The DMZ - 2018-09-23

« first day (2838 days earlier) ← previous day next day → last day (2047 days later) »

12:39 AM

@RoryAlsop It's only an average. My daughter isn't excessively feminine either.

The specific stereotypes are partially cultural, but some are natural.

12:55 AM

Why the fuck am I being presented with a captcha to post?

I'm logged in dammit!

1 hour later…

1:59 AM

@Joshua.J Just an angry 17 yea- OMG is that why I keep seeing the number 17?

I can't believe I didn't realize it. O_o

2:31 AM

The basic idea was to bring up his age as often as possible so he wouldn't have to anymore :P

1 hour later…

3:31 AM

Backwards-incompatible syntax changes in Python keep me awake. That's nasty

Yeah, Python is a silly language. Nice to use, but with a silly design.

3:56 AM

For some reason, async def was a reserved keyword in 3.6 (yes, a single one). So you could still use async as an identifier in your code as long there's no def after it. In 3.7 they turned them into distinct keywords, so lots of projects threw syntax errors because code like call(async=True) had become invalid

Which is particularly painful in a function signature on an API

Thankfully my knowledge of Python is rather primitive, with almost nothing for 3.x.

That stuff particularly bothers me because I'm playing around with ASTs and subtle syntax incompatibilities make it so much harder to support multiple versions

Not sure why people still hate Python 3 though

I just hate it because I'm not used to it.

I'm just more familiar with 2.

At least it'll always be better than JavaScript. slikts.github.io/js-equality-game

Journeyman Geek

4:14 AM

@forest 17

;p

:^)

Well, Python 3 is not radically different but makes more sense in a lot of ways (print is not a statement anymore, unicode support, type hints, ...)

Also, no more support

wtf

Well that's stupid. Guess I'll have to get used to Python 3...

And port all my scripts to it. :/

lib2to3 can convert most projets automatically

Meh, then I'll have to re-familiarize myself with my own code.

I'll probably just use it as an excuse to rewrite some of the more hacky ones.

4:52 AM

Hey guys, any suggestions for a trusted and reputable password manager?

Trusted meaning what?

I mean which is considered secure in your experience

That depends entirely on what you need. KeePassX is supposedly pretty good.

The pass utility is good on *nix systems, though it doesn't encrypt metadata.

Actually I never used a password manager but I am tired of remembering all in my head and writing it over a paper

Then KeePassX is probably good, since it's easy to use and pretty secure.

4:57 AM

But at the same time I am worried of storing all my passwords online

Do you want to be able to sync to other devices?

Or only to keep the passwords offline? Because when you do store it online with a reputable password manager, it's encrypted client-side by a master key.

I would prefer it to be offline

Windows or Linux?

I use both :)

But mostly windowa

*s

Yeah then KeePassX.

5:01 AM

Is it a application or a website?

Application.

I think it does support online sync, but you'd have to turn that on.

Otherwise it's just a program that encrypts your passwords with a master password.

Okay

(disclaimer: I do not use a password manager. I am just going by what I remember.)

But everytime I try to login in a website I have to first open the KeepassX to see all my passwords right?

I think there's a browser extension which works with it?

5:06 AM

I will check it out

Suppose I have opened KeepassX and all my passwords are visible then a person which may be staring on my screen would be able to steal all my passwords!

There might be some browser extension or application which automatically sends the relevant key to your clipboard buffer so you can just paste it into the browser without it ever being visible.

Oh yeah

Anyway, thanks forest

And also choosing a strong password while signing up in a website is also a pain

So I suppose thinks didn't work in this way

That's why it's capable of generating passwords for you.

Instead I think many people use a strong random password and use it with a password manager right?

Of course they can't remember it all

Yep.

That's the single, master password.

5:17 AM

Yeah, which have to be really strong

brb

But I also think hackers seldom target a specific person unless high profile. And a person which is aware of phishing, baiting etc, updated browser and have basic security skills would be never compromised.

brb?

Really it's all about awareness of security

But massive security breach can also be happen in Google, Facebook etc. exposing all passwords no matter how strong.

In which a user can't do anything

5:37 AM

brb.. yeah it means be right back(after googling) but as we have discussed before I have very little knowledge of internet slangs. So..

3 hours later…

8:07 AM

@daya that's not necessarily a good way to look at this. Better is to assume that hackers target everyone. Automation allows everyone to be a victim.

@forest 💩136% wrong

everyone's a winner!

@RoryAlsop Yeah, I understand it is true but we rarely heard the news that "a hacker has hacked into a FB or Gmail account by actually exploiting a vulnerability" AFAIK 90% of cases are generally social engineering

@daya 90% of hacked email addresses?

@forest that's not what I mean. Feminine doesn't have anything to do with what toys they play with. One of my daughter's is very girly and liked all manner of toys, from guns to bratz dolls.

8:22 AM

90% of all passwords to e-mail addresses are either guesses or found/bought in big password databases

Journeyman Geek

@daya cause why bother with fancy tricks when there's easier ways ;)

4 hours later…

12:01 PM

@TomK. I mean a account (which is combination of both email addresses and password)

@JourneymanGeek exactly, generally people are gullible enough to fall into phishing scams

Journeyman Geek

or you just buy or harvest information from places

Not sure what you mean?

That 90% is not from exploiting you as a target, but exploiting an individual on a network where you want to harvest data.

Your data will be harvested along with the other hundreds of thousands in the target database. You don't need to be a target yourself, you are just there.

12:17 PM

Yeah, but actually I was talking about regular scams such as banking fraud(in which people get tricked into give their OTP) and fill their credentials into a phishing page

And then shout "I have been hacked"

Social engineering is really very powerful

I am not one btw ;)

@daya I think we are either talking about different things or you have a wrong impression of how accounts get stolen today ;)

random internet article: money.cnn.com/2014/05/28/technology/security/hack-data-breach/… (2014)

which also cites these numbers
> 70 million Target customers' personal information, plus 40 million credit and debit cards
> 33 million Adobe user credentials, plus 3.2 million stolen credit and debit cards
> 4.6 million Snapchat users' account data
> 3 million payment cards used at Michaels
> 1.1 million cards from Neiman Marcus
> "A significant number" of AOL's 120 million account holders
> Potentially all of eBay's 148 million customers' credentials

@TomK. :O

They are massive breaches

Exactly

and this focuses heavily on North American users with the exception of eBay and Adobe

These are the cases where hackers hacked directly into their servers

12:28 PM

The first breach my details were stolen in was the Adobe one - according to haveibeenpwned.com

yes

The British Airways one was individuals. None targeted specifically. But exploit code inserted into page

there other cases though, where service provides literally save user data on cloud servers that are freely accessible

But these massive breaches generally didn't happen in my country

And most pension and mortgage fraud is individuals, but they don't target an individual. They get a huge list and go through them all

12:30 PM

so there is no real APT going on, just someone lucky enough to find it

@daya that's definitely the wrong way to think.

Journeyman Geek

@daya as far as you know

The internet is all countries. Some are just forced to report breaches

as I said, this article focuses on North America and does not account for Europe, Africa and Asia

Journeyman Geek

business-standard.com/article/pti-stories/…

12:30 PM

Yes Tom

@JourneymanGeek I am having lack of information

it is really unlikely that - if you are a typical internet user for more than say 5 years - your credentials were not lost once in a leaked or stolen database

Journeyman Geek

@daya so more or less someone can walk into any local government office, put together publically available information, and steal your identity

Oh, I really didn't know that before

@JourneymanGeek Yeah, I read about that article

Damn

Journeyman Geek

and if it was targetted a lot of information about someone can be worked out from that

birth dates, family...

Yeah exactly

Journeyman Geek

12:36 PM

pet names are useful (and my home wifi password has it... granted, that is simple and easy to guess by design)

lol

You shouldn't use your pet name as your password ;)

Anonymous

@Arminius But, I never said it when I wasn't asked :'(

Journeyman Geek

@daya well my wifi password is pretty much "if you visit, and you need it, just ask"

12:58 PM

@JourneymanGeek :p

3 hours later…

4:27 PM

@JourneymanGeek I have various WiFi networks. The one I share with strangers is segregated from any of my networks. And I do rotate the password for that one quite frequently

« first day (2838 days earlier) ← previous day next day → last day (2047 days later) »

Transcript for

Sep '1823

The DMZ

A serious place where infosec is discussed PS we don't do hard...

404-errors moderate-anarchism pretending-to-work staring-into-the-abyss

join this room
about this room

00:00

06:00

12:00

18:00

all times are UTC

site design / logo © 2024 Stack Exchange Inc; legal

mobile