The DMZ

I don't know if this is too much to ask, but I personally have no idea how these things usually work. So if there was a post on a certain meta site where you explain:

- These are the people that usually join in
- these are the kind of challenges we usually do
- this is how we do them
- this is where we have a lot of knowledgeable people in our ranks
- these are the topics where we'd love to see new people

Benoit Esnard

Well, there's this post: security.meta.stackexchange.com/questions/1117/… but I guess it's outdated

Rory Alsop

@BenoitEsnard I have removed the featured tag and had a quick read - superb result!

Tom K.

okay, I guess I kinda walked into that one..

yeah, so why not update it? :)

Benoit Esnard

10:16 AM

- People who joins: It depends. :-) Anyone can suggest participating in a new CTF, and the team is open to new players if you have enough reputation here
- Kind of challenges: CTFs ( https://ctftime.org/event/list/upcoming ).
- How we do them: We're on Slack, communciating and using our knowledge to go through the challenges. There's team effort when someone's struggling on one challenge.
- Topics where we'd love to see new people: reversing binaries, mainly. But anyone is free to join even if he doesn't know how to do it.

And I'm sure @Xavier59 has learnt a lot too

Thanks @RoryAlsop!

We should update it indeed

Tom K.

"I'd be keen but I'm a serious noob. I'd do way more learning than helping :) – OJ. Jan 2 '13 at 5:26" <- I guess this is a feeling that a lot of people have towards these challenges

or towards participating in a team with "stangers"

Benoit Esnard

Well, we're all noobs

Rory Alsop

@TomK. there are various ones that get published after the fact almost "as live" - it is well worth going through them to see what decisions the teams make along the way, both correct and incorrect, thoughts on the RE sections, looking at techniques used etc.

Benoit Esnard

We never stop finish learning imo

Tom K.

10:32 AM

wasn't aware that the solving process was publicly available

thats cool

but how do they track fails and solves? ctf.neverlanctf.com/team/363

@BenoitEsnard

ah.. I think I understand

when you submit solutions for the jeopardy questions you either get a fail or a solve?

Benoit Esnard

Solves = # of challenges we solved

Fails = # of wrong flags we submitted

Tom K.

11:02 AM

but you do get an immediate feedback if your flag is wrong? or in other words, if you submitted a wrong flag, can you try for another one?

Benoit Esnard

Yes!

Tom K.

alright

Benoit Esnard

You submit it, it says "valid" or "invalid", and you can continue searching another one

Tom K.

so i could check if you just "bruteforced" for solutions

w/ your number of fails

Benoit Esnard

Indeed

root-me.org has a lot of challenges in various categories, if you want to practice

Some of them are really easy, so they're perfect to start :)

Tom K.

11:05 AM

cool, thanks

maybe include that in your updated post :P

Benoit Esnard

I will. :)

I think I'll suggest Pragyan CTF 2018 for the next competition

It will start Friday

Tom K.

1:13 PM

well, I already completed two challenges ;)

(and wasted half an hour on the third)

cool site @BenoitEsnard

Benoit Esnard

Which ones are you doing?

Tom K.

steganography

I figured I'll start with something I have no idea about

Benoit Esnard

Haha, I'm doing the steganography ones right now

Tom K.

yeah, I saw your name when I finished the challenges

but you were way faster than me ;)

Benoit Esnard

Well, NeverLAN CTF had one steganography challenge

So I had to learn it

Tom K.

1:21 PM

I'm stuck at the petit annonces picture

but I should get back to work anyways

Benoit Esnard

iirc it has a French hint right?

Do you speak French?

Tom K.

little bit

put it into a translator nevertheless

dunno what I should infer about the missing point that is hinted at

within the quote

Benoit Esnard

Actually "point" has a double-meaning in French

The meaning here is "dot", as in the title "dot and next line"

Tom K.

i tried including the dots over the i-s, but it didnt help me

so, is the quote needed at all?

or is the title enough?

Benoit Esnard

The title is enough actually

And you don't need to understand the text neither

Tom K.

1:41 PM

yeah, I thought so...

arf

I have to get back to work benoit, I'll maybe get back later to you ;)

Benoit Esnard

1:59 PM

Okay! ;)

terdon

3:03 PM

@RoryAlsop (thought I may as well take this where it's on topic). My bank, NatWest, has a two-password system for logging in online. They ask me to set up a pin and a password and then ask for the Nth, Mth and Kth number of one and the Xth Yth and Zth number of the other. Seeing as I tend to set up long passwords, this is extremely annoying.

I was wondering if there's any real security benefit to this or if it doesn't just push people towards creating very simple passwords so they can easily remember the Nth letter.

Rory Alsop

It does have a benefit in this implementation - if you need to phone the help desk, they will never have visibility of your password, as they will just get the 3 chars you say

terdon

Oh, and let me know if this is the sort of thing that you'd rather see posted as a question on the site. I figured it was too soft and unspecific for that.

@RoryAlsop Yes. I get asking for only parts of a 4-5 digit pin. But they ask for that and for the, say 4th 7th and 11th character of my password.

Rory Alsop

I think it may have been posted already in some form... probably asking how it is secure. Answer being every char is hashed :-)

@terdon that just increases the space

terdon

I'm thinking of the other side. I already changed my randomly generated 12-character password to something else. And am feeling the urge to change it again to something smaller so I don't need to count out 9 characters.

Rory Alsop

In reality we know 2FA is better, but customers do not like physical tokens

So in order to be sufficiently secure there are not a huge number of options.

terdon

3:06 PM

And I am assuming that given that I use a password manager, I am probably more security conscious than the average bank customer. Won't most people simply use two 4-digit pins instead? And therefore bring down the overall security of the account?

Rory Alsop

The good thing is with mobile apps, they can use things like face recognition, fingerprint scanners etc built into the device

terdon

Yes. But not the online banking page.

Rory Alsop

@terdon which is why having the password as well is significant

terdon

True. But since I never enter the whole thing out, I find myself needing to open my password manager and count out the positions. I am just assuming that this sort of thing will push most people towards using very simple pin/pass combinations that thjey can easily find the Nth char/number with.

I currently have a 4-digit pin and 11 character pass, where I would normally have a much longer pass (they used to ask me for the 14th 17th and 19th character or whatever, and that was even more of a pain). And am seriously considering making it a good deal shorter.

I just think that the end effect of this will be less security, not more, because users will opt for shorter, simpler passwords.

(and the bank employee who set up my account had me type my password using her machine and keyboard, but that's a whole different issue)

Rory Alsop

All banks run through possible future security features to try and see what customers will accept, and what will provide sufficient security. And it is a trade off. Retina scanning is currently considered a pretty good 2nd factor. But humans generally don't like lasers scanning their eyeballs, for some reason. So this is typically reserved for fairly James Bond-esque situations.

Mad Scientist

3:12 PM

@RoryAlsop A token per account/website/whatever would be annoying. One single token that can be used for everything would be very nice, but I haven't seen banks supporting standard 2FA methods so far (I haven't looked much, though)

Rory Alsop

@terdon as per NIST guidance, banks and other organisations are likely to move towards longer, simpler passwords (see the xkcd password post here on sec.se for explanation)

terdon

@RoryAlsop Yes, that's precisely the sort of thing I had. And, of course, one of the major sources of knowledge I have on the matter. I don't pretend to be any sort of expert. But that's exactly what this approach of asking for the Nth characters breaks for me. While I can easily copy/paste the thing from my password manager and don't need to remember it, making it simple and practical to use randomly generated passwords, finding the Nth charcter is a pain.

Mad Scientist

@terdon my bank does the nth digit thing as well, but it's on a separate 6 digit PIN that isn't the main password.

terdon

@MadScientist Mine does it for both.

I just see that it's pushing me towards using simpler passwords and am wondering whether that doesn't have the end result of less security.

Journeyman Geek

@terdon or ... have the password manager count it out for you. Feature request? ;p

terdon

3:25 PM

@JourneymanGeek Yeah, that's be cool.

Journeyman Geek

(as a dyslexic, counting numbers hard. good to let the pc do it ;p)

terdon

I guess my main question is whether there's any evidence that this increases security or, conversely, whether there's evidence that it decreases security because people opt for simpler passwords.

Tom K.

5:10 PM

@terdon I would assume people would only actively start changing their password if they have to enter this regularly

it seems like a big burden, but changing a password - it seems - is a pretty big burden for users as well

and: people choose simple passwords regardless of how weird a bank's login form is.

@RoryAlsop just fyi: the ctfs still show up in my sidebar, so I guess the caching is kind of broken

terdon

@TomK. That's my assumption as well. I was wondering if anyone had data.

Tom K.

to my knowledge there is little research to these niche password requirements and password queries

Rory Alsop

5:29 PM

@terdon well, they won't be able to use a shorter password, because it will be enforced

@TomK. ctrl-F5 :-)

and yeah, it's always caching

Tom K.

doesn't work

but great advice, thanks :P

Rory Alsop

@TomK. There is actually years of research. I was involved in some for over 8 years - in that time I successfully argued for an increase in time between password changes from 30 days to 90 and now to 180 in many cases.

As well as pushing to remove the "special chars" requirement as it really doesn't help

Tom K.

@RoryAlsop nono, there is a lot of reasearch regarding password guidelines in general and also what passwords are used

not arguing that

but to niche password requirements joint with special login forms? this would be news to me

Rory Alsop

@TomK. This use of individual chars is a compromise - between securing against abuse by call centre staff, not being able to use smarcard readers or other 2FA, and trying to have as wide acceptance/accessibility as possible

Tom K.

agreed

terdon

5:46 PM

@RoryAlsop Hmm. I don't think it is, actually. But I should try that before jumping to conclusions.

@RoryAlsop THANK YOU

I've been trying to convince my GF that the fact that she has a _ and a digit in her password, in no way mitigates the fact that she uses the same one all over the place!

Tom K.

uh, it doesn't

it's really two different things

terdon

Yep.

Tom K.

I mean the argument is pretty simple, big providers like yahoo get hacked pretty regularly. one of these days a provider will get hacked where she has an account (maybe it already happened). If the provider in question used an outdated hashing algorithm, all her accounts are theoretically compromised

terdon

6:08 PM

Yep.

:) I know all this. It's trying to convince her that the risk is worth the effort that's hard.

Transcript for