The DMZ

> use wifi

> use vpn or tor whatever

wow

7:47 AM

hide your kids, hide your wife, hide your id

hide yo kids, hide yo wifi

Journeyman Geek

8:05 AM

why was that not "unclear what your asking"Ed?

Also, its simple

You just flood the website with electricity.

HamZa

8:17 AM

has anyone succeeded into mitming encrypted grpc traffic?
grpc is based on http/2 and they support TLS
Building the latest wireshark from source lets you view http2 traffic
i have a pem file though that's used by the client

i'm doing some mobile security tests
usually i only need to install burp certificate on the device

I'm almost thinking that i might need to write custom hooks on the compiled grpc library functions in order to intercept the data when it's being sent or received

if I don't see a "number" next to any reason in the close vote review queue, does that mean the question was only flagged by an automated system?

8:33 AM

@TomK. Or a person with too little rep to issue a close vote manually flagged it.

ah okay

I was wondering, because in the last 2 weeks or so, there were more and more questions in the queue that are around 6 months old

with no other votes attached

so that looked like an automated system, but it might as well be an inexperienced user

I don't think it's necessarily a bad thing tbh. Some of the questions are crappy.

true dat

9:13 AM

@RoryAlsop If it's not a caching issue again, I think you can remove the WPI ctf meta post from "featured on meta"

HamZa

9:23 AM

@TomK. didn't have much time to write the writeups :(

@HamZa nooo problem, I didn't even contribute enough that weekend becaue I was so busy with stupid shit :(

HamZa

9:43 AM

happens all the time
planned to do a ctf with a friend of mine this weekend but couldn't do $hit

5 hours later…

3:13 PM

maybe a dumb question so I ask here first, but given a high enough factor (let say 12), even if an attacker know the salt.hash pair, can he really break it in a reasonable amount of time?

I guess the context is cracking a bcrypt hash, right?

It would still be possible if the password is really weak, or has been reused

so only with dictionary attack (or smart enough brute force) with weak password, but no way with a ood enough password(at least 8 characters, upper and lowercase + number + special char)?

you mean "P4$$w0rd!"?

well, this one would probably be broken by dictionary ^^

probably

what you describe can result in a "odd" password, but really not necessarily

3:25 PM

Well, according to that page:
https://gist.github.com/epixoip/a83d38f412b4737e99bbef804a270c40

8 GPU calculates 105.7kH/s for bcrypt cost 5, that's 826H/s for cost 12.

8 lowercase + uppercase + digits: keyspace is 62 ** 8 = 218340105584896

You would need 8400 years to calculate the full keyspace with 8 GPUs.

I didn't even put any special characters in the password

You can still add more GPUs, but 8 GPUS is already quite uncommon I guess

thank you, great catch. 826H/s is still enough for a good dictionary attack however

Only specialized people have that much GPUs, and I doubt they will be running all of them just for you :)

Unless you have some enemies in some government

well, the data behind the application won't worth 8 gtx 1080, and if they only want password, there are easyer target than bcrypt I suppose...

Yeah. If your dictionnary has 5 billion entries, then it will take 70 days to run it

I guess it will be cheaper to buy some obscure 0-day than to run 10k GPUs for a full year, yes

if that doesnt work

you can always flood the system with electricity

3:31 PM

@TomK. is that a meme from this chat? not the first time i see it

Xavier59

@BenoitEsnard how did it end up with all the interview thing ?

It's a meme indeed

I was expecting someone to post it actually

obligatory xkcd reference

When something seems impossible, the solution is flooding with electricity

@Kepotx no, Benoit is lying. Our chat was flooded with electricity. and now some words are automatically replaced after sending your message

we speak like smurfs now

3:32 PM

We're under attack!

Women and children first

it is too late

they have all been flooded with electricity

their brains now capture internet traffic

@BenoitEsnard so the sharks aren't hungry anymore?

4:11 PM

@Xavier59 Quite well, but I've chosen to stay in web development for now

4:38 PM

Out of curiosity, how did you learn (dis-)assembly?

I want to learn it, but that stuff looks so hard compared to everything else in development / security

4 hours later…

8:57 PM

@Anders why the edit on the OWASP Top 10 question?

Arminius

9:13 PM

@Kepotx It's not a meme. It's part of our FWE awareness campaign.

(And later we're planning to sell FWE certifications.)

Anders

@schroeder You mean this one? security.stackexchange.com/posts/182723/revisions

@anders yep

the tags seem appropriate

Anders

I thought it was in accordance with this: security.meta.stackexchange.com/questions/2902/…

But I might have missed something.

Is there an OWASP connection other then "XXE is on the top 10 list"=

Arminius

I'd fully agree with Anders here

Also, the top 10 list changes

hmmm

Arminius

9:22 PM

So we couldn't consistently tag them