The DMZ

8:49 AM

@RoryAlsop good lord that's wrong

9:16 AM

You're missing my point. I'm gonna say it again: Your analysis is 100% useless. You didn't track anyone. You're just fighting windmills here. And yes, there's always some that find that useful and would follow one with seemingly just cause on a donkey if they had to. Lack of knowledge perhaps, like the comment suggests? BTW, you're still not actually showing how this is phishing. Have you heard of "spam"? — TildalWave 14 mins ago

Too harsh perhaps? I hope he'll at least get the reference to Don Quixote.

CodesInChaos

@TildalWave I think the part starting with "And yes" is barely comprehensible.

TildalWave

@CodesInChaos maybe I should use "righteous cause" instead of "just cause"

or "worthy" ...

it's too early to spawn a complete vocabulary ... or make too much sense :P

Lucas Kauffman

@RoryAlsop Also known as the "insta-heart-attack" burger

CodesInChaos

9:48 AM

@TildalWave It's mainly the sentence structure that makes it confusion. All those "that"s and "one"s for which you need to figure out what they refer to.

TildalWave

@CodesInChaos it's a reply to a comment, click on the timestamp link for context

raz

12:17 PM

Good morning

TildalWave

good morning @raz

raz

Got out of Jury Duty yesterday

TildalWave

torrential rain here so it's not such a good afternoon now ... almost as dark as in the night and it's 1 pm

@raz Was it at least interesting or did they bore you to death? How long did it last?

raz

It was interesting for the 10 minutes I was in the court room. But most of it was just waiting around.

Almost a whole day, it was a multiple kidnapping and homicide trial. Would have lasted 5 weeks.

TildalWave

would have?

and jeez you got a heavy case there

raz

12:27 PM

Yeah, lol

TildalWave

My only one so far was a trial of one that instigated a bar fight that ended in GBH to a third person. And it wasn't all that grievous either. All of it was pretty boring.

raz

GBH?

TildalWave

Grievous bodily harm, aka serious injury (open to interpretation)

in that case it was really just a broken nose and a few cuts and bruises

yawn

Arperum

12:45 PM

@TildalWave Doesn't sound all that serious to me.

TildalWave

indeed

Prosecutor went for intent ... which was basically just threats to ward off one of the attackers ... didn't pass since the weapon used to threaten with was never really used, just displayed. The rest of it was just a "normal" bar fight

raz

Seems reasonable to me

TildalWave

All of it sounded like a badly scripted soap opera. Also, why do lawyers never speak normal? Even common words seem to have completely different meanings at courts.

Arperum

@TildalWave They never told you that words do mean different things at courts?

TildalWave

> Please note that I am not implying, neither am I suggesting, that all — or even any — web developers are sane or know enough about what they are doing to realise that what they are doing would be be insane if they knew what they were doing.

I LOL-ed

@Arperum Sure. The judge addressed us and explained in detail what our duty was and how to interpret what we heard. It's only then that I realized this actually. Before, I just thought a few of them had a stroke or something.

CodesInChaos

12:58 PM

@TildalWave Probably for the same reason programmers never speak normal either.

TildalWave

here, you can't really ask for clarification during the trial ... so you'd write things down, ask questions later

@CodesInChaos we !do?

Simon

@RoryAlsop This is the confirmation that heaven exists.

Adnan

1:23 PM

Remember that professor I was talking about? The OOP guy

He said that question like "What is a source code? What is a class?" are gonna be in the exam.

:|

Simon

Shouldn't be too hard eh?

Adnan

When you have to answer in the same exact way the teacher wants, then it is hard

Simon

True.

Adnan

I said "Instructions that humans understand and a compiler translates into instructions that a CPU understands"

He said that it's wrong

Then he recited the Wikipedia definition

Simon

Oh boy.

He's that type of teacher, great.

Adnan

1:26 PM

"source code is any collection of computer instructions (possibly with comments) written using some human-readable computer language, usually as text."

That's what I should have answered

Simon

Your definition actually has a deeper explanation so he's just a horrible person for saying it's wrong.

Arperum

@Adnan That's what you actually answered, only worded better.

I suggest answering your way and changing the definitions on wikipedia to fit your more detailed answer.

Simon

Haha.

Adnan

@Arperum I have experience with this professor. If you don't answer exactly what he has in his material, you're screwed

Arperum

@Adnan If that was Belgium, I'd suggest answering properly, and when he fails you for correct answers, fighting it at the correct place (who's name I can't remember, and don't ever knew in English)

Thomas Pornin

1:57 PM

@Adnan Well you know how the exercise goes, then.

Don't think. You just have to parrot word-by-word definitions.

This is not a course about learning, it is a memory exercise. If I were so bold, I could say that it is a giant Simon game.

Simon

wat

Thomas Pornin

@Simon You know, the thing that you use for your account picture.

It was a real thing back in the days; I have touched some.

(Never owned one, though.)

Simon

Oh, I'm kind of disappointed that it wasn't something mean directed towards me.

Thomas Pornin

@Simon Someone who uses a Simon game as his avatar is already quite beyond any additional meanness.

TildalWave

@ThomasPornin You have touched some @Simon's?

I actually have one ... somewhere ... in the loft or wherever

Simon

2:08 PM

@ThomasPornin Aaaww, thanks!

Adnan

@ThomasPornin Yup, which sucks.

After the class, I'll see if I can convince the teacher to allow me not to attend and just create some course project

Arperum

@Adnan Good luck.

Adnan

I've already done that with other professors, but this one believes in "traditional teaching", whatever that means.

Arperum

@Adnan According to him it seems to mean "be a parrot and shut your stupid mouth already!"

Thomas Pornin

@Adnan You can rationalize it by taking it as a training course for your professional life (during which you will have to endure worse).

Unless you marry Paris Hilton, although that is also a kind of hardship.

Simon

2:16 PM

@ThomasPornin Then what, you gotta endure the stupid things she does, like claiming music is her passion and pretend she can DJ? Fuck that.

Thomas Pornin

@Simon Yeah, but she is filthy rich, too. You gotta consider all facets of the problem.

Rory Alsop

@Simon those are the best things she does

She can't even make good videos

ahem - apparently

@ThomasPornin that is also a problem, yes

Simon

@ThomasPornin I've sworn to myself that greed will never take over my actions.

Arperum

@Simon Think of all the donuts you could eat!

TildalWave

@Simon but not inactions?

Simon

2:20 PM

@TildalWave Choosing to not act is an action to me.

@Arperum I would just die.

TildalWave

@Simon fair enough

raz

3:18 PM

Does this make sense to anyone else? security.stackexchange.com/questions/72432/…

Thomas Pornin

@raz Yes, I understand his problem.

AJ Henderson

security.stackexchange.com/questions/72419/… could use some close votes

raz

@ThomasPornin Could you explain it? I'm a bit confused

Xander

@raz His problem is that he needs to be able to do some form of plaintext matching for search purposes, without having to either) first decrypt everything in the database to compare it to these plaintext search terms or b) compromise the confidentiality of the encrypted data.

CodesInChaos

There are quite a few papers on "searchable encryption".

raz

3:32 PM

@Xander Why can't he just store hashes of the data he's searching for?

He's talking about text related data

AJ Henderson

@raz because if I have "Bobcats" encrypted and I search for "Bobcat" the hashes will be completely unrelated

CodesInChaos

@raz Standard guess and confirm attack if the data is short or guessable.

AJ Henderson

but yet it should still find the relationship

CodesInChaos

and for substrings everything goes to hell.

raz

@AJHenderson I see

AJ Henderson

3:34 PM

note that the more common approach (encrypt the search value) still has that limitation, but avoids the guess and confirm attack

while not requiring mass decryption

CodesInChaos

Personally I wouldn't use database encryption for fields than are used as search key of any form - not even with simple equality matches.

AJ Henderson

but it only helps for exact matches

CodesInChaos

The security gain is far too small for the trouble.

Simon

You're a security gain.

2

AJ Henderson

@CodesInChaos yeah, but sometimes that isn't possible, for example, if you need to be able to search on social

raz

3:35 PM

@CodesInChaos yeah I think this is what I'm hung up on. It seems like an awful lot of work for almost no gain.

AJ Henderson

sometimes you need to search on data which also must be kept confidential

Simon

@raz No pain, no gain, bro.

AJ Henderson

that said, there are certainly ways to minimize the impact

like having a lookup table of socials to non-social IDs

CodesInChaos

@AJHenderson I'd rather focus on keeping the computer that works with them secure. Minimal attack surface. FDE instead of DBE to protect data at rest.

AJ Henderson

except that there are legal requirements about encryption of some information

my general approach is to have a table that you do one expensive lookup that matches you to an id that can be used as the index in all your actual records

thus minimizing the amount of expensive searching

Simon

3:37 PM

@ThomasPornin My apartment will be uninhabitable for possibly one week to four. I have given your information to my insurance company. They should be calling you soon enough to let you know that my gf and I are temporary moving in at your place.

raz

@AJHenderson Yeah I can see the problem now. But there's got to be a way to ID the encrypted data without implementing an encryption searching scheme

CodesInChaos

You can sprinkle on some crypto to satisfy auditors. You need one minimal secure system that does tokenization and stores the actual secret information.

Everything else operates on those tokens.

AJ Henderson

@CodesInChaos yeah, that would be what I just said :)

CodesInChaos

But I believe crypto within the tokenization server has little security gain. FDE so you can throw away harddisks is the only part that matters.

AJ Henderson

@CodesInChaos nah, it has plenty of security gain, you successfully hide the public identifier

the concern is preventing information leakage from your system that could be used with another one

CodesInChaos

3:40 PM

@AJHenderson The hiding happens via tokenization. No crypto needed.

AJ Henderson

well, you just need crypto on the public values

CodesInChaos

what does that crypto do?

AJ Henderson

it doesn't matter if someone knows which records are mine, what matters is that an attacker can't determine that my SSN is 012-34-5678

(note, not my actual SSN)

CodesInChaos

@AJHenderson ORLY?

AJ Henderson

wow, I can't believe that question about changing a GUID identifier in a program hasn't closed yet. All the 3k's must be asleep this morning

Simon

3:47 PM

@CodesInChaos You're such a liar. On your SE profile, it says your location is Frankfurt, Germany. On Google+ (lulz), your location is Munich, Germany.

raz

@Simon His life is a lie!

Simon

@raz I knooooow!

Thomas Pornin

@Simon What happened to your apartment ? Cockroach infestation due to your massive stockpile of doughnuts ?

Simon

@ThomasPornin Centipedes infestation would be more likely. Those things are horrible.

CodesInChaos

@Simon Didn't update Google+ since I barely use it.

Simon

3:49 PM

But nah, main drain is broken which means that it gets clogged every ~5 days.

raz

@CodesInChaos Woah woah woah woah Miss Lippy, you're telling me that no one uses Google+!?

Simon

Which means there's shit coming from the toilet, bath tub and the sink.

@CodesInChaos I'll believe it the day you'll send me some proof.

Xander

@AJHenderson Given how adamant he is about it not being a programming question, I'm having reservations about my vote to migrate to StackOverflow. Not because it doesn't fit, but because he doesn't want it there. I think if I had a do-over at this point I'd just VtC as off-topic and be done with it.

Rоry McCune

@Simon this sounds like the plot of a bad american sitcom...

raz

@Xander Yeah, agreed

Simon

3:51 PM

@RоryMcCune It couldn't be bad if I'd be acting in it, come on now.

Rоry McCune

@Simon hmm that's a perspective I'm sure

Simon

You donut.

I still have nightmares about when I ruined the poor donut during my IBC.

CodesInChaos

@Xander Bit annoying that SE says that I migrated it, when I just VtC.

raz

Ahahahaha, he must be kinda pissed it just got migrated to SO.

Xander

@CodesInChaos Yeah, would be nice if it was more transparent.

raz

3:57 PM

@Xander Sounds like a Meta question/request!

Xander

@raz Yeah, but oh well. I still think it's a decent dev question, so maybe a good answer will come of it anyway.

CodesInChaos

The taken literally would probably best fit reverse engineering. But I suspect that he's asking the wrong question.

Xander

@raz I can't be bothered with meta for anything that isn't site-specific. I don't care about SE globally that much.

CodesInChaos

@raz I'm pretty sure there were several.

raz

@Xander You know sometimes I question your dedication to Sparkle Motion.

Xander

3:59 PM

@CodesInChaos Yup, exactly. He's jumped to a specific solution instead of trying to figure out the root problem.

raz

@CodesInChaos I left a comment pointing him to RESE

AJ Henderson

@CodesInChaos in fairness, you don't actually show up on the log of people that migrated when looking at failed migrations

even if the comment itself for the close is misleading

@raz that's too bad if he is, it is the right place for the question

personally, I have no problem with migrating something where it belongs even if the OP doesn't think so

CodesInChaos

What's silly is that they implemented proper comments when people vote as off-topic give different reasons.

raz

@AJHenderson I know, I'm just amused by other people's misfortunes

AJ Henderson

at least if they aren't a high rep user

if they are a high rep user with a good idea of site scopes, then I might pay a little more mind to it

but for a user with approximately 2k rep network wide, I'm not to worried about putting it where it belongs even if he disagrees

3

A: Hashing a hard drive before shutdown

Impossible. First, there is too much data. It would take a VERY long time to compute a hash of the entire HDD every shutdown and again for every boot. That by itself isn't impossible though, only infeasible. Second however, even if you were willing to wait that long, values are going to chang...

Sec.SE - crushing the dreams of the security paranoid since... when did we start again

CodesInChaos

4:10 PM

The main problem is that it's a badly written question, especially in the context of SO. It's written with a reverse engineering assumption, whereas for SO it should be written from a software developer point of view.

@AJHenderson Just use an incrementally updated tree hash. Easy.

AJ Henderson

@CodesInChaos see the last part though, unless it isn't the bootable drive

I suppose I was running on the assumption it was a system drive

if it's dismounted, it becomes more possible

though still hard

CodesInChaos

I think ZFS even implements most of that.

You can simply use incremental verification of the piece of data whenever you read it from the hard disk. Obviously you still need a bit of code to boot into the verifier securely, but that piece is pretty small.

AJ Henderson

the main problem is that he wants to verify that someone with the keys hasn't changed anything

raz

@AJHenderson This is why I offered up something like TripWire. It'd log file integrity. He just has to check the logs when he mounts the drive.

AJ Henderson

@raz how does it manage that in a way that can't be compromised offline?

if you have the keys, you can alter things willy nilly at will

he would need something that could be loaded off the drive that couldn't be faked

that's a HARD problem

raz

4:15 PM

This is true

@AJHenderson Agreed! I think we just came up with a great idea for a product. $1 million idea in fact!

But lets not jump to conclusions

AJ Henderson

I might be overstating at "impossible" but "highly impractical" I'd put money behind

mostly because every system design I know of assumes you are boned if you lose the encryption key

raz

@AJHenderson Common sense tells you you're boned if your encryption key is compromised.

Maybe data integrity isn't your biggest problem right now.

AJ Henderson

there are unauthenticated file integrity things that are good, but they can be faked if you have full access to the drive. Fundamentally you would need some identifier (like a hash) that summarizes the entire system in an independently verifiable way

and that means full drive scans are the only option I can think of

raz

@AJHenderson That would take forever

AJ Henderson

and that has to be done while the drive is offline

because if the drive is online, the attacker may be able to hide themself

raz

4:19 PM

But it's encrypted when it's offline.

So who's on first?

Xander

0

A: How different should my passwords be?

Here is a framework I use (YMMV) that is based on the typical CISSP approach to passwords (something you know, something you are, something you have). I break my password structure down into these three topics with character substitution. Currently I never re-use password, my typical password is ...

AJ Henderson

hence why I'm willing to put money on it being incredibly impractical

Thomas Pornin

@AJHenderson If you can arrange for the filesystem to have a tree-like structure, then you "just" have to guarantee integrity of the tree root, and you can have progressive validation and relatively efficient updates.

Xander

That's the most....Interesting, let's say, take I've ever seen on multi-factor auth.

CodesInChaos

@ThomasPornin TahoeLAFS has that property, but it's designed for remote storage.

ZFS has something similar, but their implementation focuses on integrity checking and deduplication. Not sure if it's secure.

Some file sharing applications use tree hashes for incremental verification as well. (I think DC++ uses Tiger Tree Hashes)

AJ Henderson

4:26 PM

@ThomasPornin so basically bubble up the changes of the hash and hash the hash of the subfolders. Yeah, I could see that being workable, though if you can mask a change long enough to compromise the USB copy, then the attacker still wins

unless you fully check that all the written hashes are valid

which puts you back at full verification

unless you mount it in a way to prevent all possibility of execution off the drive

CodesInChaos

@AJHenderson That hashing could follow the directory structure. Alternatively you can also use pieces of a raw block device.

AJ Henderson

@CodesInChaos either way, my main point is that if you can smuggle in an active attacker, you don't necessarily have to hold up to verification all that long, though I suppose if it custom mounted and only read off files that validated, you'd be ok

because the attacker's stuff wouldn't have a valid hash

CodesInChaos

You at least need to load a trusted boot loader.

The boot loader can then apply incremental verification to the pieces of the disk you read.

AJ Henderson

@CodesInChaos yeah, this only works with an offline drive that you can get things initialized before loading it

CodesInChaos

You can store hard disk in an untrusted location that way.

AJ Henderson

4:31 PM

or I suppose you could do it by booting from the USB stick

CodesInChaos

But you still need to keep Bios&co in trusted places

since those can mess up security.

AJ Henderson

yeah, well it sounded like in this guys case he trusts the hardware, just not the HDD to have been unmodified

(which is also a bit of an odd threat model, but hey, I'll run with it)

CodesInChaos

In the context of TahoeLAFS that's a pretty reasonable model: You store the data encryption in the cloud.

You can detect modifications by a server.

Simon

@CodesInChaos What kind of cloud? Is it a cirrus uncinus?

CodesInChaos

And error correction codes mean that several severs have to tamper with or lose data before you're unable to recover it.

Pretty cool, though a bit complicated for my taste.

AJ Henderson

4:43 PM

ok, I think I have my answer refined to a point where I'm happier with it and have more explored the highly specialized cases that would help try to get it working

Simon

But you still don't own a single donut.

raz

@Simon Your face is a donut

Simon

@raz I don't think my gf would appreciate that you're talking dirty to me.

AJ Henderson

@Simon that's just because I keep eating them

they are far too tasty

raz

@Simon Your mom's face is a donut.

Simon

4:45 PM

@raz You can tell her if you like, she won't understand a single word.

Tinned_Tuna

5:11 PM

0

Q: Hashing a hard drive before shutdown

Problem: Currently have no way to verify integrity of my offline encrypted system. I would like to ensure the system hasn't been physically tampered with while I've been away from it. (To clarify:while I am aware that the system cannot be modified without gaining access to the my encryption key....

integrity

Are luks et. al. all using non-CCA secure cipher suites? I.e. attackers can modify the ct on disk undetected? That seems like fairly basic stuff they're missing...

AJ Henderson

@Tinned_Tuna he's worried about detecting changes if the attacker has the key

so effectively, the encryption is irrelevant

Tinned_Tuna

@AJHenderson indeed

Must've misread the question in that case.

As an aside to the question, do LUKS, etc. enforce integrity checks?

AJ Henderson

yeah, he kind of mentions it as an aside

Tinned_Tuna

yea, but other commenters directly contradict him: security.stackexchange.com/questions/72439/…

Anyways, I'm off home.

Simon

bai

David Freitag

6:05 PM

Woohoo my oneplus one just got here

Simon

@DavidFreitag Looks like a cool device.

CodesInChaos

@Tinned_Tuna Most FDEs don't use integrity checking. Integrity checks increase the size of the data which is problematic when encrypting at the block storage level.

@DavidFreitag When did you order? I'm still waiting for mine.

Simon

Is it gonna work on any carrier?

Xander

6:27 PM

@Simon I was wondering the same thing. Here's a list of provider compatibility I found: forums.oneplus.net/threads/…

Simon

@Xander Ah cool, thanks.

David Freitag

6:51 PM

@CodesInChaos When the preorders opened on last monday

@Simon All but Verizon

Oh and sprint apparently

Simon

I'm getting really tired of my S2.

It's laggy as hell.

David Freitag

If I hadn't already sold my Nexus 5 I would have offered to sell it to you

Simon

That would have been nice.

Xander

@Simon My wife had to go back to her S2 for awhile when the screen on her S4 broke and we had to send it in for repair. After having gotten used to the S4, she couldn't stand the S2 any more. It is definitely a phone that has outlived its usefulness.

Simon

@Xander Oh yeah, I can totally see that. When I see my gf navigating on her Nexus 5 I'm just thinking of all the seconds I waste while waiting apps to open, sigh.

Xander

7:00 PM

@Simon LOL, 'zactly.

Simon

I like its shape very much though, that's the perfect size for my tiny hands.

David Freitag

So @Simon you know how big your girlfriend's nexus 5 is? The oneplus one is 0.5" taller and 0.25" wider

Simon

@DavidFreitag I know but it seems that you can't get small high-end phones these days so I'm just gonna have to get used to it.

David Freitag

7:53 PM

@Simon I knooooow. I really wish the oneplus one wasn't as big as it is, but like I did with my nexus 5 I'll just have to get used to it

raz

8:08 PM

I wish I had a oneplus one

Simon

I wish I had a donut.

raz

@Simon You always wish you had a donut, you donut

Simon

@raz Good point and well said.

David Freitag

@raz It's so massive

Simon

Just like my D.

David Freitag

8:15 PM

I really need to get a micro usb -> ethernet adapter

Simon

What for?

David Freitag

The shitty wifi and general lack of signal everywhere I go

and relative abundance of ethernets

Simon

ah

raz

@DavidFreitag Didn't we already have this discussion...

David Freitag

@raz I have the memory of a goldfish

raz

8:21 PM

lol

Right, and you don't want the double adapter thing to happen

David Freitag

Oh that discussion

Yeah I'm a professional procrastinator. I majored in self destruction.

5

raz

Sounds like fun

Also, why do people think that removing the "Thanks" as being an editable improvement?

David Freitag

Yep, luckily I handle stress so well.

Xander

@raz They like getting edit rep.

raz

@Xander I hope they like getting rejected too

Simon

8:25 PM

@raz Please stop rejecting my edits.

Xander

@raz Apparently they don't mind, because I keep rejecting the same ones over and over again. Although we have some serial approvers around who blunt the effect a bit...But I reject 'em on principle anyway.

David Mulder

Hey Guys, although I don't feel like getting into semantics (various ways of calculating entropies of passwords), could somebody explain why this scheme would be so unsafe? security.stackexchange.com/a/72461/25355 The highest voted (!) answer is saying that patterns are trivial to detect, so I even included a couple examples of patterns which apparently are so trivial to detect... yet nobody is detecting them (obviously, cause it's not trivial) and my answer is being downvoted

without anybody attacking anything except semantics... which really is affecting my mood far more than I wish to admit... and I know I shouldn't care, but seriously... if somebody would prove the ideas outlined in there wrong then that's fine by me (I have been wrong often enough that that's always an option), but this...

Gilles

8:46 PM

@DavidMulder well, you've got your wish now

Xander

@DavidMulder Same as I said in the comments. A password generation scheme (as you've devised) is an algorithm. A good password generation scheme is based on random data. In otherwords, if I need a new password, I generated it randomly. Even if someone knows my scheme, and has a bunch of passwords generated by my scheme, they cannot hope to predict a password that they do not have, with less work than a brute force attack. This is what gives the scheme semantic security.

@DavidMulder If someone has your algorithm: ("tSaF4nWeA" + [First letter of the domain name in lower case] + "CVkUU4") , and a bunch of passwords generated using your scheme, they can easily predict any other password generated with the scheme. This is broken. It's essentially identical to what the OP proposed, and what was proposed by the other down-voted answer.

raz

Because now rather than having to guess 18 random characters, they only have to exhaust through 1 random character.

David Mulder

@Xander: Which is exactly why I said that if they compromise more than one plaintext password using that scheme it will be compromised. That's right there in the answer...

raz

Which is exactly what makes it a bad scheme.

It's like using PFS, you don't want all other sessions to be compromised because a single session was compromised.

Xander

@DavidMulder Certainly, but the fact remains, it's a weak scheme, and should not be employed. Disclaiming that you know it's weak under reasonable conditions does not make it acceptable.

David Mulder

8:53 PM

@Raz: Except 1) you don't just magic up multiple plain text versions of passwords of the same user 2) that scheme was incredibly weak

raz

@DavidMulder Are you advocating for the scheme? or fighting against it?

David Mulder

@xander: Now say the same about the plain text passwords I posted in my spoiler at the end, if you can figure it out for those I will acknowledge that the idea of using schemes is weak

@raz: I am saying that the idea of using schemes is a fairly solid one. Just including the first letter isn't going to be enough, but with a sufficiently complex scheme that still can be humanly applied I think a reasonable level of security can be achieved

@raz: Possibly at some level of complexity even rivaling the use of password managers with their set of dangers, although definitely being absolutely crap compared to remembering random passwords.

Xander

@DavidMulder Yes, that scheme, while still weak, is slightly less weak, because it's slightly less static. There's still no reason to generally recommend such a thing, however. Actual random, unique passwords, managed with a good password manager completely eliminates all of this nonsense.

raz

I feel like this is just going to be argued in circles.

Xander

@DavidMulder And yes, I agree that password managers do have their own set of issues, but they generally present less risk than non-random passwords, which we know are one of the biggest issues in all of information security.

TildalWave

9:00 PM

@DavidMulder if I had a dime for each time SE brought me down I'd become an alcoholic :)

David Mulder

@raz: Yes, that's probably true

TildalWave

damn that came out way more cryptic than intended lol

Xander

@DavidMulder It matters not whether you think your scheme is strong, only whether you can prove it, and whether other people knowledgeable in such things can examine your proof and agree with you. I'll bet that yesterday Blake Benthall thought his OpSec skills were pretty hot stuff as well.

raz

I hate it when mommy and daddy fight.

David Mulder

@Xander: And if it's so weak, then you could please tell me what the easily recognizable pattern is in those plaintext passwords at the end of the post? I am even willing to generate you another view, no matter how crazy that is.

raz

9:02 PM

@TildalWave You're not already one?

TildalWave

@raz not one with drinking problems at least :P

(SE won't cover the costs of it)

David Mulder

@Xander: Wrong, in the world of cryptography that would be true, but in this case not. Why? Because take something like password manager, easily provable to be incredibly secure, yet everyone I have seen use them in a non corporate setting cut corners which compromised the entire solution (used cloud based services, or had a different password for their most used services, etc.).

raz

@DavidMulder You would still have to put a fair amount of work into guessing those passwords. Asking him to crack those passwords in the next 2 minutes seems absurd.

@TildalWave It's only a binge if you stop!

David Freitag

@raz Wait, you mean like on the television?

raz

@DavidFreitag :facepalm:

David Mulder

9:04 PM

@Raz: Getting to the point where you collected 3 different plain text passwords from the same user is already absurd. So I already gave an absurd amount of work away for free. Saying that doing the rest is absurd is exactly the point. Of course it's absurd, that's what makes it safe

David Freitag

@raz You mean those TV people lied to me? Those bastards

TildalWave

@raz heh true

Xander

@raz Nobody's fighting...I'm just explaining. <Shrug />

raz

2

TildalWave

so you're saying this ain't gonna be fun at all?

Xander

9:20 PM

@DavidMulder So, I guess the bottom line is this. Random passwords, generated uniquely for each application using a CSPRNG have a provable level of security. Non-random scheme have less security, and the amount of the decrease may or may not be definable, based on the algorithm, and there is no generally good reason to give up that additional security. So, if you feel your scheme has enough security to make you comfortable, by all means, go ahead and use it.

@DavidMulder However, if you post answers here suggesting that others do the same, they will be down-voted, because others should be using provably strong random passwords instead.

@DavidMulder This site is in the business of giving solid security advice, not promoting hare-brained schemes.

David Mulder

@Xander: Ehm, this site should be about answering questions, which may or may not be security advice. My question explicitly explored the dangers of using such a scheme and based on that reached a conclusion (ranking it below random generated passwords, but far above re-usable or different but memorable passwords), I still do not see how such an answer is worse than "Hey, this is not what you should do, because patterns are easy to recognize, end of story"

(which is mostly what the top voted answer is saying without at all examining the actual question at hand...)

TildalWave

@Xander Your use of a hyphen there makes me cringe ... hare, a brained one? That's like the one from Donnie Darko?

Xander

@TildalWave LOL. google.com/webhp?q=define%3Ahare-brained#q=define:hare-brained

TildalWave

@Xander I know what it means I just thought it's spelled without a hyphen ... actually I'm still not sure. Can't you English speaking people tell your English speaking dictionary authors to decide already? They're applying entropy all wrong there, damnit!

Xander

@DavidMulder I see it as nearly opposite. The question asked "How different should my passwords be?" This question is both in the title, and repeated at the end of the body. The answer to that question, as stated by the top-rated answer, is that passwords should be independent of one another. The provable way to generate independent passwords (or keys, or data of any sort) is to generated it randomly. This is the answer.

@DavidMulder To the contrary, coming up with strange schemes for generating passwords may speak to the example in the question, but not to the question itself at all.

@TildalWave I prefer to spell things arbitrarily. Whether I've chosen to use a hyphen or not, I feel should be an exciting adventure for the reader to discover anew each and every time.

David Mulder

9:33 PM

@Xander: The question is clearly asking about how different passwords should be within the context of the example... that's why the example is there... It's a typical case where somebody does not have the terminology at hand to describe his question better and thus uses examples to make clear what he's thinking about

Xander

@DavidMulder Now you're just making things up. If you can't read the question, I can't help you. The last sentence is "Is this bad practice if so how much variation should I put in different passwords." That's about as clear as can be, and top-voted answer addresses it marvelously. The fact that you can contort the example to imagine a question that is appropriate for your answer is a fine talent in its own right, but irrelevant.

raz

Alright, I'm peacing out for the day. Have a good one

Lighty

9:52 PM

quick! drive encryption like bitlocker, but for Linux (ubuntu)!

friends request xD

Xander

@Lighty LUKS.

Lighty

@Xander thanks mate <3

TildalWave

10:06 PM

Here's something I don't get. If I go to users / editors / all time it shows I made 287 edits so far. And if I go on my profile / activity / revisions, it says I made 444 of them. Where does the difference come from? Migration? If so, then how come I only have a single registered edit, say, on SU? Who's stealing my stats?!?

OK I think I get it. Revisions shows all new revisions (obviously, it's in the name LOL), and edits shows number of posts edited. Is that correct?

Xander

@TildalWave Yes, so if you edit a post multiple times, all of those edits will be in the one count, but only one of them in the other.

TildalWave

So in other words, on average, each post I thought was worth editing I edited 1.55 times ... just in case :)

Xander

@TildalWave And there's yet a third count for the "Copy Editor" badge, but I don't know what is being excluding from that one...Maybe edits to one's own posts? I have 187 revisions all time, 161 posts edited, and 124 edits toward the CE badge.

TildalWave

@Xander Tag wikis maybe? Those have other badges, don't they?

Xander

Ah, yes, edits to your own posts do not in fact count, nor do tag-only edits. Tag wiki edits do count.

TildalWave

10:15 PM

on space.se, for some odd reason, tag wiki edits don't count for me ... it's stuck at "you made one tag wiki edit"

maybe I overflowed the counter :)

some others that I'm sure made fewer edits than I did already got that badge LOL

OK, one other

Lighty

@TildalWave isn''t that badge, like, near-impossible to gain?

TildalWave

@Lighty Why? I mean, yes, for me obviously it is. It's pretty easy otherwise, especially on a beta with most tag wikis empty.

Even if it counts only edits (new revisions, not when you first submit it), I made loads of those ... I'd improve / correct pretty much every suggested edit on them

hmmm for some reason it shows "community" as the author of most tag wikis ... that can't be right, we did have a few members deleted for various reasons, including one mod, but none of those edited many tag wikis

and many have no revision history .... odd

Xander

10:45 PM

@TildalWave What motivations would an attacker have to pay your electric bill with a stolen credit card? (Asking for a friend.)

TildalWave

@Xander the police comes knocking on your door and in the end, you still didn't pay all those bills once the payments are reversed.

Xander

Typically if you're trying to validate stolen cards (the only reason I can think of) you want small transactions that might go unnoticed. I think I'd pick up it if someone else's electric bill was paid with my card one month.

@TildalWave Ah, so the "mischief" approach. Ok, that makes sense.

TildalWave

It can get you in a lot of trouble yes

Use a credit card that was stolen close to where the guy frequents and you can bet he won't come home for a day or two. And it might only be the beginning ...

@Xander only just now saw that you answered that ... I'm not getting any closer to 10k with comments am I? :))

ManishEarth

dafuq

arstechnica.com/security/2014/11/…

Xander

@TildalWave LOL, No, no you aren't, but I know your delimma....They're just so darn easy.

@ManishEarth Yeah, was pretty hilariously clueless.

TildalWave

10:55 PM

@Xander BTW for what you describe ... those 4 digits ... we have a good example somewhere on the site. Something about someone having to give up on a twitter handle to a hacker

IIRC it involved locking him out of his paypal account or something along those lines

Xander

@TildalWave Yeah, it was a journalist. They attacked his Amazon account to get the last 4 digits of a credit card, and then used that to take control of his Apple account.

TildalWave

@Xander that would be the one yes ... just thought you might wanna attach a link to what you mentioned, that story was quite a read from what I remember

Xander

@TildalWave Yup. Found it. wired.com/2012/08/apple-amazon-mat-honan-hacking/all

Transcript for