The DMZ

Anonymous

10:00 AM

and i have like boxes all over my apartment of like comptuer parts and stuff like that just stacked everywhere

Anonymous

so nobody wants to come in my house

Anonymous

its only my desk area and bedroom which is nice and clean

Journeyman Geek

meh, but I also want nice things lol

Anonymous

haahha i mean i got 5 monitors currently journeyman what more could you want

Anonymous

but yeah when i move

Anonymous

10:00 AM

im going to be a bit more... serious

Anonymous

i am an adult now i should at least have some plates lmfao

Journeyman Geek

its your place :D

Anonymous

i dont know why but i refuse to throw away boxes of computer parts

Journeyman Geek

lol. Most of us are like that

Anonymous

its really a problem... i still have intel cpu boxes from when i was like 10 its a bit stupid

Journeyman Geek

10:01 AM

lol

>_>

MechMK1

My cellar is full of them

Anonymous

i really like collecting things idk why

Journeyman Geek

I FEEL CALLED OUT

Anonymous

hahahah :D

Journeyman Geek

(actually I did a clear up at some point)

I do have a running SGI octane I forgot the password for though

MechMK1

10:02 AM

"This is a manual for Windows 3.1"
"Yeah?"
"I'll throw that away"
"NOO!!!"
"You don't need it anymore"
"You don't know that!"

Anonymous

hahahhahahaa mood mech

Anonymous

i still have about a thousand ps2 games

Journeyman Geek

24 of 25 windows 95 floppies :D

Anonymous

i dont even have a ps2

MechMK1

You know that you can play them on your PC with a regular dvd drive?

Anonymous

10:03 AM

i just decided to keep them all for some reason i like the cases

Anonymous

i know but my case is so modern design

MechMK1

I trued that with PCSX2 and it works SOOO WELL

Anonymous

it doesnt even have a dvd drive bay

MechMK1

Like, shockingly well

Anonymous

but i got a computer somewhere with a disk drive

Anonymous

10:03 AM

i might spin it up actually

Anonymous

i want to play spyro

MechMK1

You can just dump the ISOs and play them

Like literally, any iso-dumping tool will do

Anonymous

ill have to do that i been wanting to play ps2 for a while actually

Anonymous

i really miss the ps2

MechMK1

Me too

Anonymous

10:05 AM

i also had a ps1 but i was so young when i had that

MechMK1

If only there were good converters to feed my modern TV the PS2 signal

Anonymous

so i dont remember much ps1 games yu gi oh and tony hawks only

MechMK1

That don't cost 100 USD

I recently played THPS 4, the 0 stat challenge :D

God it was awful :DDDDD

Can I ask an on-topic question for a second?

Anonymous

yes lul

MechMK1

I'm testing a web app and it sends the token as a GET parameter

I know it's not best practice, but what's the actual problem with that?

Anonymous

10:08 AM

Honestly, I don't know.

Anonymous

Do you have more context?

MechMK1

So when you log in, you get a token

And then you send the token to api.example.com/some/endpoint?token=abcdef1234

Instead of sending the token as header

Anonymous

Hmm, honestly.

Anonymous

I actually don't think the issue is THAT big of a deal.

Anonymous

As far as I know the biggest issue is that if it goes via anything that doesn't secure the URLs.

Anonymous

10:12 AM

There probably is a bigger reason I am not aware of, web isn't much my thing.

Anonymous

But that's what I understand anyways.

MechMK1

What I read is it could end up in log files...

Wow...

Anonymous

yeah

Anonymous

its for nothing more than confidentiality

Anonymous

there's not an actual security implication past that

MechMK1

10:13 AM

A rather short-lived token in a log file

Anonymous

its as you say just a best practice

Anonymous

i guess there is also the thing of

MechMK1

As if the person who had access to the log file couldn't manipulate the app too

Anonymous

if you are rolling your own tokens

Anonymous

then they might be TINY

Anonymous

10:14 AM

and then end up in a log file i guess its more damaging

Anonymous

but honestly its just a best practice

MechMK1

No they're pretty long

Anonymous

yeah exactly

MechMK1

looks like UUIDs

Anonymous

but ive seen tokens on custom apps that they roll their own kinda' thing

Anonymous

10:15 AM

and they're very short

Anonymous

but it doesn't make a difference where it goes

Anonymous

in the sense that there is no BIG risk

Anonymous

short of it passing through unsecured locations

Anonymous

(logs as you said)

MechMK1

Also, I love the customer: "Nahh, we don't lock accounts"

"Your account is locked after too many invalid login attempts"

Anonymous

10:16 AM

ACTUALYL

Anonymous

I JUST THOUGHT OF A USE CASE FOR YOU

Anonymous

I just remembered another reason based on a "bug" i found

Anonymous

Have you heard of StreamAlerts?

MechMK1

Nope

Anonymous

Sorry, StreamLabs.

Anonymous

10:17 AM

Well basically StreamLabs have a streaming software mostly for Twitch streamers, YouTube streamers, etc.

Anonymous

They have a feature where you can display widgets. I found a "bug" where they were putting the token in the parameters.

Anonymous

A few streamers kept leaking the token when creating widgets live on stream and because I could physically see the token I could send alerts to the streams.

Anonymous

It's not really a "bug" because it's shoulder surfing but there's a use case for you why they shouldn't be in the parameters of a URL :D

Anonymous

So again, it is in-case they pass through unsecured locations lol. But I just remembered like a year or so back when I kept trolling streamers with this.

Anonymous

lmfao.

Anonymous

10:21 AM

You can still do that by the way, if a streamer is stupid enough to leak that token by showing the URL of a widget then you can send THOUSANDS of alerts to them.

MechMK1

I recall that you could XSS the twitch chat

Or some chat plugin a lot of streamers used

Anonymous

Yeah, a while ago there were a few XSS'.

Anonymous

They were stored so they affected every chat user IIRC. I believe they were stored anyways.

Anonymous

Kinda' surprised I remember that StreamLabs story, it was funny though. I did it to like some big streamers, SodaPoppin, Reckful (rip) lul

Anonymous

Since the alerts also have noise you could literally just spam their headset with thousands of alerts, pretty meme.

Conor Mancone

10:23 AM

This guy is irritating me now, but I'm happy to hear that I'm the one being stubborn.

See the comments on this answer:

5

A: Why use entropy at all in considering password strength?

I do password cracking for customers from time to time (to know whether their employees use good passwords). Here's how I would attack your passphrase or password. First off, we should assume the key or password is secret, not the method that it was made with (Kerckhoff's principle). I may not kn...

Specifically from JCRM

Anonymous

lol. Going to read this now.

Anonymous

By the way @ConorMancone if you never saw it way back when, I self proclaim I had the WORST interaction ever with another user on this platform.

Conor Mancone

He apparently wants me to acknowledge that randomly guessing a 128 bit "password" on the first try is possible, and thinks I don't understand probability because I refuse to acknowledge this as true

Anonymous

It was with a guy called JayMee, if you ever feel like a headache you can find the chats.

Conor Mancone

@J.J that is a very bold statement, given the inanity that happens on this site on a regular basis....

Anonymous

10:25 AM

I am guessing that @Forest doesn't come here anymore but even he got done with the guy

Anonymous

Well put it this way conor

Conor Mancone

yeah, we haven't seen him in a long while now :(

Anonymous

i had to make a 15 upvoted meta post

MechMK1

Let me read what this guy has to say

I miss Forest

;w;

Anonymous

and it took 2 mods to get the guy to stop lmfao

Anonymous

10:26 AM

@MechMK1 me too

Anonymous

i hope hes okay

Anonymous

183 days ago

Anonymous

feelsbadmn

Conor Mancone

I'm sure he's fine. Probably got tried of dealing with all the crazy people around here...

Anonymous

Most likely, yeah.

MechMK1

10:28 AM

Not my fault, that's for sure

But damn, that JCRM guy is a _______________

Anonymous

Forest was very interesting to interact with, super intelligent it was very impressive.

MechMK1

an idiot, is probably the safest way to phrase it

since I can't say retard anymore

Anonymous

lmfao.

Anonymous

I don't see why not.

MechMK1

It's people like this that make working in Infosec so much harder

Anonymous

10:29 AM

Perfectly valid tag.

MechMK1

Also, VERY important question:

When you make a toast with ham and cheese, do you put ham on the bread first, then cheese on top? Or cheese first and then ham on top?

Conor Mancone

I left it at "you're silly" when I realized that having an actual conversation was going to be pointless

Anonymous

Cheese, ham, cheese - george foreman or other grill

Anonymous

toasties are the only acceptable form of bread loaf

Conor Mancone

Toast cheese cheese cheese cheese cheese cheese toast

MechMK1

10:30 AM

I got to lose weight, so I stick to cheese, ham, bread in the oven

Anonymous

just cut carbs mech to 50-100grams per day

Anonymous

easy weight loss

MechMK1

I'm cutting calories, works much better

Anonymous

yeah that works too lol

MechMK1

Lost 4kg already

And my belt is too big

Anonymous

10:31 AM

easy light work

Anonymous

i am going to drop another stone and then im done

Anonymous

i have a lot of clothes that wont fit if i lose too much more weigth

Anonymous

and thats more important to me lmfao

MechMK1

I just want a good enough BMI again

Anonymous

id be sad if i couldnt wear them all without going to the tailor

MechMK1

10:32 AM

Plus some more workout

More strength, better endurance

Anonymous

yeah i just do callisthenics

Anonymous

at home*

MechMK1

Kyle gave me a bit of motivation :D

Anonymous

also mech if you get stuck i heard coke works well

Anonymous

:upside_down:

MechMK1

10:34 AM

:dab:

Anonymous

you know whats so funny

Anonymous

idk about you guys

Anonymous

but here in the uk people in security

Anonymous

at least in my experience of after parties

Anonymous

LOVE drugs

Anonymous

10:35 AM

but nobody talks about it publicly of course

MechMK1

I don't know too many security folks IRL, aside from my co-workers

I mean, we have some stoners, yeah

Anonymous

ah i know quite a few aye :D

Anonymous

oh im talking hard drugs mech lol

MechMK1

And I like some shrooms now and then

Never bothered with them

Anonymous

i say "hard"

Anonymous

10:35 AM

i hate that term.

Anonymous

mostly molly and coke

MechMK1

Yeah, but I know what you mean

I used to know a heroin addict

Anonymous

really popular here at after parties of security shit its a bit mad

MechMK1

With used to being the dominant part of the sentence

Anonymous

honestly i am like

Anonymous

10:36 AM

i have a few personalities in infosec

Anonymous

one of them is somewhat well known in a few crowds

MechMK1

I'm not really a fan of it, but people are old enough to make their own choices. I'm not their mom

Anonymous

i feel like there are a bit too many people that could expose me ngl lmfao

Anonymous

i do wonder what would happen

Anonymous

i guess i'd lose my job but

Anonymous

10:37 AM

i dont see why that should be the case

MechMK1

I'd honestly say just let them do their thing

If they want to get a stroke at 46, they can

Anonymous

lmfao

Anonymous

i know a kid who has a huge benzo problem

Anonymous

guzzles them like skittles

Anonymous

never seen someone care so little about anything

Anonymous

10:39 AM

its scary actually

MechMK1

Well, it's self-destructive, and I'm sure they're aware of it

Perhaps it's even by design

Anonymous

oh yeah for sure

MechMK1

Some people can't cope with their life, so they just act self-destructive

Anonymous

haha i know that very well

Anonymous

just i somehow always manage to stop with self destructive behaviour

Anonymous

10:40 AM

luckily

MechMK1

If I ever was at the point where I would not want to cope anymore, I'd do it faster though

Luckily I haven't had such thoughts for...about a month or two now?

Anonymous

yeah i dont get them so often anymore

Anonymous

its nice but i still get dumb thoughts about progress

Anonymous

and idk about you but i get intrusive thoughts a lot

Anonymous

like "ooh wonder what happens if i run out into this train"

Anonymous

10:43 AM

then i think about everything that happens when that happens

Anonymous

its kinda' weird lmfao

MechMK1

To me it's usually when I spend time with friends who are way happier than I am

It's always thoughts like "Why is your life not like that?"

Anonymous

See I think like that sometimes about my close friends

Anonymous

and then i remember that given my age my salary make me part of the top 5% in the uk

MechMK1

The last time I got really really furious was when some gal tried to explain to me how men can't be abused, because of their male privilege

Anonymous

10:44 AM

thats top 5% of my age and i just think "fuck it"

Anonymous

nevermind

Anonymous

honestly infosec is the only thing that makes me keep going

MechMK1

Did I ever tell you the Yoga story?

Anonymous

if i was living like this and i worked in lets say

Anonymous

mcdonalds i'd be gone by now

Anonymous

10:45 AM

no you haven't lol

MechMK1

I understand you

Anonymous

i actually cannot imagine not having a career

Anonymous

or a career you're passionate for

MechMK1

So, here's the thing. Many many years ago, I bought myself an android tablet, and I logged in with my regular google account

Anonymous

i feel bad for those people often

MechMK1

10:46 AM

Which of course, is the same account I use YouTube on

When I moved out from my mom's place to my own apartment, I left my tablet with my mom, since she liked playing games on the Tablet

Afterwards, my girlfriend moved in with me, and we were looking for a video I was watching on YouTube a while ago

So what did I do? I clicked on the history tab, and there were all the videos I had watched

Mostly stuff about music and videogames

But there were also Yoga videos. How did they get there? You see, my mom used the tablet to watch some instructional videos while doing the exercises

My girlfriend went fucking ballistic

Anonymous

Hahaha, oh dear.

MechMK1

She accused me of watching them as if they were pornography

Anonymous

jesus lmfao what happened in the end? :D

MechMK1

I explained it to her that my mom was doing yoga and wathing them, but she kept screaming and crying and god knows what

She always told me one day she was going to show me her diary, and after she moved out, I saw her diary while packing up her shit and sending it to her, so I had a look

It was full of stuff like "David has Yoga videos in his YouTube history. I think he is cheating on me. I want to kill myself" "David spoke with a female coworker today, I think he is cheating on me with her. I want to kill myself"

Also yeah, first name drop :D

Who gives a shit, it's not like it's not public anyways

Anonymous

OH wow, that is a very terrifying thing to read.

Anonymous

10:51 AM

Jesus Christ. Also, meme :D

Anonymous

So, I have a similar story... Not quite the same but along these lines.

MechMK1

One day, a female co-worker sent me a message starting with "Dear David, could you please do me a favour and call whatshisname and discuss that one project?"

And she saw and literally accused her of flirting with me

Anonymous

Im going to delete the parts though just in-case i dropped this name anywhere and irl people recognise the story.

MechMK1

She asked me to call her and tell her to stop talking to me

Anonymous

@MechMK1 that is insane...

Anonymous

10:53 AM

actually insane.

MechMK1

I told her to shut the fuck up and snap out of fantasy land

Yeah, that's how my everyday looked like

Anonymous

wow...

Anonymous

that sucks im glad you're out

MechMK1

I lived in perpetual fear some woman would speak to me in a way she disapproved of

Anonymous

that is absolutely not healthy.

MechMK1

10:53 AM

I remember, when we were outside, I asked her if she wanted a coffee

Anonymous

you deserve a medal for staying so long in all honesty.

MechMK1

She said yes

I feel so retarded for not leaving sooner

Anonymous

nah dont

Anonymous

you loved her its not so easy

Anonymous

its not something you can just say "oh i should have done this"

MechMK1

10:54 AM

So we went to a nearby coffeeshop and there was a woman behind the counter. I ordered two large Latte's and after paying I said "Thank you, have a nice day"

The first respone of my ex was "Why did you say that to her?"

Anonymous

my god thats just next level insecurity fr

MechMK1

You can imagine where that conversation went

Anonymous

that is absolutely crazy

Anonymous

kinda back to your yoga story

MechMK1

What about it?

Anonymous

10:55 AM

it reminsd me of this

Anonymous

but ima have to delete parts because i dont wanna have this in public archive forever

Anonymous

it was the most horrific experience of my life

Anonymous

they were like angry with me

MechMK1

Jesus, that's fucked up

Anonymous

to the point i felt unsafe lmfao

Anonymous

10:58 AM

yeah

Anonymous

crazy right lmfao

Anonymous

and until like a year ago my gf never udnerstood why she wont meet my family ever

Transcript for