The DMZ

12:50 AM

It's hard to help people who are just very confused...

Here is another person who seems similarly confused.

0

Q: Would a JWT token in the database provide extra security?

What I've been doing: I've been working on creating a HttpOnly cookie to prevent cross-site request forgery (CSRF). I've had trouble creating a HttpOnly Cookie on a POST(login) request. I did find an alternative solution where I can res.send(token) then in my store where my token is sent I can ca...

John Zhau

3:04 AM

Imagine a StackOverflow-like helpdesk/customer service...

Customer: My oven isn't working!
Helper: https://googlethatforyou.com?q=broken%20oven

Customer: Why isn't my refrigerator running?
Helper: That's a stupid question.

Journeyman Geek

3:32 AM

@JohnZhau uhhh.... modern helpdesks are not much better. :D

they just follow a script

Fire Quacker

Customer: Why isn't my refrigerator running?
Helper: It doesn't have any shoes.

ThoriumBR

it's infuriating as a customer when I call my ISP because they got a routing loop (and all packets get back with TTL exceeded in transit) and they ask me to reboot my router, and my computer, or plug my mouse on another USB port...

really, I once had to ask the customer service to transfer my call to engineering, because the script is so dumb it would end nowhere...

I got transferred, told the guy that the routing table on the routers A and B were wrong, he yelled about it to another guy, asked me to call back in 5 minutes if needed... it wasn't needed, as they probably reverted the change and rebooted the routers

took less time than to convince the customer service to transfer me to engineering

John Zhau

6:10 AM

Sometimes, when I connect to a WiFi network, usually my own home WiFi, if the connection isn't functioning correctly (has happened a few times, not sure of the cause), I would get a message in my browser telling me to log in through a portal to use the WiFi. My university has a WiFi portal on 172.16.x.x but my home WiFi should be 192.168.x.x so I seems like the cause shouldn't be in that confusion. Of course, when I get the unexpected "log in prompt", it never actually works.

Any idea why it happens?

John Zhau

6:25 AM

How would we respond to a CA compromise? I've learned of DigiNotar but it's been a while since. I'd imagine most servers and apps would remove the CA asap and that CA may go bankrupt, but what else would/should we do?

*root CA

MechMK1

@JohnZhau The problem is that people see Stack Exchange as a customer service, and get mad when they don't get what they expect

John Zhau

6:44 AM

I like teaching people how to solve problems but not so much solving problems for them...

MechMK1

Teaching people to identify the problem and asking question that allows them to solve the problem

reed

9:01 AM

The problem is knowing what you need to know, in order to learn what you want to learn. Often knowledge isn't linear, and to really understand something you need some background information, which in turn needs other background information to be understood.

I really have much more questions than I have answers, and sometimes I feel like this loop will never end

ThoriumBR

1:03 PM

@JohnZhau a CA compromise is a compromise of the entire TLS infrastructure. Except by a few minority that set the CA on the DNS records, every single TLS protected site around is affected.

my personal domain have the CA fixed on the DNS zone, and I doubt anyone would gain anything by MitM-ing my own personal domain, but few other domains are setting the CA on the DNS... as any certificate issued by any CA is valid for any domain, one compromised CA means the individual (or group) in possession of a CA certificate can impersonate almost any website...

if they get the certificate from, say, Noob-CA, they can issue a certificate for verisign that is signed by Noob-CA and it would be valid

John Zhau

1:26 PM

What can we do to minimize damage when a root CA is compromised then?

Conor Mancone

Stop using the internet

MechMK1

2:39 PM

@JohnZhau Suicide also works

@reed Then the skill is to find a starting point. Or, to ask where to start.

Fire Quacker

First principles!

Conor Mancone

@MechMK1 RADICAL FREEDOM!!!!!!!

MechMK1

3:38 PM

@ConorMancone Sartre is such a character :D

ThoriumBR

@JohnZhau act VERY fast, stop trusting that CA and every certificate it signed since always...

or put the CA you will use on your DNS zone, so you block anyone creating a certificate from another CA

Conor Mancone

4:15 PM

@MechMK1 I recently realized that I'm like 2 months behind on xkcd and existentialcomics. It's so sad... (mainly the existential comics - I don't find xkcd as entertaining these days)

Oh man, it is always so good...

existentialcomics.com/comic/348

reed

@ThoriumBR, I looked that up, it looks like it's DNS CAA records, but I don't understand how that can help. From what I understand, a CA must first check if that record exists to see if they are authorized to create a certificate. But if the CA is "compromised", what forces the compromised CA to follow the rules and actually check? My reasoning: compromised CA => avoid checking

Conor Mancone

"Also, have I told you my theory about how Germans are better than the other races? I used philosophy to discover this, by the way, not racism"

MechMK1

I mean it's not like he's wrong or such...

Conor Mancone

we've got a lot of Germans (and close relatives here), so I figured that would be agreeable :)

MechMK1

Y'all thought this was over just because I was gone for a week, huh?

Conor Mancone

4:19 PM

Let's be honest, it gets boring here if we only ever discuss security...

MechMK1

[Erika plays in the background]

Conor Mancone

@reed Although I'm a bit out of the conversation, I think the idea is that the browser (or more generally, the client) is the one doing the checking. As a result the client is going to check the DNS and can do that regardless of whether or not the CA is compromised

MechMK1

That's why I'm here, to gently steer the discussion away from this boring place called "on-topic" and instead discover the vast hellscape known as "off-topic"

Conor Mancone

His discussions are great to. I'm assuming he is just giving a factual description of the person at hand:

Hegel did recognize that a large part of society, namely the uneducated poor who had no real hope of advancement, which he called "the rabble", were excluded from political and social influence, and more or less condemned to live and die as poor laborers (Prussia was just transitioning from Feudalism to Capitalism at this time). However, he seemed to not really be too bothered by this.

In addition he somehow seemed to not think this progression of the "consciousness of freedom" would ever apply to women, and he seemed to think that Democracy was less free than a Monarchy (although in his conception the Monarch would have very little real power). He also expounded many theories for why such a consciousness of freedom had failed to arrive in places such as Asia and African, and let's just say, well...that not all of his ideas aged so well.

"The Rabble". Gotta love that

Why has that phrase gone out of style?

reed

@ConorMancone I would hope so, and that would make sense. But at first sight I did not see browsers mentioned in the explanations

Conor Mancone

4:23 PM

Although rather than "Rabble" I've adopted "Youths!" from New Girl. Same idea though

giphy.com/gifs/schmidt-youths-new-girl-QFraqen4EZDHy

MechMK1

@ConorMancone Imagine your existance was limited to work and the tavern. Who'd give a fuck?

reed

4:46 PM

@ConorMancone, I just found a question and answer here on SE, basically CAA is only meant for CAs, browser should not implement any checks (and they don't). Pity.

ThoriumBR

6:23 PM

@reed what the CAA record does is specifying that you will use that CA for issuing certificates. for example, my personal domain says it will be created by letsencrypt, and only it. If verisign issues a certificate for my site, my domain records says it should be from letsencrypt and the browser should reject the certificate

but as plain dns is plaintext over udp, it's possible to change the response in flight and remove the CAA record from the respone

*response

Conor Mancone

6:57 PM

@ThoriumBR Yes, but that requires a MitM. Therefore you need to take over a CA and have a MitM - an unlikely combination for your typical user

ThoriumBR

the typical CA adversary aren't a typical user, but a typical oppressive government...

they usually own the ISP, own the links, own the laws, own the media... but the CA usually is outside

so they create their own CA (state-controlled), issue certificates for gmail, hotmail, facebook, mitm their population and guess how journalist's sources get caught...

Conor Mancone

@ThoriumBR Good point!

ThoriumBR

nakedsecurity.sophos.com/2013/01/04/…

Conor Mancone

Strange question:

0

Q: Generalization of The Term "Insider Threat"

A definition of an Insider Threat in enterprises/organizations context is: "A current or former employee or business associate who has access to sensitive information or privileged accounts within the network of an organization, and who misuses this access." I would like to know if such a threat ...

insider-threats

ThoriumBR

I looked into it, started to think about something, lost interest and went on

there was cake on the kitchen...

those "define this" questions are boring... you say one word a little off the center, and people hammer you down...

Conor Mancone

7:05 PM

@ThoriumBR I don't think they are a great fit here anyway. I VTC for "Opinion based" but I think that "Off topic" would be just as applicable. After all, we're not a dictionary.

ThoriumBR

I voted to close as not a security question

MechMK1

7:19 PM

The idea of using jargon is that people understand what you mean. When you say "Insider Threat", 99.9% of all security folks will know what you mean, even if you don't present a formal definition. — MechMK1 12 secs ago

Tell me one person who has to deal with the concept of an insider threat, but needs a definition of the word

Conor Mancone

7:53 PM

@MechMK1 I can point you to a lot of people who have to deal with the reality of an insider threat but don't know the definition :)

MechMK1

Yes, but I'd say most of them have at least a workable idea of what an insider threat is

reed

8:09 PM

@ThoriumBR are you sure the browsers are supposed to check the CAA record? According to this answer, CAA is only meant to be checked by CAs: security.stackexchange.com/questions/180903/…

ThoriumBR

browsers don't check the CAA, only the CA, and all CA must submit the certificates to the certificate transparency logs

reed

@ThoriumBR, yeah, so basically to me CAA doesn't seem to help much if you want to mitigate the treat of a compromised CA. The Certificate Transparency Logs OTOH seem more appropriate

ThoriumBR

the point of the CAA is that external entities can check both the CAA in the DNS and the certificate transparency logs...

and you can easily create a plugin for your resolver or browser to check the certificates and the CAA, and flag those mis-issued

Transcript for