The DMZ

MechMK1

2:00 PM

@ConorMancone By the way, tomorrow I am going to buy more paints and hopefully get into painting over the weekend

I want my painboy to be done

Conor Mancone

Shoot me a picture when you're done with it!

MechMK1

2:19 PM

@ConorMancone I will, and I want to do it well. But when my free time is limited to 3 hours per day, it gets difficult.

00:00 - 06:00: Sleep
06:00 - 06:30: Prepare for work
06:30 - 07:00: Go to train
07:00 - 08:30: Commute to Vienna
08:30 - 09:00: Go to the customer
09:00 - 12:00: Work
12:00 - 12:30: Eat
12:30 - 16:45: Work
16:45 - 17:00: Catch train
17:00 - 19:00: Commute back home
19:00 - 19:45: Take a bath
19:45 - 20:30: Cook and eat
20:30 - 22:00: Spend time with my girlfriend
22:00 - 00:00: Sleep

Conor Mancone

Not enough sleep! Two hour commute definitely eats a lot into the day.

MechMK1

More like 4 hours, and 8 hours of sleep is plenty

I actually get more sleep than I would otherwise

Conor Mancone

Oh, lol. Misread your schedule.

I really wish I could get away with 6 hours of sleep. I can do okay on little sleep for short stretches, but ~7.5 hours of sleep is the least I can get away with in the long-term.

MechMK1

Yes, but cutting into sleep to get more free time or such is really bad for your health in the long run

I tried that for a long time, often cutting my sleep back to like 4.5 hours.

Not a good thing to do.

@Rick Hey there

I was about to write a comment to your question

Rick

LOL

MechMK1

2:33 PM

> Because for a game you need to create your own application level protocol and that's a kind of encrytion.

Rick

I came here to ask something else. Good to see you. And @ConorMancone , old friend.

MechMK1

This is a false belief. Application layer protocols are not encryption. They have nothing to do with each other.

Rick

Why? Since the developers knows the meaning of each bytes, others can't imitate unless they make some effort.

MechMK1

No, that's security by obscurity.

Imagine a simple protocol in which a client sends "0" and the server returns "Boat" and every other message has the server return "Horse"

This is a rudimentary protocol, and not encryption.

Rick

Ok I see.

Conor Mancone

2:35 PM

@Rick Hello!

MechMK1

FTP - the File Transfer Protocol - is also a protocol, and it's very much not encryption.

Rick

Hi Conor

MechMK1

if you assume an attacker has good reversing skills, it will not take too long before an attacker will understand how client and server communicate, even without reading any documentation

Conor Mancone

Indeed, an application-level protocol is certainly a barrier to an attacker understanding your system and mucking with your data, but since they have full control over the client (and all network communication back and forth), they can always figure out the details enough to cause trouble

Rick

@MechMK1 good to know that. Because I have no experience in that field.

MechMK1

2:37 PM

@Rick That's fine. And Conor is right. If an attacker controls the client, it becomes even easier to tell how something works.

Rick

I am curious. For example, do games like PUBG use any encryption? Or to be more generic, do most games employ encryption on their udp data?

Conor Mancone

I don't do games, so unfortunately I can't say for sure. My guess would be "no", but that's just a guess. Especially for mobile games, there are so many ways that an attacker can take control of the app or intercept/change/generate network traffic, it probably isn't worth the effort

In essence, it's a cat and mouse game, and it varies depending on: 1) how badly hackers want to get in, 2) How much the app developers want to keep them out

Rick

Yes, I think so. As you said in the answer, doesn't worth spending so much effort on a rare attack.

Agree

MechMK1

Well, that's difficult to say

Rick

Btw, I came to chat for another quick question.

MechMK1

2:42 PM

Game developers don't disclose what they use, out of fear it would help attackers

In some way, it makes sense to not give away information, but you shouldn't depend on that information being secret for your system to be secure

Rick

Agree

Conor Mancone

Not quite an exact fit, but related: Uber has to spend a large amount of effort combating fraudulent apps in their ecosystem

Because they are such a large target, the lengths that fraudsters (and therefore uber) has to go to are quite crazy

Rick

LOL poor developers

Conor Mancone

As an example

MechMK1

As for encryption...I really doubt it. It doesn't really make sense, because cheaters would be able to decrypt traffic on their local machine anyways.

Conor Mancone

2:44 PM

eng.uber.com/…

MechMK1

@ConorMancone And? Could they do it?

Sounds a lot like fancy DRM for me

Conor Mancone

In particular, check out the section on "GPS Spoofing Detection". It's pretty crazy the lengths they have to go to

Rick

@MechMK1 Yes, I think so. One may intercept the decrypted traffic.

MechMK1

And?

Rick

@ConorMancone LOL that's very interesting

MechMK1

2:45 PM

Like, I doubt you would be able to intercept the traffic of my machine

Only likely if we are on the same LAN

Conor Mancone

"Instead, we developed an altitude profile for all the geographic locations around the world by aggregating historical trip data. We then compare each trip’s altitude with the profile altitude."

I find that hilarious

"We used a similar computation for speed matching, shown below in Figure 7, with hourly speed profiles for global road segments on each day of the week."

Sooo much effort

Rick

feel soo bad for the developers

MechMK1

But once I have some realistic data what LA traffic looks like on a monday at 07:30, then I can just emulate that with slight variations

Conor Mancone

@MechMK1 Indeed. I'm sure Uber has some techniques in place to try to keep people from mucking with the apps too easily, but most of their protection seems to boil down to behavior analytics to try to measure the likelihood that what they receive on the server-side is actually valid

Which means that next up the hackers try to get some realistic data of what LA traffic looks like on a monday at 07:30...

Rick

Btw, I have a quick question. Which TLS library should I learn? I just found so many alternatives to Openssl. Openssl is so difficult without tutorial, though I might learn something enough from SO posts.

MechMK1

2:49 PM

@Rick What do you mean with learning?

As in, developing software that uses it?

Rick

yes

What most company would use at work? You know what I mean. Learn the one that everybody uses

Conor Mancone

What are you using it for?

MechMK1

Bouncycastle or libhydrogen, or libsodium

Conor Mancone

I think that may be a relevant question

MechMK1

Don't use OpenSSL

And if you see someone using OpenSSL, don't

Conor Mancone

2:51 PM

(I've only ever used openssl snif sniff)

MechMK1

@Rick The vast majority of companies don't write their own crypto code, and THANK GOD they don't - else the internet would be even more broken than it already is.

Conor Mancone

Although to be fair I only ever use it for generating keys from the command line...

MechMK1

Command line is fine

I'm talking about openssl's libssl, not openssl

@Rick But if you have to use an SSL library, ask yourself: "What makes a good SSL library?"

And the answer is: The Pit of Success

Rick

@ConorMancone I don't know yet. Since I am going to seek some server side progamming jobs, I think I should learn a bit of that?

MechMK1

Our trusty Jeff wrote this blog post

@Rick That depends entirely on what servers. If you write custom server software, then most likely yes. If you write stuff that runs on a server (e.g. a web server), then no

Conor Mancone

2:54 PM

@Rick I've done server-side programming for ~15 years and I've never used an SSL library

And running stuff that runs on a web server is what I do

I.e. if you are writing a web application with some standard tools/languages (PHP, javascript, python, ruby on rails, etc...) you'll probably never need to use an SSL library.

Rick

haha. Ok. Now I know that it's not a common tool and I would be happy to skip :) Thank you for telling me that.

MechMK1

The thing about OpenSSL's libssl is that it's incredibly hard to use and you will likely make mistakes. Mistakes in crypto code are deadly. A good SSL library will make it easy to do things right and hard to do things wrong.

Rick

Yes I know that I don't need to handle TLS at a web application level.

@MechMK1 Totally agree. Openssl just looks like shit to me.

@MechMK1 My answer is: Good Documentation. At least I can know how to use it without asking one the Web.

45mins for a bath?

Wow 3.5 hours commute. that's quite long

MechMK1

@Rick It's not just the documentation, it's the whole API design.

A good crypto library is like "plug in your data and your key and you're ready to go". A bad crypto library is like "So, here's a few lego pieces. Build a working car now"

Rick

lollll

I like that analogy

MechMK1

3:03 PM

Even if it is all well-documented, it's still hard to get right

Rick

a few lego pieces. Build a working car now ... hahaha

> Part of the problem with learning how to implement OpenSSL is the fact that the documentation is not complete. An incomplete API documentation normally keeps developers from using the API, which normally spells doom for it. Yet OpenSSL is still around and going strong. Why?

OpenSSL is the best-known open library for secure communication. A Google search for “SSL library” returns OpenSSL at the top of the list. It started life in 1998 being derived from the SSLeay library developed by Eric Young and Tim Hudson. Other SSL toolkits include GNU TLS, distributed under the GNU General Public L…

developer.ibm.com/tutorials/l-openssl

But that's the story for the old days I think.

MechMK1

It's still true

OpenSSL fucking sucks.

People are like "ohh it's so good I see OpenSSL everywhere", but reality is you spend like 3 hours in the source code and you have yet another CVE to request

Rick

T_T

Good article. I just finished reading that post.

MechMK1

4:05 PM

So, on my way home now

Transcript for