The DMZ

« first day (3526 days earlier) ← previous day next day → last day (1359 days later) »

John Zhau

3:11 AM

Has there been a case where you used sudo, waited for 2 seconds and it turned out to be the correct password?

Every time I've had to wait for >1 sec it's been wrong

JBis

3:42 AM

Hi, I am trying to understand ZKP (zero knowledge proof). I get the basic idea but I'm confused on how to prevent replay attacks. Can someone either explain it to me or point me in the direction of a good article to read?

I don't care if it's non interactive zkp or not. It just needs to prevent replay attacks.

11 hours later…

A. Hersean

3:09 PM

@JBis In the ZKP protocols I know of, the verifier issues a challenge to the prover. The burden to avoid replays hangs on the verifier who must ensure to never send twice the same challenge, and to never accept a second answer to a previous challenge.

JBis

@A.Hersean Does that prevent MITM attacks as well?

A. Hersean

That's another question.

It depends on the protocol.

JBis

What's an example of a ZKP protocol that prevents MITM and replay attacks?

A. Hersean

Secure Remote Password protocol

The Secure Remote Password protocol (SRP) is an augmented password-authenticated key agreement (PAKE) protocol, specifically designed to work around existing patents.Like all PAKE protocols, an eavesdropper or man in the middle cannot obtain enough information to be able to brute force guess a password without further interactions with the parties for each guess. Furthermore, being an augmented PAKE protocol, the server does not store password-equivalent data. This means that an attacker who steals the server data cannot masquerade as the client unless they first perform a brute force search for...

JBis

3:26 PM

@A.Hersean thank you, i will look into it

1 hour later…

JBis

4:36 PM

@A.Hersean this is really intersting

A. Hersean

I'm glad that helps you.

JBis

5:03 PM

@A.Hersean Do you know if SRP has been considered for SNI encryption?

It sounds like it might work.

...maybe not because of the registration process

2 hours later…

Conor Mancone

6:50 PM

Craziest person ever:

Q: Can iPhone SIM card be hacked?

Something happened to me yesterday. My dad was always into hacking and I am convinced him or someone he knows hacked my SIM card or my iphone. Yesterday I came to his house and I was talking to him and I heard my voice and his voice being played back and the sound was coming from his body. I woul...

Steffen's comment is definitely the right answer here. If your dad's "body" is playing a live copy of your conversation with him, then why would you assume your phone is hacked?

And why not just ask your Dad?

Anyway, this is just me making conversation because it is so quiet without @MechMK1 here :p

MechMK1

7:22 PM

@ConorMancone I see that you need me for entertainment

Conor Mancone

@MechMK1 :) maybe

MechMK1

@ConorMancone Honestly, I missed it here

But work is sooo stressful at the moment

Conor Mancone

On a different note I now work for a megacorp who has a history of buying tinyco's. We had a conversation from someone yesterday that came from a tinyco who was very unhappy with the security measures we were asking him to follow - he was convinced that they were pointless and just hurting his productivity

So when I saw this question hit the HNQ:

Q: How to get infosec team to see that their over-the-top security measures are only decreasing security?

Summary: I worked for a small startup, that was acquired by a MegaCorp. Its IT security policies are excessive but don't add more security, and prevent me from doing work. How do I change that? First some context: the startup (let's call it tinyco) I worked for was bought last year by a large (t...

software-development security

I couldn't help but wonder :)

MechMK1

It's hard to say, honestly

If I believe measure X is pointless, then I will explain it and make it sound pointless

Conor Mancone

However some of the requirements the person says they are dealing with are definitely over-the-top and not requirements that we have, so I suspect not

MechMK1

7:30 PM

I would love to hear someone from the security team explain them

Conor Mancone

You probably would get a much different answer

In my case the person really wanted to store ssh keys in gitlab, and was irritated that our cloud team couldn't provide him with a private gitlab repository

MechMK1

Indeed. And i understand why some companies have really high security requirements, that may seem "over-the-top" to the average user

Conor Mancone

If I had a dollar for everytime he said "I want to keep this simple and easy", I wouldn't need a job

I was curious and checked that particular user's network profile. They have one question in security:

Q: Is there any flaw in my API-to-API authentication concept I missed?

I've been thinking lately about how all of the authentication methods used in API to API communications (RESTful API's) are mostly methods that have been designed to be human oriented first (tokens\passwords\etc) & how in API this often means you need a secret store to have the passwords\tokens s...

authentication

It is, without question, one of the most poorly designed authentication concepts I've seen

It's a whole lot of effort, a ton of downsides, and it doesn't even provide authentication

lol

MechMK1

Yes, but here you see the kind of person who thinks they know a lot, without knowing anything

Conor Mancone

Anyway, sorry your job is stressful. I hate it when my job isn't going smoothly - you spend so much time at it every day that it really sucks...

MechMK1

7:33 PM

He swims in a bowl and thinks its an ocean.

Well, I just had 2 weeks of vacation and now everything hits me at once

Conor Mancone

I need to use that analogy...

Hopefully it will settle down in the next couple weeks...

MechMK1

Feel free to do so, even without saying from who it is

One could say I'm starting to become a professional quote maker

In this moment, I'm euphoric :D

Conor Mancone

MechMK1

I didn't expect you to get that reference :DDDDD

The important question now is: Why did I make it then?

Conor Mancone

I'm still shaking my head over that "API-to-API authentication concept" that doesn't actually include any authentication. Literally zero. "Are there any flaws in my proposal". Why yes, yes there are. You made a steel gate but then forgot to put it across the road (although it's more like a straw bale than a steel gate)

Apparently I didn't get the reference: I just found the idea amusing!

MechMK1

7:45 PM

Well, you see that a lot with such people, that they think a concept gets better by adding more shit to it

Antoine de Saint-Exupery said it best: "Perfection is achieved, not when there is nothing more to add, but when there is nothing left to take away."

2 hours later…

Conor Mancone

9:38 PM

That's a good one. It's like a similar saying about how a really good writer doesn't just communicate their idea, but also does it concisely. This does not describe me.

So had a hilarious meeting with a third party vendor we are evaluating today. For background, we are a large company so this will be a large contract, and our CTO is very well known on the security space. I had gotten less-than-ideal results out of this tool we were evaluating and had asked about a meeting to discuss.

That meeting was today, and while I didn't think about it at the time, when it started there was like 6 people from the other company on the line, and then me. This included the boss of the support guy I was working with.

I forgot about it until the end and they were like "We know [your CTO] is especially interested in your results and feedback, so we want to make sure you are comfortable with the feedback you give him the next time you talk".

They definitely misunderstood something, because, while I do talk with the CTO on occasion, that was definitely not an accurate description of the situation. I'm one of about 20 people evaluating these systems, and while I am on the security team and so my feedback will definitely be seen by the CTO, I know he wasn't singling out me for specific "attention".These guys had all their highwr ups on this basic support call because of a misunderstanding :) I feel a bit bad but it is also hilarious.

« first day (3526 days earlier) ← previous day next day → last day (1359 days later) »

all rooms