucas Kauffman

as long as it's in the shadow thingie you should be fine

just don't create new files on the disk

otherwise it might be disallocated space where your file resides might be overwritten

Terry Chia

14:00

0

Q: Are there implementations of password hashing algorithms for major frameworks that utilizes specialized hardware like GPUs/FPGAs?

It is common knowledge that password cracking attempts can greatly benefit from specialized hardware such as large clusters of GPUs or FPGAs. Are there any implementations of the commonly recommended password hashing algorithms (PBKDF2/bcrypt) for common or popular programming languages and/or f...

passwords hardware gpu

Not sure if it's borderline acceptable... it's sorta asking for a list.

Lucas Kauffman

@TerryChia check the comments yo!

Terry Chia

@LucasKauffman Just did and replied. :)

Lucas Kauffman

14:16

@TerryChia sorry not aware of any libs, I know python has pycuda, but I imagine you will need to implement the algorithms yourself

@TerryChia you could make one yourself and share it on github

Terry Chia

@LucasKauffman Yeah, I'm not aware of any myself. I don't think they exist actually. O_O

@LucasKauffman That sounds like work.

Lucas Kauffman

@TerryChia we could do it together 'cause it looks interesting

Terry Chia

Plus I never get done with my personal projects, something else always distracts me halfway.

Lucas Kauffman

all we would need to do is port existing code to pyCUDA

@TerryChia yea I need to finish this OSCP course first too :p

Adnan

@TildalWave Tried it, didn't work.

Lucas Kauffman

14:19

@Adnan Try Harder!

Adnan

But it's alright now. I used GetDataBack NTFS

Brilliant piece of software

Terry Chia

@LucasKauffman OSCP's motto? :P

Lucas Kauffman

@TerryChia yes :P

Adnan

@Lucas It restored all the files with the old structure. I just lost some minor files that I changed manually.

Wooohoooo!!!

My side of the release is saved!

Lucas Kauffman

wow, there is this one guy who has been working all day alone on a construction site opposite our house, he's singing "Happy birthday to me!"

Adnan

14:22

@LucasKauffman Doesn't remind me of anybody :'(

TildalWave

@Adnan it's been a while since I needed any of that but yeah there's a lot of different tools, and most prolly paid

Lucas Kauffman

also:

github.com/georgiaw/Smartphone-Pentest-Framework

Adnan

@TildalWave Well, $80 to save your release and meet the deadline is probably nothing

TildalWave

@Adnan that's true

Lucas Kauffman

@Adnan I have a strange feeling you didn't actually pay that 80 USD

:p

Adnan

14:25

My personal inbox is:
- Enlarge your manhood.
- Get the secret to make her happier.
- @Lucas has endorsed you.
- Hey big boy!

I'm not sure how the LinkedIn email ended up in the spam folder

Lucas Kauffman

hahaha

Terry Chia

@Adnan Because it's from @Lucas.

Adnan

HOLY SHIT!

RUN RUN RUN RUN!

TheNSA

Carry on, nothing to see here.

Terry Chia

@TheNSA AHHHHHHHHHHHHHHHHHH

Adnan

14:27

@LucasKauffman They KNEW!!!

TildalWave

heh... Dark Side of The Moon cover?

Lucas Kauffman

@TheNSA I speak for all people in this chatroom when I say: Fuck You, now get ooouut

2

TheNSA

No, of course not. It's the PRISM logo.

Terry Chia

@LucasKauffman No you don't. I'm saying it myself.

Fuck you

TheNSA

@LucasKauffman Aww. We love you too.

Adnan

14:28

@LucasKauffman No no no.. you don't represent me.

I love the NSA. They're the best

Lucas Kauffman

@TheNSA now where's my money, I delivered you prism.py I want to get paid for it!

Terry Chia

@Adnan Suck up.

TildalWave

know your logo

Polynomial

@TildalWave with the stolen stock image ;P

TheNSA

@LucasKauffman Payment is still being processed, I'm afraid. You know how efficient things are...

@Polynomial That wasn't my fault.

Adnan

14:29

@TerryChia I happen to be quite weaker than a Predator-UAV-mounted Hellfire missile.

TheNSA

@TildalWave The album cover came up in google first, plus Dark Side of the Moon is pretty sweet.

Lucas Kauffman

@TheNSA Every single time, same happened when I wrote stuxnet.py for you guys. "This won't leak out, we swear!"

TildalWave

@Polynomial well yes... but still better to steal off an American server than off a British artwork, no? :P

Polynomial

@TildalWave kekeke

Terry Chia

@LucasKauffman Gib gib gib.

Adnan

14:30

@Iszi Fixed

TildalWave

@TheNSA agreed

TheNSA

@LucasKauffman We blame the work experience guy for that.

We blame him for a lot, actually.

Lucas Kauffman

@TheNSA He should be shot. (and I know you guys can do that!)

TheNSA

@LucasKauffman Who should?

Lucas Kauffman

@TheNSA Didn't I also get a free "kill card" with the job package?

@TheNSA the work experience guy

TheNSA

14:31

@LucasKauffman Don't know who your on about.

Adnan

Weekend started.

Lucas Kauffman

@TheNSA problem solved.

TheNSA

@LucasKauffman Yes, call 555-HELLFIRE. Express delivery guaranteed by Predator Drone.

Adnan

I'm going to do what I do on every weekend: Think of ways to help the NSA.

Lucas Kauffman

@TheNSA also watch out, we have several @Rory and a bear, we are not afraid to use them.

Terry Chia

14:41

@LucasKauffman I think The Bear is the NSA.

AviD

15:06

@LucasKauffman Loki: "I have an army." DMZ: "We have a @Rory".

Terry Chia

@AviD What is better than one @Rory?

TWO @Rory's!

AviD

and a BEAR!

Terry Chia

@AviD Since you are here: how much did you pay for your korean monitors again?

AviD

seriously, though, Let's try to keep the chatter here down to a low roar. ladies. I cant read a transcript of thousands of messages since yesterday, dammit.

@TerryChia 350 usd, plus local fines to the thugs...

Terry Chia

@AviD Ahhh. The Dell offer I linked earlier is a nice bargain then.

AviD

15:10

@TerryChia dint see it?

Terry Chia

2 hours ago, by Terry Chia

> 27-inch Dell UltraSharp U2711 2560x1440 LCD Monitor w/3-year Advanced Exchange Warranty for $549 with free shipping (normally $999 - use $450 coupon code SDW7RZ4J1P20BM)

AviD

@TerryChia yeah, nice - 550 < 1000. but still 200$ more than the korean, for near comparable performance....

TildalWave

@AviD how come you don't have the copy editor badge? The all times editor ranking shows you have over 1.4k edits and there's 500 of them required for that badge? :O

AviD

@TildalWave I know, right??

I am guessing that a lot of them are tag edits, and tag edits dont count.

or maybe something broke the trigger... like my diamond...?

TildalWave

@AviD And you have that much more tag edits? That's a bit strange

AviD

15:17

dunno

TildalWave

@AviD RoryA got it... dunno, seems odd

AviD

yes, yes @RoryAlsop does seem odd.

so, did I miss anything of interest in the transcript of thousands?

I mean today and yesterday of course.

Scott Pack

@TildalWave The reason @avid doesn't have it is because of tagging. Retagging counts as an edit, but does not count towards the editor badges.

AviD

@ScottPack what about teabagging?

Scott Pack

@AviD Teabagging your face?

AviD

15:23

retagging and teabagging, thats me...

Thomas Pornin

@ton.yeung Usual suspects are encoding issues. Make sure you input the exact same bytes, both for the message and the key. There are various ways to both the thing, including extra spaces, final newline character, or taking an hexadecimal string as a string instead of converting back to the bytes.

Come what may, take a SHA-512 implementation and the HMAC spec, compute the intermediate values, and see who is right.

gspr

15:42

Would asking a question regarding how to get started on a major overhaul of personal computer security be too vague a question to ask on the security stack exchange? In particular, I'd like to ask about recommendations for smart cards and readers and their integration with password managers etc in Linux, with the purpose of entirely moving away from password-based security

AviD

@gspr well, the 2nd part is a very small subset of the 1st, so you're on the right track.

you would still need to trim it down to something more specific, though.

gspr

@AviD: OK. Would it be OK to ask for recommendations for smart cards, what standards and brands to look for, and integration with browsers and password managers in Linux?

AviD

also its quite likely that, when you figure out what your specific question is, you'll find its already been asked - and answered - at least once already.

we have a LOT of password questions here...

gspr

Alright. I tried looking around for general "intro to smartcards" questions, but none really seemed to match

AviD

@gspr recommendations: no. Shopping questions dont work well on SE sites.

gspr

15:45

OK. But recommendations for features/capabilities in smart cards would be ok?

AviD

what standards, features, etc would make for a much better - and more interesting - question.

Polynomial

@ThomasPornin Any chance you could take a look at this if you get a sec?

gspr

Right. Makes sense, thanks

Terry Chia

@Polynomial You need a bigass bounty to attract the Bear. :P

Polynomial

@TerryChia or a salmon.

Terry Chia

15:46

@Polynomial Or both.

AviD

@gspr you do need to make it a specific match for your exact requirements, though - otherwise its really wide open with any of a dozen different answers being schrodingerly correct.

Terry Chia

@AviD "schrodingerly" - First time seeing it used as an adverb. Nice.

Polynomial

@TerryChia adverb.

AviD

hmm, I think that would be an adverb, though...

dang, ninjad!

Polynomial

@AviD ;)

well, I am British, we did spawn the language ;)

Terry Chia

15:48

Blah. Been a long time since I need to remember this stuff.

Polynomial

not that many of us seem to actually speak it, of course.

AviD

@TerryChia dick move, now we both look stupid.

Terry Chia

@AviD So in other words you look exactly the same?

AviD

@Polynomial yknow what they say, Americans speak the language that is closest to English.

gspr

AviD: Does my basic idea make sense to you? Here's a summary: Too long have I skimped on password security. I'd really like to take some time to improve fundamentally, and I've been thinking of beginning to use a hardware token to unlock SSH/GnuPG/other keys and to control access to a password manager storing new, huge and random passwords.

Polynomial

15:49

@AviD Lies! They speak Americanese!

AviD

@TerryChia couldnt pass up a chance to correct the grazzi... ;-)

Polynomial

which is half-way between English and Mexican.

AviD

@Polynomial it's close!

@Polynomial lol

Terry Chia

@AviD :)

gspr

In short: I'd like to comprehensively revamp how I think about authentication, and for a private individual with limited means, basing the approach on smart card unlocking of a password manager seems reasonable at first sight

AviD

15:50

@gspr fair enough, but its missing some specific context. Also - don't forget the affect on usability.

Terry Chia

Did I ever share this video with you guys?

►

gspr

AviD: True

Scott Pack

@Polynomial Aren't you thinking of Spanglish?

Polynomial

@ScottPack Yés.

gspr

AviD: Thanks for your comments.

Scott Pack

15:52

@Polynomial I think you mean "Jés!"

Polynomial

indeed

AviD

@TerryChia excellent!

Polynomial

Spanglish should be English written such that Spanish pronunciation results in the same as English pronunciation.

e.g. Békon

I wrote a tool called SQLrillex. When you run it, it drops all databases.

Tweeted by wimremes on May 8, 2013 at 7:27 PM

5

hahahahahahahahahaaaa

pmsl

Transcript for