The DMZ

Scott Pack

12:41 AM

@FalconMomot It's less complex than your face!

Falcon Momot

@ScottPack My face is kind of complicated, so sure :P

pacifist

your face isn't complicated in theory, it's just the implementation has some terrible defaults

(sorry if it came off mean - may not've been as witty as hoped)

tylerl

@pacifist par for the dmz

Falcon Momot

1:00 AM

@pacifist some of the defaults are changed :P

Scott Pack

Default settings can sometimes be quite elegant but are often boring.

Falcon Momot

thus the facepaint and metal

I should go get an airbrush one of these days

Scott Pack

1:54 AM

Planning on centerfold modeling?

Falcon Momot

@ScottPack it's much easier to apply warpaint with them. facepaint runs and can't be made even. #cyberpunkproblems

In short: what I want is a server which can only be accessible from port 80... so, how do I completely isolate the OS from the outside world, making my web server the only and unique way to get in and out??? is such a thing even possible??? — george b 6 mins ago

ugh, this guy

FEichinger

2:24 AM

Mar 14 at 18:14, by FEichinger

Close all ports, be surprised by how "functional" your machine suddenly becomes.

Falcon Momot

heh

Simon

2:39 AM

@DavidFreitag I couldn't recognize the intro at all but as soon as I heard the synth, I remembered the track. I totally forgot about this one, it's reaaaally great!

Anonymous

3:02 AM

sup @Simon!

Stack Exchange

4:02 AM

If data fails the Teacher's t test, you can just force it to take the test again until it passes.

Terry Chia

@LucasKauffman Around here, a statement like that probably means you are going to assassinate the POTUS.

Terry Chia

5:20 AM

> public function encrypt($value) {
return strtr(base64_encode(mcrypt_encrypt(MCRYPT_RIJNDAEL_256, hash('sha256', $this->key, true), $value, MCRYPT_MODE_ECB)), '+/=', '-_,');
}

Another gem from opencart!

Falcon Momot

5:41 AM

ugh. eyeroll

why do people think hashes are good PRNGs and KDFs?

(and why is ECB still implemented by anyone)

Terry Chia

@FalconMomot This is clearly the far more important point. :P

Falcon Momot

though so far the only academically-acceptable source I've seen decrying the use of SHA2 as a PRNG entropy distiller is a French government report without data, criticizing Java

@TerryChia nothing wrong with ECB if you're only encrypting a single block and don't plan to use the key again.

:P

Terry Chia

@FalconMomot Sure, what are the odds of that happening?

Falcon Momot

I'd be more interested in the derivation of $this->key

Terry Chia

@FalconMomot Appears to be a read from a user config file.

Falcon Momot

5:46 AM

oh, lovely

that likely restricts the keyspace quite a bit

TildalWave

you must be bleepin joking me

0

Q: Fuzzdb detected as Trojans

I recently downloaded fuzzdb from http://code.google.com/p/fuzzdb/ and my antivirus kept on detecting some of the files as Trojans. I need to know if these files are safe?

Terry Chia

@FalconMomot I presume that's why the guy ignorantly used SHA256 in the first place.

Hey, the output appears random so it must be good right?

Falcon Momot

@TerryChia it does raise the bar a little, sure, but it's far from a uniform distribution, especially used on that.

Terry Chia

Also, no HMAC is applied on the encrypted result. Woohoo!

Falcon Momot

ugh.

I'm not sure an HMAC is really necessary in this case.

well

I guess it depends on what is being encrypted

for some reason I assumed it was password hashes but I guess there isn't any reason for that

yeah, the lack of HMAC is a shame.

Terry Chia

5:50 AM

@FalconMomot It appears to be mostly used to encrypt certain columns of a product table in the database. (It's a ecommerce app). Also, it's always a good idea to apply message authentication, you really can't go wrong with that.

Falcon Momot

is it really so difficult to use cryptographic primitives only for their intended purpose, and not abuse encryption for authentication and hashes for KDFs?

@TerryChia it is, but sometimes it isn't worth the overhead.

Terry Chia

@FalconMomot Oh, I already complained about their password hashing. github.com/opencart/opencart/issues/1269

@FalconMomot Oh cmon, what kind of weak ass server are you using if computing a HMAC is an overhead?

Falcon Momot

oh god

github.com/opencart/opencart/issues/1269#issuecomment-38146718

@TerryChia one that processes a fuckton of data.

I mean

there are people that think using 4096-bit RSA keys and AES256 on webservers is unacceptable overhead

so I always try to think about what the marginal benefit and cost of a measure are

Terry Chia

@FalconMomot Ehh, I can understand that at least. 2048-bit RSA keys and AES128 is more than sufficient.

Falcon Momot

applying an HMAC to data in your own backing database because it might not be trusted doesn't seem to be marginally beneficial. encrypting and applying HMAC to database communication, on the other hand, is clearly the right thing to do.

Terry Chia

5:56 AM

Ok, I'm done with poking around random $PHPAPP today.

Falcon Momot

yeah, I tire of writing software patents

(as evidenced by me chatting here)

FEichinger

6:22 AM

0

Q: Is StackExchange/meta/stackoverflow.com secure

I just recently noticed that none of the security indicators for a secure connection are showing up for any of the StackExchange site associations that I visit. I find this odd as I use weak passwords on sites that have lame security and yet find that I need a complex password here. Whereas I sav...