The DMZ

1:28 AM

> Can our thoughts be controlled?

Wow

The Imperius curse is the darkest of hacking techniques!

@YetAnotherRandomUser Yeah that happens a lot for questions that hit HNQ. Chances are it won't end up getting closed. If it does, you can be sure that it will get re-open votes. I think it's a fine question, myself.

forest

1:48 AM

@JoshuaJones Looks like your little critic got suspended :P

forest

2:16 AM

0

A: Multiple gateways (Whonix with Tails)?

Does anyone have a step-by-step explanation of how to configure whonix and tails?

Not an answer (can't flag right now)

Anonymous

6:59 AM

@forest Yeah I saw, I really don't understand why he was so offended but hey shrugs

Anonymous

8:08 AM

Considering this security.stackexchange.com/questions/188072/… will only cause discussion

Anonymous

I think I have remained pretty objective in my answer actually.

Anonymous

Hopefully the OP will appreciate that as I tried my best to avoid a subjective opinion on the two certs.

Kepotx

8:27 AM

when the question is off-topic but still interesting, isnt'it better to bring it on the chat?

Anonymous

Yes I would agree.

Anonymous

However I don't think the OP will come to chat.

Anonymous

As he appears to be very new to the site.

Anonymous

Considering he didnt even respond to my initial comment which I made not long after the post

Anonymous

I didnt expect to get a reply thus decided to just write an answer..

Anonymous

8:29 AM

Perhaps I was wrong to make an answer?

Kepotx

well, both question and answer are opinion based/off topic, but I just realize he didn't have enough rep to enter a chat anyway

Anonymous

Oh yes.

Anonymous

Actually I saw a meta post about this I think.

Anonymous

If I remember rightly mods said unfortunately there isn't much you can do.

Anonymous

And yeah whilst I tried to remain objective all answers will always be opinion based.

Anonymous

8:44 AM

Unfortunately thats just the nature of the question hence we dont allow them :

Benoit Esnard

9:10 AM

Wait, chat needs rep? :(

Anonymous

Indeed.

Anonymous

I think it's low though.

Anonymous

20 ^_^

Rory Alsop

Morning. In general, we suggest not answering off topic questions, as it tends to encourage more. Instead, point them at the few career questions we do have, get them to ask specific questions that are in scope, and after only a couple of upvotes they can enter chat anyway

Anonymous

:p

Anonymous

9:19 AM

Yeah sorry.

Anonymous

I can delete the answer.

Rory Alsop

No worries

Nah, I'd leave it

You'll get some upvotes

And you have put effort into it

Anonymous

Ha, well if you insist :D

Anonymous

I guess there are plenty of other sites where questions like that are allowed so I am sure he can ask there :D

Anonymous

This may sound stupid - but why when you enter chat is your first message displayed with a black icon and the rest white...?

Anonymous

9:21 AM

Is it because you're a mod or?

Rory Alsop

It is because I have a strange image for my icon

It changes transparency

Due to a bug in the Imgur handling

It amused me

So I haven't fixed it

Anonymous

Oh right, thought it was a purposeful thing to be honest.

Rory Alsop

Lol no - just a silly thing

Anonymous

:D

Anonymous

0

Q: Management interface on Cisco router

In my company we had a firewall as edge device on the Internet. Behind this central firewall, we have a management network. Now we had to put Cisco router in front of central firewall, as part of some services from our ISP. This router has public IP addresses on all interfaces and it is pretty v...

M'vy

9:30 AM

The small one is black

Anonymous

I'm really struggling to understand what he's asking here.

M'vy

the expanded one is not

Anonymous

Oh. You're right.

Anonymous

It seems he's asking is it safe to connect to the management network via the router from the outside.

Anonymous

But that implies hes connecting to the management network from the outside already; surely he'd be connecting from the inside if hes in the company as he'd already be behind the router & firewall..

Anonymous

9:31 AM

Unless I am completely misunderstanding what hes saying.

Anonymous

Is that post clear to anyone else? I want to know if it is just me having trouble understanding what he means :?

Rory Alsop

9:53 AM

I can only assume he wants to connect management network not just to the internal Mgmt port on the fw, but to the internal Mgmt port on the router, thus bypassing the fw. Could be wrong though

Anonymous

I see.

Anonymous

I am not sure why if he's INSIDE the company he would want to circumvent the firewall..

Anonymous

This is why I need a network diagram.

Anonymous

Because hes suggesting he would need to connect via the router (from the outside) to get onto the management network when hes internal.

Anonymous

Surely his network should allow him to get there providing hes internal and there would be no need to go via the Internet at all.

Anonymous

9:58 AM

I'll just wait and see if he's able to post a network diagram :D

Rory Alsop

I didn't read it as needing to connect from outside the company network infrastructure, but connecting directly to the router without passing through the fw

Anonymous

Ooh..

Anonymous

SO he wants to completely bypass the firewall..

Anonymous

10:15 AM

It's really hard to answer networking questions when people don't show you what the network actually looks like.

Kepotx

12:24 PM

too much off topic/opinion based for the main site, but why password managers are so few used by people?

I'm sure that even on SO or security.SE, not everyone use password manager but instead reuse passwords

is it just because they don'tk know such solution exist, or are they just not convinced?

forest

@Kepotx People genuinely don't understand the dangers of reusing passwords.

M'vy

@Kepotx usability

Password manager on shared device/multiple device is a bust

Kepotx

@M'vy well, to be honest, password manager improve usabilty as you don't neeed to write long password (or only the main one)

M'vy

Go type a 20 chars long password that long like this h6!~'HNHek-45E2#iuP9 from a phone on a computer/other mobile device which might not have the right charset

just cause you can't have the database on that other device

I finally found a USB stick that can go on my phone so I can at least share computer/phone

Anonymous

I dont use a password manager but I dont reuse passwords I just remember them.

Anonymous

12:35 PM

And I am not sure how..

Kepotx

well, if we are talking about people who use weak password, they probably won't use "h6!~'HNHek-45E2#iuP9" as passwords, probably just an 8 character alphanumerical passwords

Anonymous

^

M'vy

Well yeah, but the idea of password manager is to have it generate the password for you

forest

The idea that you need to sync to multiple devices is bunk.

M'vy

Well, it should be

forest

12:36 PM

Stateless password managers are a thing for a reason.

Anonymous

Do you guys use password managers?

Anonymous

Or you just remember your passwords?

forest

Technically no, but I do the equivalent.

I save my passwords in a text file.

So unless you consider less or vi a password manager...

Kepotx

use password manager since few years, before i used semi-random passwords

Anonymous

I don't trust password managers to keep my password safe.

Anonymous

12:37 PM

I trust my head to keep them safe.

M'vy

I use KeePass

Anonymous

And I don't re-use and tend to refresh as often as possible considering the complexity of some of my passwords.

Kepotx

passwords in two parts : 8 character common to all paswords, and 8 characters specific to one website

forest

I prefer ASCII. Much less likely to forget than storing it in my head.

@Kepotx Better to hash the result.

M'vy

Before I had a sheet of generated password I chose from, and took note in a notebook

Anonymous

12:38 PM

I don't tend to forget the passwords I choose.

Anonymous

It's quite weird because some of them are really long and complex but I just remember them.

forest

E.g. KDF(master_password || domain)

M'vy

Now I just ask for 20 chars generated with [a-zA-Z0-9]

Kepotx

@forest well, when i did this i didn't knew how paswwords really works, just knew that they need to be unique, long and random

now i use lastpass

Anonymous

If I would use a password manager it would be one like KeePass or KeePass.

Anonymous

12:39 PM

I dont trust these cloud based ones.

M'vy

There's a problem with that method @forest. If a site is compromised, you need to change all passwords

forest

@M'vy No, why would you?

M'vy

Unless you can choose the number of derivations?

forest

You can't extract master_password just by knowing the hash of master_password || domain.

M'vy

no, but..

you also can't change the resulting password without changing master_password

forest

12:40 PM

Hell, you could even use plain MD5 and not a real KDF if the master password is completely random.

Kepotx

@JoshuaJones lastpass decrypt your password locally, so it's not that diferent from keepass, and easyer when you got more platforms

forest

Sure you can, just extend it to KDF(master_password || domain || version)

Anonymous

@Kepotx But they still technically have control don't they?

Kepotx

what do you mean by control?

M'vy

hmm.. It feels like defeating the principle of statelessness

Anonymous

12:42 PM

As in, its still to some degree controlled by them.

Anonymous

And their security policies.

M'vy

cause you need to remember the number of breaches you had on each sites

Anonymous

A KeePass DB on my PC is managed by me I just don't own the software.

forest

If each site has a non-zero number of breaches, there's a bigger problem.

M'vy

true, but it happens

Kepotx

12:42 PM

they store all your passwords encrypted by your main password, on give you the vault encrypted, so no sniffing can make your passwords compromised

Anonymous

I

M'vy

in the last decade, LinkedIn stated at least 2 leaks

Anonymous

*I know @Kepotx

Anonymous

But I don't like how I have less control.

Anonymous

Because its cloud based.

forest

12:43 PM

And Yahoo has like 4.

Anonymous

I trust myself, I do not trust others.

Kepotx

@forest good idea, but you have a kdf hash generator on mobile?

forest

@Kepotx Naturally a stateless password manager still requires, well, a password manager.

It just means that you don't have to sync anything.

But you still need to have the software (or crypto utilities).

I suppose you could also use a website that does everything client-side.

Kepotx

ok, so the password manager just take the main password + domain as input and givou you the domain-specific password as output?

M'vy

Admittedly you could keep a list of leaks online, that info can remain public

forest

12:45 PM

@Kepotx That's the general idea behind stateless password managers.

It exploits the fact that a long, random master password will not be leaked even if the hash of the password concatenated with a known value is revealed.

Kepotx

what about website that change domain name?

like "thefacebook" become "facebook" => "new website" but still same password

forest

It doesn't have to be the domain name specifically. It can be anything easy to remember that your grandmother might want to use as a password.

It's easy when all you need to remember to log into Stack Exchange is the ASCII string "Stack Exchange" than it is to remember a proper password.

So sure, I suppose it might change its name, but it's not like that means you'll forget the original string.

The only requirement of the extra string is that it is unique to each site you use. It could be anything from the site name to the domain name to the IP to an incrementing counter. It's just that domains or site names are easier to remember.

Kepotx

but as its deterministic, two guys ussing both "Passw0rd!" as password would have the same password for each domain?

forest

Only if you used the same master password :P

The point is that your master password is strong, not just Passw0rd. You'd only have to remember a single password, so you can put some effort into making it strong.

It's not hard to memorize a single password like zWGOAMgmf9Bo71Ht.

It would take less than an hour to memorize, and it would be quite strong.

Anonymous

^

forest

12:56 PM

So your password for SE might be ef79394a97f4cdcf0fd9b7f1e5146d9a, and your password for YouTube might be 3255c37d6d3d33d31e667b7270c762a9 (the MD5 hash of zWGOAMgmf9Bo71HtStackExchange and zWGOAMgmf9Bo71HtYouTube, respectively).

Well, with newlines, but you get the idea.

Anonymous

My heads not failed me yet

Anonymous

Not massively at least so ^_^

forest

But how long are the passwords you use?

It's not easy to memorize unique 80+ bit passwords for a dozen sites.

Anonymous

12 - 16 typically.

forest

Fully random alphanumeric?

Anonymous

12:59 PM

Characters.

Anonymous

Si, senor.

forest

Ah, good on you then :P

Anonymous

As I said I am not sure how I remember them, I just do >.>

forest

Some people just have a talent for memorizing arbitrary things.

Mnemonics can be quite effective, e.g. chunking or roman rooms (method of loci).

(though I think the latter is hard to do with pseudorandom data)

Anonymous

I always remember stuff like that usually but its dates I cannot remember.

Anonymous

1:00 PM

I really forget dates.

Anonymous

I forget my own birthday half of the time.

forest

:o

Anonymous

Then people get angry at me.

forest

Solution: encode dates in base64, memorize the base64.

Anonymous

Especially my dad I always forget fathers day and his birthday.

Anonymous

1:01 PM

Then he will ask me "what day is it today" and I will just be like.. "Tuesday"

Anonymous

Or something.

forest

Hey at least you know the day of the week :P

Half the time I forget unless it's a Friday.

Anonymous

I know that feeling, lol.

forest

Anyway, I gotta go get some stuff done. ttyl!

Anonymous

Goodbye :D

Kepotx

1:12 PM

@JoshuaJones and how many password do you use?

some people just use few website, so it's easy to have long enough/random enough passwords remembered, but it's harder to remember 100 strong password

Anonymous

Hmm.

Anonymous

I use YouTube, Outlook, Bank, PayPal, StackEx, Linkedin, Twitch

Anonymous

Thats about it.

M'vy

My manager has around 71 entries..

Anonymous

Jesus.

Anonymous

1:22 PM

Im a man of simplicity.

Anonymous

I hardly use anything

Anonymous

I tend not to login if avoidable.

Kepotx

and i suppose you use this website daily or at least weakly

Anonymous

Or i use a lot of throwaway accounts

Anonymous

Daily? Yes daily :D

Anonymous

1:23 PM

Very daily.

Kepotx

but some websites are unavoidable and you will use it twice a year, like paying tax or other administrative stuff

Anonymous

Yeah I have a few other accounts

Anonymous

Like my DVLA account

Anonymous

But for anything I will use once or twice I just use a throwaway mail with a password I have no intention of rembering.

Anonymous

2:42 PM

0

A: Single Domain SSL Certificate vs Wildcard Certificate

Certificates are now free! And everyone should use them. Because of "services" like Let's Encrypt (and possibly others in the future) You can create as many certificates for single domains as you want, but also wildcards certificates where implemented march 13th 2018, according to their own u...

Anonymous

Why I do feel like this user works for that company and is not disclosing it?

Anonymous

3:40 PM

What would you guys make of a question like this ai.stackexchange.com/questions/6800/…

Anonymous

Here?

Anonymous

4:02 PM

security.stackexchange.com/questions/188124/… this whole post is a mess.

Anonymous

From the answers to the comments (including my comments)

Anders

8:39 PM

@JoshuaJones To make matters worse, I wrote another answer...

Annoying when half the question is a duplicate. I'd like to edit that part out, but there is already an answer answering that part.... So now I don't know what to do about it.

AndrolGenhald

@JoshuaJones Letsencrypt is pretty widely known now, I wouldn't assume he's involved with it based on that answer

I must admit, that answer does look a little spammy like someone advertising their own product, but letsencrypt was started by the EFF and is generally considered reputable

Anders

There are plenty of Let's Encrypt cheerleaders without any connection to the organization. I mean they provide a great service for free.

In the Holy Church of TLS, Let's Encrypt is Jesus Christ.

Anonymous

9:55 PM

Oh no @Anders I see that! Yeah, it's a bit messy but, oh well I guess it doesn't matter too much.

Anonymous

@AndrolGenhald Ah okay. Yeah I thought it looked a little sales-esque.