Canonical ransomware question posted:

May the duplicates be plentiful, amen.

@Anders I didn't know that some ransomware just replaces the files with junk, but it makes sense

Some AV's get wary when a program just mass encrypts files

Also completely off-topic. I am fascinated by the Pre-WWII Third Reich, especially how it was praised by the US

In 1936, the Olympic Games were hosted in Berlin, and several US companies such as Coca-Cola, sponsored them

Nowadays this sounds absurd, but back then this was an insanely good marketing slogan.

@MechMK1 What does it say?

IIRC, Hitler was not just a popular leader in Germany but also well respected on the world stage (up until he started his expansionist policies, anyway). Germany basically went from a completely trashed crack house to an upscale mansion fairly quickly.

I haven't actually read much about that time in German history, so now I'm actually curious about what factors helped their quick turn-around. It certainly wouldn't surprise me if the "German Story" was generally praised at the time

@ConorMancone "Ein Volk, ein Reich, ein Getränk. Coke ist es" translates roughly to "One people, one Empire, one Drink - It is Coke"

"It is Coke" could also be substituted with "Coke is it" (more literal) or "Coke is the one"

@ConorMancone Yes, it absolutely was. I could get into it, but some of it would probably be considered "Mech is supporting the Nazis again" and I'd be away for 30 again

Though i am sure that a question like "Why did the Post-WWI German economy recover so quickly?" is a good fit for History

@J.J Hey, how's it going?

jesus reading the question from the guy who thinks his android phone got hacked is hard, I feel really bad for him :(

obviously he's just paranoid but it must be real hard for him

@UwU We get these people regularly

> My neighbor/co-worker/ex-boyfriend/government has hacked my computer/laptop/phone and is spying on me. What should I do?

The people themselves range from slightly confused about technology to batshit insane.

@UwU I suspect he might legitimately need mental help. Sometimes it seems like the person is just suffering from too much Apophenia but in this case I worry this person might legitimately be schizophrenic and seeing/hearing things.

Unfortunately that's obviously not something any of us can fix expect (as Mech did) explaining that they might legitimately need help

@ConorMancone Indeed. I mean, it's rough to tell a person that they might need help with their mental health.

That's why I said to the guy he should take a look at his life and consider if it is a possibility that he might suffer from paranoia.

@MechMK1 It's hard enough when it is someone you know. The odds of success as a stranger on the internet are effectively zero

Yeah, but then again I'm not responsible for the guy. As you said, I'm just a stranger on the internet

And the way you survive in this fucked up world is to not care too much

That particular conversation reminded me very strongly of the movie "A beautiful mind". Granted, you can't take a movie too seriously as a representation of mental illness, but they seemed well past the point of simply correlating unrelated events and into straight-up hallucinations

the way he gets frustrated when people don't believe him is kinda heartbreaking

@MechMK1 It sounds harsh, but there are simply too many things in this world to be able to care about them all. When it is a stranger on the internet sometimes it's great to be able to spend 5 minutes with them, but indeed it's just not something you can be responsible for

i mean to him he must think he's in real danger and everything thinks that he's crazy

Yeah, but then again we did all we could.

it's true

there's not a lot you can do to help someone like that

I told him several times that he is likely not being spied on.

I was truthful in the sense that I cannot know for 100% sure, but my experience tells me that he is very very likely to be safe.

right

It's like a lottery ticket. Sure, I can't "know" if the ticket won, but I am almost 100% sure that I didn't.

It's just part of being in security

You get these people from time to time, and it's sad. But then again, we're here to solve technical problems, not to fix people.

right

And the best we can do is tell them that perhaps they should see someone who can genuinely help them.

the analogy you made with the mechanic interviewing you was really great by the way

Thank you. I often like to include analogies to make some concepts more accessible.

perfectly encapsulates how I feel when people ask me to fix something but don't let me actually touch the computer

like how on EARTH do you expect me to help you with your problem if I can't even diagnose it

It's the same when people here on Sec.SE ask "Is my computer infected?"

No way for us to know for sure

Yes?

No?

Maybe?

just don't download random stuff off the internet

then you don't have to worry

the best antivirus will always be yourself

I like to say the best Anti-Virus is common sense

But I stopped giving tech support for anyone except my friends who are also huge nerds, and my immediate family

i mean it's true

The reason being is that other people loved to blame me for random issues years after

For example, a neighbor was told that "I'm good with computers" and they asked me if I could help them with their printer

some people just can't handle things being their fault

I agreed, and all I did was plug the printer in, and it worked

That was all I did

And I kid you not, 7 fucking years later they accused me of breaking something back then because something didn't work anymore

god

And ever since I refused to touch anyone else's PC

unbelievable

I still help my mom with tech problems, because she's my mom, but also because she knows quite a bit about tech (she's my mom after all :D) and knows which problems are roughly because of what

there were some times that I would look at people i was helping and just think "??? how has natural selection not taken you yet"

@UwU Yeah I ask myself how they get through life on a day-by-day basis

some people are just

fascinatingly stupid

I also help my friends, because they're all into tech as well and for them it makes sense what I say. So when my friend asks me "I have this situation and this problem. Do you have any ideas?" then things such as "Maybe the certificate has expired? Have you checked the logs yet?" just make sense to them

And when the things I suggest make sense to someone, they stop blaming me when something goes wrong

exactly

Otherwise I just tell them to bring it to a computer repair shop

with people who don't know what you're talking about it's just so difficult to describe what the problem probably is

i remember when i didn't know anything about security

@UwU I kind of want to keep the myth of the Black Hat hacker alive

It's so disheartening when people realize that a hacker looks like a regular dude and not Neo from the Matrix

lol

it really is

I did try to come to work with a black trench coat and several machine guns, though my boss did not appreciate it and said I looked ridiculous with dark sunglasses inside.

this comic comes to mind

Whenever I actually pop a shell I lean to the side and say "I'm in"

This is my new favorite news story:

zdnet.com/article/…

lol, you guys are hilarious

@ConorMancone The fact that they ask me if I want to accept or reject cookies is the best part

That news article isn't actually crazy at all - pretty normal stuff. I just appreciate the irony that a commonly used plugin to make those silly GDPR notices pop-up on sites ended up having a critical XSS vulnerability and will lead to lots of data breaches

@ConorMancone Yeah, things got too serious when I started talking about politics again

Video: "THE 2020 THREAT--"

when i was a kid i used to use the tree command on windows in front of my dad (a seasoned software engineer) and used to say "aren't I cool? I hacked my computer"

Do you want to know the funniest story?

absolutely

Before I applied to be a penetration tester, I had absolutely zero pentesting experience.

@MechMK1 Continue...

I literally learned how pentesting works in the interview.

You may say that's irresponsible. I say, all the years of me saying "Fuck it, I'll just wing it" in school prepared me to just wing my job interview

@MechMK1 I call that a definite win. That's a plenty useful job skill anyway.

god i wish i did pentesting

I still remember the guy asking me "So how do you think the check was implemented?"

@UwU My dad got me started on computers by moving the DOS games to a random folder in the computer's file system and making me figure out how to find it.

@ConorMancone This is so fucking cool

@UwU Then why don't you?

my dad handed me a big black binder with the python coding manual and just told me to learn it

that was my introduction to programming and computers lol

My father told me if I ever clicked on WinZip the computer would crash and I had to buy a new one

@UwU Maybe not the most practical method for most kids. Although it might work for some - I asked my parents for programming books for Christmas a couple times in high school. I learned C that way, and have never used it since

@MechMK1 lol, and that's a good way to discourage someone from learning about computers...

My introduction to programming was a fellow student back when I was like 10. He had some VBS knowledge and I just copied his scripts

to be fair, learning like that taught me way more than any of my actual classes

if something didn't work i just had to figure shit out

And all I could do was just rearranging what he had used in his scripts

I had no idea what a coding manual was. I had no idea where to look any of that up

I was the first person in my family who really bothered learning how a computer works

high key i think my dad wished i was a boy, he was kinda against me doing girly stuff and really pushed me to learning computer science

or maybe it's just a weird dad thing

Dads can only show you the world from the perspective of a man.

He probably encouraged you to do "manly" things because those were the things he was familiar with.

probably

If I had a daughter I too would offer her to shoot guns with me and play videogames and play warhammer and all that stuff

learning how to program made me feel like a badass until i realized how little i actually knew

Not because I wouldn't be happy with a daughter, but because those are the things I enjoy doing

@UwU Reminds me of this comic:

oh god yes

reading old comments is so awful and amazing

"who wrote this??? I wrote this?? why? what was i thinking??"

Yeah. I mean, coding is cool. I love doing little pet projects with coding. But what bothers me a bit is this "programmer mindset"

This idea that programmers are so far out and that they are so special and nobody could ever compare

My daughter is hilarious (she's 3). She is surrounded by boys (3 older brothers, one younger). She's a fun combination of "sterotypical boy" and "stereotypical girl", and it came to a head yesterday when we were picking out toys after getting vaccines at the doctor's office

At first she picked out a frozen princess lego set

Like, m8, it's just code. Even someone who never saw any code at all would understand what if(stuff == Status.Shit) Explode(); means

(sorry, frozen princess = Frozen the Disney movie)

@ConorMancone This sounded way more badass than it is :D

Then her next older brother picked out this big toy dragon and she practically threw down her Frozen lego set and trampled it in her rush to go get a dragon

Hell yes

dragon lego sets

Combine it. Elsa is now a dragon rider

also seeing your code made me think of this

She loves dragons about as much as she loves princesses and unicorns (although I suppose dragons don't have to be a "boy" thing)

@UwU accreate

@MechMK1 Oh man, an "Elsa riding a dragon" set would be her favorite thing ever

@ConorMancone nothing "has to"

@ConorMancone Probably because dragons are fucking badass

daenerys proved that

If it's a lego dragon I'm sure there's a lego elsa

dragons are DEFINITELY for girls

Ahah

Which reminds me of this strong female lead argument I have had a while ago with someone

Because I think the vast majority of people are not opposed to strong, female lead characters

Though you may wanna explain to her that going cray cray and burn everything with fire is NOT good. :D

She has a strong "girly" streak and also a strong "boy" streak. I realize that saying that probably breaks some rules, but it's how she is and it's fun to see how her own interests mix with those of her brothers

I'm not saying I would rather have a dragon than be a princess, but i am saying that if I had a dragon I could probably force people to treat me like a princess

And what puts some people off is when a franchise that has a strong male lead gets changed in a sequel or a reboot, the initial male lead is changed into a jerk and/or idiot and a new strong female lead takes over that does everything "better" and has no flaws

Star Wars, Ghostbusters, etc...

@MechMK1 That's probably true, but weird. My daughter is already a strong female lead character. You should see how she bosses around her older brothers

@ConorMancone Why not? At least, to a certain degree

There's always a difference between "taking leadership" and "bullying others"

But for example, look at the Metroid franchise

@MechMK1 Oh, I totally misread your statement. I thought you said that the vast majority of people are opposed to strong female leads

What I dislike is when the point of a strong female character is that she IS a woman

it shouldn't matter, they should just BE a strong lead

(gotta bounce - meeting)

Samus Aran perfectly fits the "strong female lead" archetype

@ConorMancone Good luck!

have fun!

She's independent, capable of solving all problems thrown at her. She is shown to be respected among her peers and not once was it ever a situation like "yOu knOw woMeN cAn Do EvEryThInG thAT mEN CAn"

exactly

She's just Samus, she's a badass, and that's all she needs to be

let women be strong leads without bringing up the fact that they are, in fact, a strong woman who leads

I personally didn't mind the way that Tomb Raider went, showing that Lara can also be weak and vulnerable, but without tainting the character that has already been established

some people say that they admire me because of the industry i'm in, which is bullshit because it really isn't that hard to do what i do

I think it's good to show that someone can have self-doubt without making this the whole point of their character.

@UwU I assume it's the voluntary minority status they admire

right

exactly

Which routes right back into the victim culture we've spoken about

i find it kind of insulting when people admire for being a woman and not being a successful engineer or programmer

along the lines of "is being a woman all you see about me?"

Well, that's all society focusses on these days

It's all about identity politics

You're a woman, you're black, you're gay, etc. etc.

I try not to engage with identity politics

i think it's a waste of brain power

"But isn't it brave to be part of this thing as this group?"

Yeah, identity politics is bullshit. It's patronizing

It's not brave, it's just what I like doing

being a woman has no importance

it's true, most of my peers are males, but that doesn't matter because we're all interested in the same things

"Isn't it brave for a woman to become a firefighter?" - Yeah, but I'd call anyone brave who volunteers to jump into an inferno to save a complete stranger.

@UwU To paraphrase Linus: "What matters is the code, not who wrote it"

it's like when people credited Katie Bouman for creating the first image of a blackhole

and she got mad and told people to credit her entire team, not just her

It's the same with all colaborative works

just because she was a woman in STEM doesn't mean that the rest of her team shouldn't get any credit

Movies, Videogames, research...

I want to commit sudoku every time people say bullshit like "Bill Gates, Creator of Windows"

right?

he's the face of it but not the sole creator of it

Funnily enough, the opposite is also sometimes used

For example, with Telltale games

how so?

The company went completely bankrupt, laid off all staff, then sold the name to the highest bidder. Now the new owners want to release sequels to the original games, and people will expect the same quality because it's the same developer name

oh yikes

But that's not how it works. These games are the result of a small group of people who wrote the script (Telltale games are very dialogue heavy), and you can't just completely replace them and act like nothing happened

Same with the Simpsons

right

I get that

The early seasons were amazing because of the writers

Zombie Simpsons are shit, because all the original staff changed

And not just that. the staff that replaced them didn't care about the fundamental concepts of the simpsons

These are the three components that made the simpsons great, and none of them exist anymore

it is at points like these that you just wish they replaced everything

and then rebranded

They should have just stopped

Make one last episode, showing how everything goes. Bart eventually graduates from school and starts to work in some local shop in Springfield. Lisa goes to university, graduates and gets into politics, etc...

Anyways, I gotta go now

alrighty

see ya!

@MechMK1 Indeed! It was a job interview for a security position (mainly on the "defensive" side) in a large tech company - it's pretty much a perfect fit for what I'm looking for. Seems like it went well, but only time will tell!

What is the proper term for the lower bound of the upper limit on the input box of a password? eg "a passphrase box's input length should never be lowered to restrict a user entry below 43 ascii characters"

@Gregory The minimum max-length? I don't think there is a term for that. I'm also not sure if there is really a good number to end that sentence with though.

43

IMO it's related to 256 bits converted to Base64

43 is indeed a 256 bit ascii string converted to Base64. 256 bits = 32 characters of ascii, and Base64 encoding increases the length of an ascii string by 4/3 (32*4/3 = 42 2/3 characters long).

I'm not sure if that has any relevance for password input length in general, but it might very well be applicable in your case

are there currently any crypto suites which keep secrets stronger than 256-bit?

my reasoning is along the lines that the minimum-max should not restrict the full usage of the key space

base64 seems reasonable enough to convert the raw binary into something typeable, since Base85 really wouldn't gain much more ground without giving up a lot of overhead to input sanitization

@Gregory Based on your comment about crypto suites, it seems like you have a particular use-case in mind. Which is perfectly fine. I figured you just meant passwords in general, in which case there really isn't anything that might suggest a preferred maximum length at all. Google uses a 100 character maximum length. Most passwords storage systems don't involve Base64 at all, so that reasoning isn't applicable

but again, if you have a particular use case in mind that makes 43 characters relevant, then go for it.

i wouldn't limit the upper bound of the maximum only the lower bound

it's more of a metta setting for something like word press or drupal, so that the admin page wouldn't let the admin set the max any lower than 43

@Gregory But why is 43 characters relevant for Wordpress?

sometime in the future or on a case by case basis it may be different, but 43 would be the smallest you could sanely cram 256-bits into ascii... a case for bumping it up would be when the general use of crypto goes past a 256-bit secret

so if an admin sets the input less than 43, they are in a since reducing the key sapce

@Gregory But when choosing a password, very few people make a random 256-bit key and convert it to ascii with base64... so why does 43 matter?

In fact, that would give less entropy anyway... a 256 bit secret converted to ascii via base64 would have less entropy than simply creating a password which is 43 characters long and composed of random ascii characters

yes most people don't but you wouldn't want to cut the key space short due to bad admin setup

But if no one actually does that are you really cutting the key space short anyway? If a 20 character random password is already so long as to be impossible to brute force (which it is with modern hashing algorithms), then do you need 43 characters anyway?

yes you could raw bit into a lower char count, but that would involve non-printables and hard-to-types

by setting the min-max at 20 you force the use of hard-to-types in order to achieve 256-bits

@Gregory But why does 256 bits matter if 20 characters is already impossible to brute force?

20 chars is 256 raw

wait sorry 32 would be 256 raw

@Gregory New number: a 16 character string composed of numbers+letters+special characters using a modern hashing algorithm is impossible to brute force. So why not set the maximum length at 16 characters?

if the password box was capable of accepting special chars it would be ok, but it has been my experience that most of these boxes do not allow ; or _ or % because they want to avoid issues with SQL

@Gregory numbers+letters+special characters gives you 72 possible characters. Losing three of them makes almost no difference to the entropy. So even given that, why isn't 16 characters a reasonable maximum since it is long enough to guarantee that brute force is impossible?

could 256 be done in less than 43, sure but [0-9a-zA-Z+/] is far less strenuous on sensitization. Do you need the full 256, no you probably don't even need 128. When considering a general case for the min-max that 43 [0-9a-zA-Z+/]'s would be less work for all parties and still allow those who wished to be crazy to go the full 256 without breaking the database

wait, not db

because the db should have the hash as you say

but without breaking the input box

i don't know, I was just thinking how far can I max out the password(256-bits) and what's a good way to represent it(base64)

@Gregory So here is what I'm getting at: I'm not actually voting for 43 as a min-maximum length, or 16, or anything else. What I'm really saying is that if you're going to pick a number and suggest it as the number to use, then it needs to have a good justification. Choosing 43 because it is a 256 bit key converted to ascii and then base64 is a justification, but since almost no one generates passwords that way it may not be a great justification

Which isn't a reason not to use it anyway

What I'm really getting at is the typical security perspective: there isn't a secure or not-secure, simply "secure enough for me". So for instance if you suggest "43 should be the minimum value for the maximum password length" then you have to be prepared for someone who comes back and says, "Meh, I think that 20 characters is long enough".

Whatever your answer is, you have to be able to provide good reasoning, and accept the fact that it may not be applicable in all situations. Which is why I decided to play "20 questions" here.

I'd like to believe I see the direction you're coming from, but setting the allowable max at 43 would also allow for shorter unless you restrict the min; however setting the max at 20 would cut off the use case of 43

which wouldn't be applicable if your current stack only goes up to 20...

@Gregory (playing the role of stubborn business guy) Yeah, but nobody is actually going to put in a 43 character password and 20 characters is definitely long enough, so I don't think it's worth the effort to adjust the system to allow your 43 character password instead of my 20.

Anyway, I'll stop playing devil's advocate now

@ConorMancone thanks for being a good sounding board