The DMZ

MechMK1

5:59 AM

@ConorMancone "please I need it urgently" - oh boy...

@ConorMancone And as long as they are not used to circumvent a ban

MechMK1

11:02 AM

By the way, @ConorMancone, did you ever disclose the vuln of that one website?

rdab

hi all apologies if this is off topic at all. I'm reviewing the authentication mechanisms for a set of systems for which I'm a developer and producing a specification for a number of upgrades. This covers things like password policies, password reset mechanisms, security questions, brute force prevention mechanisms etc.

The majority of my recommendations are based on published advice from OWASP and the uk national cyber security centre and I've been able to find lots of good resources for most of the topics I'm reviewing.

One area where I havent managed to find any good information from OWASP or NSCS is social media login. One of the affected systems currently has the ability to login using facebook, as an alternative to the standalone login mechanism. Can anyone point me towards an authoratitive source such as OWASP or NSCS publishing this sort of best practices guidance for implementing social media login.

Conor Mancone

@MechMK1 medium.com/@sresearcher039/…

MechMK1

@rdab Just to make sure I understand correctly: You're developing an application where you have traditional password-based auth and want to offer facebook login?

@ConorMancone From you? :D

Nice!

Conor Mancone

Yeah, posted anonymously (although kinda defeating the purpose of that now!)

I also posted it to the full disclosure mailing list. The article has a few hundred views in medium. I kinda wish someone would hack it and kill the servers - it makes me sad that a few thousand email/password combinations are stored in an app with zero security effort

MechMK1

@ConorMancone Don't tempt me, please

I just want to see my ASCII art on the site just one more time

For the sake of the good old days

Conor Mancone

11:13 AM

lol, sorry :) For legal reasons I did as little as possible

MechMK1

I understand

Conor Mancone

They are driving an app, so you could just replace all their images with fun pwned memes... you do love memes!

MechMK1

I just want to get into their SMTP server to send a ticket to their IT, saying that the server has become sentient

Conor Mancone

ALL YOUR PASSWORDS ARE BELONG TO US

(I'm not actually suggesting you do any of that)

I did a minor amount of poking not mentioned in the article because I wanted to send a more comprehensive report to the owner

Their MySQL server accepts connections from anywhere on the internet, and they have an FTP server running as well

If that's not begging to get hacked I don't know what is...

MechMK1

"Hello, we here at GCM are terribly sorry for being unable to properly secure our systems. As a result, we've put the trouble on you - our dear valued customer - and you therefore now have to deal with your passwords being all over the internet. Kind regards, GCM."

Lord don't tempt me

Conor Mancone

11:16 AM

@rdab Policy for security questions: don't do that

What sort of information are you looking at for SSO via social media? Can you narrow it down a bit?

If properly implemented, it's usually fairly secure (or at least as secure as the user's social media account)

MechMK1

11:32 AM

Ready for a really shit take on recent events:

-10

A: Stack Overflow is doing me ongoing harm; it's time to fix it!

Marginalized groups cannot just avoid situations where they are forced to experience shame at their failure to normalize themselves. In order to attain any higher levels of career status, marginalized people are forced to do a lot of things that are a lot more uncomfortable than typing an "i" whe...

> gay and lesbian people are forced to act straight

> black people are forced to talk white

> opiate users are forced to hide their tracks

Can you imagine running a business and one of your employees tells you that they quickly have to leave for a few hours because they need some heroin?

And I don't even know what people consider "acting straight" or "talking white".

One take I have heard is that "talking white" is "using correct English grammar and vocabulary", which is quite an insult towards black people if you think about it.

rdab

11:57 AM

@MechMK1 thats basically it, except the systems already exist (including the facebook login part) and we are looking to update the way the authentication already works so that its up to date with the latest best practices e.g. updating the hashing algorithm etc. Ive managed to find implementation guidelines on everything except the facebook login part of it

MechMK1

@rdab You could ask the question "Are there guidlines for implementing third-party authentication schemes?" on the main site

rdab

@ConorMancone I was basically hoping for something like this for general best practices: cheatsheetseries.owasp.org/cheatsheets/… - owasp has a lot of guides like this for different aspects of authentication but i cant find any mention of social media login

MechMK1

And as for updating your algorithms: Make sure to have a solid plan for rolling over the hashing algorithm regularly, even if it is just to adapt the workload

rdab

@MechMK1 ah ok i didnt realise i could ask that as i think that would usually be off topic on the main stack overflow site

MechMK1

Not Stack Overflow

Information Security

Conor Mancone

12:09 PM

@MechMK1 This is clearly headed towards a lawsuit. I suspect that is a reasonable choice...

Does an employer have to accommodate someone who intentionally disables themselves because of their transableism?

Body integrity dysphoria

Body integrity dysphoria (BID, also referred to as body integrity identity disorder, amputee identity disorder and xenomelia, formerly called apotemnophilia) is a disorder characterized by a desire to be disabled or discomfort with being able-bodied beginning in early adolescence and resulting in harmful consequences. BID appears to be related to somatoparaphrenia. People with this condition may refer to themselves as "transabled". == Signs and symptoms == BID is a rare, infrequently studied condition in which there is a mismatch between the mental body image and the physical body, characterized...

(now I'm really stirring the pot)

@MechMK1 That's gotta be a troll... right?

MechMK1

@ConorMancone I honestly don't know. Monica suing SE, Inc. is a given, she has enough reason to do so

As for that guy...phew, good question. You know my political stance (or if not, you can probably guess by now), so you will know that i am not one who really supports statements such as "I am transabled".

The nicest thing I can say is that I can't be convinced that this is a troll, because there is a reasonable assumption that someone may actually hold such beliefs.

Conor Mancone

I mean, I could certainly believe someone actually believes all of that, but the "hiding track marks" thing is pretty over-the-top. Although, I'm sure there are people out there that would say all of that and believe it...

@rdab Social media login is just a variation on SSO and OAuth (which is what they pretty much all use)

MechMK1

There's quite a large group of people who are like "Opiate users are victims of their addiction and to tell them to stop is ableism"

Conor Mancone

As a result, I'd look into guidelines for securing OAuth flows

It's true that they are victims of their addiction. That doesn't mean it's crazy to try to help them to stop

MechMK1

I personally know one heroin user, and he has struggled for almost 10 years now with the withdrawal symptoms

The problem with opiate addiction is that even if you stop, the withdrawal symptoms will never stop.

Yes, there is medication, that you can get to make the withdrawal symptoms less, but that medication is often not covered by insurances.

As a result, many people, especially in the US, continue to abuse opiates, because it's the best alternative.

Which is weird as fuck if you think about it.

Conor Mancone

12:37 PM

I can actually relate to that. I mentioned previously that this has been one of the most difficult years of life for my wife and I. The short story is that we had our 5th kid this March. It was a rather traumatic birth, and my wife had some emotional difficulty after. She had some severe PPD after our last kid, so her doctor assumed she has having that again and prescribed Zyprexa. Things we know now: Zyprexa is an extremely powerful anti-psychotic drug.

It is only suggested for use treating severe bi-polar disorder, and only after all other options have failed, because of its severe side effects. We've read many horror stories from people who were on it long term and are basically incapable of getting off of it because it destroyed (among other things) their ability to sleep on their own. After a few months it was clear that my wife was fine but the side effects from this drug were crippling, so she stopped taking it (against doctor's orders)

She didn't sleep for three days - literally couldn't sleep for a second for 72 hours. 5 months later and her brain still hasn't completely bounced back (it's getting better very slowly). She still has bouts of insomnia (usually for a few days, once every week or so), except now it just keeps her up for a few hours instead of the entire night. I expect it will be at least 6 months before she might finally be "better"

People who have been on this drug long term usually reach a point where they can't operate without it, because the withdrawl symptoms will literally kill them... And of course since it was a medication prescribed by a doctor, there isn't any help getting off of it. I think she would have had better luck getting off of heroine...

MechMK1

Jesus...

How comes that the doctor prescribed that so quickly? It sounds like it was prescribed without any consideration for side-effects

A. Hersean

12:56 PM

Pharmaceutical companies are very good at selling their products to doctors, that makes those doctors more likely to prescribe unneeded or expensive drugs. Even though doctors should know better, it's hard to fight the many cognitive bias of our brain.

MechMK1

That's terrifying

Conor Mancone

I'm sure my wife's doctor was acting to the best of his abilities/training.

(that's the nicest thing I can say, it goes quickly downhill after that)

Regardless, there was some very real and severe harm done, and we're still dealing with the consequences

MechMK1

@ConorMancone I wish you and your family all the best. If there's anything I can do to support you, just let me know

Conor Mancone

I appreciate it

While I'm on the topic, fun fact about anti-depressants. Many anti-depressants have a risk of causing increased depression as a side effect. Mental health issues suck.

(Quote from the wiki page about zyprexa/olanzaprine): Olanzapine is used therapeutically to treat serious mental illness. Occasionally, it can have the opposite effect and provoke serious paradoxical reactions in a small subgroup of people, causing unusual changes in personality, thoughts, or behavior; hallucinations and excessive thoughts about suicide have also been linked to olanzapine use.

MechMK1

1:15 PM

Yes, I read that. Paradoxical effects are weird

Like how people feel hot when they are about to freeze to death, so they take off their clothes

MechMK1

2:47 PM

Those company-specific gTLD's really rustle my jimmies

On one hand you have the fact that yeet.bmw is a legitimate domain, and on the other hand the fact that bk-feedback-de.com is a legitimate domain.

tld-list.com/tld/calvinklein

Why does this exist?

Conor Mancone

3:01 PM

I was okay with the idea of adding new TLDs, but when they started being specific companies I quickly lost interest. I mean, a well-known tech company might at least be understandable to an extent, but calvinklein? That's just crazy

MechMK1

3:39 PM

@ConorMancone I oppose the idea as a matter of principle. It generates a have's and have-not's culture. Who decides who is big enough? And why*? It's just a status symbol

Conor Mancone

@MechMK1 Very valid point. Unicode has started having the same kind of problem. Sometimes the slippery slope starts getting very slippery from the very beginning

MechMK1

@ConorMancone Oh god, don't get me started on Unicode

Fucking everything needs to be political now

Emoji don't have a specific skin tone and people go fucking apeshit. When I was young, :-) was good enough to be a face

Conor Mancone

:) It's easy to find your buttons to push. Although I have very similar ones, so I don't say that at all critically

MechMK1

4:04 PM

True that. It's just, Unicode used to be a tech project, now it has become yet another battlefield for the culture wars

Now my gf is crying because JJ some months ago said that if our relationship is toxic, I should break up with her. Things improved since then, but her wild mood swings are still really exhausting

But oh well, things have an upwards trend, so at least I see the positive in that

Conor Mancone

Yeah, those can be hard to deal with. As part of her recovery my wife also deals with some depression that tends to come and go in waves (a few days of depression, back to her usual self for a few days, etc). Having good days is obviously better than always being depressed, but the back and forth can be exhausting

MechMK1

4:20 PM

For her, it's mostly depression, which then exhausts her, and she then tries to counteract it with extreme euphoria

She's then disappointed when I don't share the euphoria, which brings us all the way back to depression

Conor Mancone

Depression sucks. For some people, anti depressants can be very helpful and help with leading a fairly normal life. Obviously though it's not always that easy... Have you guys explored the possibility that some of her issues are caused by long-term depression?

I actually have some struggles with anxiety myself, but it is pretty minor and very manageable. I can very much see circumstances though were being a functional person would be difficult/impossible with better tools to manage the condition (actually, there's a strong history of mental illness in my family, so I have plenty of direct experience with this topic)

MechMK1

I have entertained the thought, but I'm not a psychologist and my gf refuses to see one

Her family would regularly label her as "crazy" as a kid, so I understand why seeing a psychiatrist is difficult for her

I have some mild anxiety too, especially when it comes to doing phonecalls with strangers

Conor Mancone

The crazy label certainly doesn't help. Mental illness is extra unfortunate because you can't see the problem, so people expect you to just be normal

There's a whole line of memes about it which I appreciate

robot-hugs.com/2013/11/helpful-advice

MechMK1

5:17 PM

Yeah, I understand that. It's just difficult to change how a person sees themself

Transcript for