The DMZ

Gilles

00:16

@TildalWave I wasn't satisfied with any of the answers so I expanded: security.stackexchange.com/questions/3170/…

Gilles

00:26

@evilsoup If the software is properly written and configured, then no, Google won't be able to read its contents and hence will not be able to cache it. I can't tell you whether the specific program you mention in your question is well-written or easy to use, that would require a security analysis which is far more than what you can expect from a Stack Exchange post (doing this in industry would typically run into ~10k$). — Gilles 7 mins ago

that's good enough for me, if you can expand that comment into an answer, perhaps with some information on what exactly 'properly written and configured' entails (so that I can put some questions to the forum software devs) then I would accept it. — evilsoup 1 min ago

hem

TildalWave

00:49

@Gilles meh, all he needs is password protected access to it .... which seems to be your theme of the day :))

D3C4FF

01:01

soup all

TildalWave

@D3C4FF morning! :)

D3C4FF

How goes it? @TildalWave

TildalWave

@D3C4FF Fine, you? Here tho, seems @AviD was particularly enjoying himself today :)) (check the star wall)

D3C4FF

@TildalWave Indeed. I hope someone films @AviD being kicked in the nuts by 15 different women!

TildalWave

@D3C4FF hehe that'd be nuts :)

D3C4FF

01:10

xD Glorious transcript.

@TildalWave just fyi, he wasn't a real politician :P

TildalWave

@D3C4FF yeah I figured it's acted but after I posted here... there's more of those in there they're all pretty hilarious... I love that one with the oil tanker's front fell off ;))

D3C4FF

@TildalWave "clarke and dawe" :)

TildalWave

@D3C4FF tho that ograsm video is real... you've seen it, right?

►

D3C4FF

@TildalWave @AviDs one of him being kicked in the nuts? :P

@TildalWave Hahaha yeah, its real xD

Classic

TildalWave

@D3C4FF neah kicking in the nuts is clearly against the family friendly policy of DMZ :)

in more ways than one ;)

D3C4FF

01:19

@TildalWave If i had a family i'd choose death for them over spending an hour in the DMZ

:P

TildalWave

@D3C4FF I think @ScottPack would disagree, he's clearly found ways to enjoy having a family AND being here... where else could he share his findings on how water proof his children are, and till what depth can they be considered water resistant? :)

Tho I think his terminology is a bit off... most commonly, the question is at what age are they watertight ;)

D3C4FF

@TildalWave After the age of 18 all bets are off :P

Terry Chia

02:47

@AviD Don't worry, that's about the most tragic scene for now, there is quite a drastic drop is death after that point.

Terry Chia

03:21

Lifetime OWASP membership for $500. :O You get a metal membership card. That's kinda cool.

D3C4FF

@TerryChia I do like OWASP....

Terry Chia

@D3C4FF Wrt to your question, sounds like the kind of fun the people at Offensive Security do: offensive-security.com/offensive-security-solutions/…

D3C4FF

@TerryChia Yeah, its not that its not an interesting/fun thing, i'm just a bit concerned about potential 'collateral damage' and since its something that i've not tried outside of my labs, i'm not sure what (if any) is the best approach

TildalWave

03:41

►

dude this is insane ^

Adnan

04:00

No need for any weighing in. Just read the guy's comments.

0

A: Why store the password salt instead of generating it?

It looks like you're talking most specifically about web applications [since your example code is in PHP]. Like the other poster said, taking the salt directly from the password itself poses an increased security risk when two users chose the same password. However, taking the salt from the Use...

Terry Chia

> Using a random number generator, however, you run the chance of duplicate salts.

What shitty RNG is he using?

Adnan

@TerryChia Read the line after to know it. He's thinking of hashing the timestamp

Terry Chia

@Adnan His scheme isn't bad. It's just an overly complicated way of accomplishing something that can be solved by get_some_bytes_from_your_rng().

TildalWave

@Adnan If you read his comments a bit more carefully, you'll notice he's having a revelation moment here, figuring it out what salt is to the password hashing as he's typing it down... first by getting it wrong, then being corrected, then agreeing by not saying it so, and failing on some other point... ad nauseum

Adnan

@TerryChia This is exactly why I didn't downvote his answer; it's not a bad answer. My problem is with his whole idea about security

I mean come on! Only script kiddies would pre-compute hashes?

Terry Chia

04:13

@Adnan Yes. The real pros let someone else precompute them.

;)

Adnan

You can't seriously call yourself a pentester without pre-computing some rainbow tables for root, admin, and administrator before launching your attack.

Lucas Kauffman

Morning

Adnan

Okay, that was probably an overstatement.

Morning @Lucas

TildalWave

> This is security by, well.., security.

Adnan

@TildalWave I know! It made me laugh when I wrote it :D

TildalWave

04:27

@Adnan I can't even wrap my head around it, it's too early... but I like the sound of it.

Adnan

@TildalWave Oh you've just reminded me of a club song I hate!

> Sex in the air, I don't care, I love the smell of it

D3C4FF

@TildalWave Psch. I've done 1,417.32 Ft climb. And instead of catching a freaking elevator. I actually climbed it ALL.

TildalWave

@Adnan that sounds so teenager-ish ... 1) something 2) who cares 3) but I love it

D3C4FF

Took 10 hours up and down

Adnan

@TildalWave and that's why some mixes of this song are heavily used in clubs.

D3C4FF

04:30

That's a not even 1000Ft

TildalWave

@D3C4FF Oh man you know we have mountains also here ... but that's still kinda nuts, imagine the wind and all the movement of the construction with it, you don't see that on his helmet cam... and nothing much to hold on to, and no security line at all... dunno seems pretty bold to me

Adnan

@D3C4FF What did you climb?

D3C4FF

VLF Transmitter Woodside

Woodside Omega Transmitter (station G, now Woodside VLF transmitter) near Woodside, Victoria, Australia uses an umbrella antenna carried by a high grounded lattice steel guyed mast. Unlike many of the other Omega Transmitters, Woodside is not a "hot tower," that is, one which is insulated from a ground connection by large ceramic insulators that support the entire weight of the structure. Rather, the tower is electrically insulated from the topmost guys which served as the radiators, similar to the metal radials of an umbrella without cloth covering. The mast simply supports the downw...

@TildalWave All we had was scaff hooks, same as that dude climbing, but we set up ropes to rappel down.

So it was 6 hours up, and 4 hours down...

Adnan

@D3C4FF Damn! That's almost half a kilometre of that! That's awesome!!

D3C4FF

@Adnan Yeah, fucking intense.

Oh, did i mention there was a storm rolling on by as well?

TildalWave

04:33

@D3C4FF I don't think you watched that video till the end... or at least till two thirds of it

Adnan

@D3C4FF I always think about doing it. It's just there are really strict laws about that here.

D3C4FF

TildalWave

@D3C4FF you would love some caves here ... well, syphons really, but some are over 1km straight down

Adnan

@D3C4FF Did I already say that I hate you? Because I do now!

D3C4FF

@TildalWave Better? 500m of nothing below :D

Adnan

04:38

@D3C4FF Scratch that.. damn!

You got me really excited!

3

D3C4FF

last one for ya @Adnan @TildalWave

TildalWave

@D3C4FF nice exposure :)

D3C4FF

Nothing like a good view of the milky way ;)

Adnan

@D3C4FF Where did you put the camera to make it so stead for the whole period?

D3C4FF

@Adnan Pushed it over the balcony on the tripod, sat on the feet and hoped to god the quick release would hold :P

Anyway, plan is to learn base jumping, and save my self 4 hours of down climbing next time :P

TildalWave

04:51

@D3C4FF you did your landing training? you land pretty darn fast with base jumps and the spare shoot only

D3C4FF

@TildalWave Never jumped out of anything ever :P

I'm sure i'll pick it up ^_^

Adnan

Hearing people talk about awesome stuff, and I'm thinking...

TildalWave

@D3C4FF well I doubt you wanna learn by breaking every single bone of your body on your first jump, so you better take some courses and do a few normal jumps out of an airplane first

D3C4FF

@Adnan You gotta get outside, and then masturbate ontop of a tower half a K up in the sky

I pee'd off the top of the tower :3

@TildalWave Its probably not a bad idea...

Terry Chia

@TildalWave Wait, jumping out of an airplane is a normal jump? What's abnormal?

TildalWave

04:56

@TerryChia forgetting your parachute for one

Adnan

@TildalWave You know when you're going down the stairs, and there are those last three ones, I jump them all at once. Does that count?

Terry Chia

@Adnan Obviously not. Stop showing off until you jumped four at a time...

Adnan

@TerryChia but but but.. I need more training!

D3C4FF

►

@Adnan @TildalWave @TerryChia watch this trailer/movie :P Its awesome :D

especially the guy on the slackline, 'Sketchy Andy'

Adnan

@D3C4FF Jesus! The guy who fell at the end!

D3C4FF

05:01

@Adnan xD

Adnan

@D3C4FF Oh yeah, and fuck me long-ass comment on your question, right?

D3C4FF

►

Terry Chia

@D3C4FF Holy shit.

D3C4FF

This is what happens in Australia when people get bored in the city :P

@TerryChia Now i feel like going climbing again!!

Terry Chia

Anyone a fan of Jimmy Eat World here?

Adnan

05:10

@D3C4FF Since you know your way around these stuff, what is that technique you use when you jump from 1.5-3 meters and you break your fall so you don't break your foot?

I tried to Google but couldn't find anything useful.

D3C4FF

@Adnan You take as much shock through your legs/lower body, store than energy in them as 'springs' and then leap forward converting the rest of the energy into forwards momentum which you use to roll diagonally across your back forward...

And practice.

From smaller heights. Cause otherwise you'll break the tiny bones in your feet

:)

That's how i think of it anyway ...

@Adnan make sense?

Adnan

@D3C4FF It does. I just thought that it had some kind of a name

D3C4FF

►

"Parkour Roll"

@Adnan If you plan on trying it, i suggest starting on grass from like 20 cm high, and practicing rolls only on concrete (you'll know 100% when your doing it wrong as your back will be torn to shreds)

I did parkour for... 4-5 years?

But haven't done it in about 8 months since i started doing muay thai and climbing more often

Adnan

@D3C4FF Oh no, I don't plan on doing parkour at all. Your video just reminded me that sometimes I'm in a situation where I need to jump a meter and something, and I want to minimize impact on my knees and ankles.

@D3C4FF but yeah, this video is very helpful. Thanks

D3C4FF

@Adnan i wished i lived in Europe, it'd be heaps more fun there... super dense population. Sydney, Melbourne and Brisbane all have really spaced out cities/suburbs

Makes doing all this kinda stuff quite hard

Adnan

05:22

@D3C4FF That definitely doesn't apply here.

D3C4FF

@Adnan which part?

@Adnan No i mean, its super dense or spaced out?

Adnan

@D3C4FF Spaced out

D3C4FF

@Adnan Yeah, so you should take advantage of your parkour-able city :D

Adnan

@D3C4FF Damn! I think I'm a bit confused.. wait wait..

Spaced out does apply.

D3C4FF

Oh, so its like Aus, where you can't readily jump between buildings?

Adnan

05:25

@D3C4FF Exactly

D3C4FF

@Adnan Ah :( Then you can feel my pain :P

Terry Chia

@D3C4FF Just curious btw, what pen test company are you working for?

D3C4FF

@TerryChia A small private firm, not Stratsec or something :)

Lucas Kauffman

@D3C4FF D3C4FF Security ltd.

D3C4FF

But i don't want to associate this account with them in any way, cause i ask questions here which relate to engagements from time to time and it'd be bad for them to get linked back at any point

@LucasKauffman Oh shi-!

Terry Chia

05:31

@D3C4FF Cool, understood. :)

Terry Chia

07:16

@Adnan Why does it not help the asker?

> If an attacker has the ability to add a self-signed certificate to your trusted store, the browser will verify that the fake website the attacker is using to attack you is in fact authentic. This has obvious security implications as you will have no ability to verify a website's authenticity through the SSL certificate.

I explained the risk of having the ability to add self-signed certs....

Adnan

@TerryChia The key here is.. "by an attacker". The OP's question is about temporary development certs that he obviously trust (after all, he added them himself). If an attacker has enough access to install self-signed certs on your machine, then they have enough access to install a keylogger or, heck, a rootkit.

I took back the actual -1 because I think it was a rush judgement. Your answer is not useless, I apologize for the quick judgment.

But I still think it does not answer the question.

D3C4FF

@Adnan @TerryChia i'm with Adnan on this one, it addresses the issue of self-signed certificates but it doesn't answer the question of the OP

Terry Chia

@Adnan @D3C4FF Ok.. Then is there an actual security risk? I don't think so right?

D3C4FF

@TerryChia yeah, and that's the question. Because the linked article says there is a risk. So he's confused ;)

Adnan

@TerryChia I think I agree with this. I don't see any risk here. You created the cert, you added it.

Terry Chia

07:31

@D3C4FF @Adnan Alright, I'll edit my answer a bit. There should be no risk unless you stupidly publish the root CA cert somewhere.

Adnan

Now, there is and offshoot risk. Maybe they mean that if you're used to seeing your own self-signed certs then you want notice malicious ones. So it's sort of human-based attack multiplier (multiplier? I don't remember the actual word)

Terry Chia

@Adnan What? 10x score bonus for an attacker if he finds random certs in your trusted root store? ;)

@AviD @RoryMcCune @D3C4FF Mobile Haswell parts: arstechnica.com/gadgets/2013/06/…

Adnan

@TerryChia Well, like I said, offshoot.

Terry Chia

I'm thinking the Haswell chips will make a Retina Macbook Air an actual possibility.

Adnan

Yeah.. thanks to me!! :D

@Terry I'm famous now!!

Terry Chia