« first day (3323 days earlier)      last day (1557 days later) » 

4:59 AM
Where is steganography practically used irl? I'm not sure how much learning stego would help in pentesting or anything related...
I'm setting up an Arch laptop. Can you give me some references on setting up the security like firewalls?
I wanna learn defense by setting up my own machine
I'm looking around "recover data from encrypted hard drive" and most of the results are for Windows and every article I've read so far is just "Turn off BitLocker" or "use certmgr.msc" which both just take some time, may be up to some hours. I haven't used FDE on Windows but is most of Window's FDE that easy to crack? Seems terrible.
 
 
2 hours later…
6:58 AM
@JohnZhau Not really anywhere, because cryptography is to steganography like a VW Golf is to a unicycle. One is a very practical tool, the other is mostly for show
In all seriousness, steganography is used if an adversary must not know that communication is even happening between two parties. This is not a requirement many people have
And those who do usually have the ability to send "binary" messages, e.g. the presence or absence of an object indicates status 1 or 2.
A good example was the root beer incident, where I think the CIA (don't quote me on that though please) was communicating with a russian traitor and they said if the operation is a go, he should put a can of beer on the table outside of his apartment.
What happened? He put a can of root beer there, and everyone was discussing if root beer was a beer (which it is not) and if he just made a mistake assuming root beer is beer because it says beer.
But even here, a simple "yes/no" answer sufficed.
As for arch, just look at the arch wiki. Though in all honesty, this should be more a passion project than something for productive use. The first few months after setting up Arch you won't get anything done. And afterwards, well...not really either
And I'm sure there is like one Arch user here who got Wifi to work on his system and would love to complain about it here, but his command-line browser does not support JavaScript so he can't reply.
As for BitLocker, it depends entirely on how it is set up.
The problem with Microsoft is that they want to use recognizable names, but those names mean different things in different contexts. Outlook for example used to be a simple mail program, but now it's more of a cloud-service thingy in addition to that.
As for BitLocker, there is such a thing called transparent mode, which was supposed to be the best user experience. Keys are stored in TPM, so you as user don't need anything to decrypt it.
The problem is that this offers literally no security. Like a door that tries to be "more usable" by opening as soon as you touch it.
But other modes, specifically those based on 20-digit passwords are pretty secure.
And yes, decryption takes a long time because it needs to decrypt a whole hard drive. The reason why it does not take ages to use your PC with bitlocker is because it uses AES-XTS, which is a special mode that allows you to start decrypting on any block and just decrypt the blocks you need
When disabling BitLocker however, you need to decrypt the whole hard drive, which takes a long time.
 
7:49 AM
Also you want to see something funny?
This is my political compass:
I am probably the most right-wing person among all the people I talk to regularly
 
 
2 hours later…
9:20 AM
So basically BitLocker just leaves a key under the Welcome mat.
and it still depends on the specific program being used for FDE and BitLocker is just commonly used?
I've read that Microsoft makes the users sign up to use FDE and the decryption key is stored in their server for some government stuff which means the government can unlock people's Windows machines by asking Microsoft for the keys.
 
@JohnZhau No, that is incorrect
Bitlocker in transparent mode does that, but that mode is heavily discouraged
 
Storing the encryption key in the TPM is to prevent reading the drives when disconnected from the motherboard. When connected to the motherboard, the secure boot is used to ensure that the OS was not tampered with and thus can authenticated properly the user.
 
@JohnZhau "Microsoft makes users..." is wrong. You can use Bitlocker without that. Microsoft offers you to do that, but recent Windows 10 installers don't use MS accounts as default anymore (probably due to legal reasons)
@A.Hersean Yes, the whole problem is that the keys can be sniffed in transit
 
Yep, that's the design in theory. In practice there's flaws at all the layers.
 
@JohnZhau So the absolute tl;dr is:
Bitlocker in Transparent Mode: **Bad**
Bitlocker in any other mode: *Good*
 
9:38 AM
The TPM design is a joke. The TPM workgroup process is a joke. The TPM implementations are sometimes bugged. The Secureboot is poorly implemented by MS. The secureboot implementation in UEFI is generally flawed. The isolations properties of VT-d and VT-x do not isolate that much and AMT is just a backdoor.
 
Aug 20 '19 at 8:01, by MechMK1
The real skill in infosec is not freaking out every day.
Sep 20 '19 at 10:14, by MechMK1
"An admin wants to analyze the traffic to see where an attacker came from. Which of these parameters is the least relevant?"

- ARP
- Geolocation
- User-Agent
- Potato
good ol' CEH
 
 
2 hours later…
11:30 AM
Quoting yourself is nice, but you know what's nicer? Someone quoting you trying to explain something to you.
 
@JohnZhau Can you give an example of that?
 
 
2 hours later…
1:37 PM
-1
A: How dangerous can a file be with no detected malware?

YashpalSpeaking of files in general, it cant be dangerous, if it isn't written to be dangerous or vice versa. Whether its a corporate environment or a home, if its a plain text file or an exe it has to pass through the layers of security. A lot depends on the source of the file. Where was it downloade...

 
 
2 hours later…
3:40 PM
I saw such a case in some reddit post some time ago so I can't really give you the sauce.
 
 
1 hour later…

« first day (3323 days earlier)      last day (1557 days later) »