« first day (3688 days earlier)      last day (42 days later) » 

10:21 AM
@MechMK1 Not anymore because I deleted mine :) I really thought that the OP was referring to breaking into someone's account, but there was a comment about using login CSRF to get the victim to login to the attacker's account (which it could be used for). I read through the OP question again and saw that this is indeed what they were referring to, so my answer was invalid
Login CSRF in this case isn't much more than a poor man's session fixation attack, which is pretty darn low impact, but still technically has an attack vector
Can't decide if I should put my answer back and make it clear that the impact here is very minimum, or just leave it as-is. Considering that the OP was asking, "Is this login CSRF?", I'm not sure if my answer was very helpful regardless
 
@ConorMancone How so?
 
@nobody Which part? How is it a poor man's session fixation, or how is there still an attack vector?
 
poor man's session fixation
 
It may not be the best comparison, now that you're making me think it through :) But... Usually with session fixation you get the victim to use your session. Ideally this means that they then login and so you can pre-steal their session and gain access to their account.
A lot of times though session reset on login means that you can't fix the session and then keep it once they login. As a result the best you can do is login yourself and then get them to use your session, logging them into your account.
(kind of a reverse session fixation)
Then you just hope that they put sensitive data in your account (like stored credit cards) without realizing that they are logged into the wrong account. You can do this same thing if there is login CSRF
 
Hmmm... going the phishing way with this would probably get you better results.
 
10:35 AM
Yeah, but it's still a stretch
 
Getting them to store card info in your account is a bigger stretch than phishing
But if it gets you a bounty, it doesn't matter how much of a stretch it is
 
Goodness, hacker one gave out a $500 bounty for someone who identified a login CSRF on hackerone:
The researcher gave the same "motivation" as I explained above
Doesn't seem like a $500 vulnerability, but :shrug:
 
Yeah but in this case, if you get a researcher to submit a bug through your account, you will receive the bounty
 
10:52 AM
That's the problem with bug bounties
When I started my job as pentester, I signed an ethics agreement, which among other things, stated that I must repost vulnerabilities to the best of my ability - and neither over- nor understate their risk.
But with bug bounties, you're incentivized to blow everything out of proportion. Imagine how many people saw Server: nginx/1.18.0 in some response header and tried to sell off the vuln as high impact information disclosure
 
@MechMK1 This counts as a vuln?
 
No, but that doesn't stop people from reporting it as one
When I see information discloure like this, I always report it as low-impact finding. Like "Yeah, you're giving the attacker unnecessary information, but disclosure of the version info itself isn't really a vulnerability"
It reminds me a little about the guy who spoke about bugs in Firefox
He reported several bugs, and they were all just closed after a while due to "inactivity". Mind you, not him being unable to provide information, but the Firefox devs not responding.
That's one way to get the number of open bugs down: Just close them.
According to him, the other was to only accept security relevant bugs. And so, people marked every bug as security bug.
Then they said only critical security bugs. And so, people marked everything as critical.
 
@MechMK1 Disclose the bugs on twitter and they will get patched really fast
Or so I've heard
 
11:42 AM
@nobody It's not just security bugs, but also other bugs
For example, VLC Android has a bug that the media controls on the lockscreen just disappear. I don't know what exactly causes this, but once disappeared, only forcing the app to quit completely and re-opening it gets them back
Has been reported, nobody cares
 
 
2 hours later…
2:09 PM
@MechMK1, I found a bug in YOURSELF
how do I report it to you?
 
@reed Here
What's the bug?
Is it on my shoulder?
 
Actually, It was a joke that it's not really a joke. If I wanted to tell you something in private, what should I do?
 
@reed Well, you can use gpg if you want
@reed my public key is

-----BEGIN PGP PUBLIC KEY BLOCK-----

mDMEXfJDORYJKwYBBAHaRw8BAQdAm+kQLxeFhkxuh6aE2OYsxlBRF9NQOF02gSvI
etGJNH+0B01lY2hNSzGIkAQTFggAOBYhBDmpLDBVjB7g6b8a4mT1YIbwyyxaBQJd
8kM5AhsDBQsJCAcCBhUKCQgLAgQWAgMBAh4BAheAAAoJEGT1YIbwyyxaIKMA/3g2
6T7KzCq0wMLUFPbCGnxPxeI/a/79xH584aadFBwWAQCI7dttW+GoWxSUdQIF26W/
REPeIofZcQ/8GnVq9lcyDrg4BF3yQzkSCisGAQQBl1UBBQEBB0Bjzd0Y8gY6jZ1O
znjKuCFDK/ouZ5SPD6OgnE4YP+bUZQMBCAeIeAQYFggAIBYhBDmpLDBVjB7g6b8a
4mT1YIbwyyxaBQJd8kM5AhsMAAoJEGT1YIbwyyxa79AA/2tYyq6s8uFj/SWw+qf1
`gpg --import` to import it
`gpg -a -e -r '<key-id>'` to encrypt
Ctrl-D to end the message
Or just use a GUI client like any sane person living in the modern era
 
2:30 PM
You mean that I should encrypt the content and then paste it here?
 
@reed Yeah
 
We could, yeah
But if it's just one message I think it's fine
It's not like we'd spam the whole DMZ with gpg-encrypted messages
 
@MechMK1, ok, it's not that important or secret though, but encrypting it here could be fun, lol. It'd be the first case of "encrypted off-topic". It's just something I wanted to tell you, but I am not sure if it's ok to say it publicly. So I'll think about it, maybe write something, encrypt it, then paste it somewhere for you. I would actually want to go for a walk now
 
@reed Man, you're making me nervous now :D
 
2:42 PM
@MechMK1 that's why my ssh banner literally is Windows 9 OpenSSH-Server 3.11v95...
 
@ThoriumBR Make a Touhou fanboy squee by setting it to Windows ⑨ OpenSSH-Server 3.11v95
 
@reed steganography guys... post a meme with the message embedded...
aaaand I got over 40k points!
 
Congratulations, m8
 
@reed That's not the 1st case of "encrypted off-topic" here.
 
@A.Hersean Yeah, forest and I had that
Which is why the GPG Garden came to be
It is still technically against the rules
But it wouldn't have been the first time
 
2:51 PM
is tinychat.com still a thing?
yep, still online... create a room, post the link here, encrypt everything and send there
 
@ThoriumBR Congrats, although I thought people with >~25K stopped caring about rep :)
 
@nobody Actually sooner. Site analytics don't really matter to a lot of people
 
sure, after 25k there's nothing new... I am looking forward to 65536
 
I think 10k was the big one for me
Because I can see deleted stuff
 
32768 went by and I didn't noticed
 
3:00 PM
And that shit is the best part of SE
 
Yeah I'm aiming for 10K too.
 
yes, deleted posts are funny sometimes
 
then I guess I'll stop
 
A big spike in votes near the 24th of november
I wonder why
 
We could start a similar process that is common on social media: exchanging votes, like exchanging likes. I ask a stupid question, then you guys all vote it and answer it. Then we all vote each other's questions, and so on. Lots of points in a few days. StackExchange hacked!
We must wait until Schroeder is on vacation though
 
3:11 PM
I read an answer first and make sure not to read who it's from
Just to ensure I'm unbiased while voting
 
Depending on the financial state of SE, you could get a swag package when you reach 100k
 
Fuck yeah, merchandise from a company I deeply hate
 
What are you talking about hate for? This is FREE stuff
 
Sure, treat everyone like fucking garbage and then give a select few people socks and a T-shirt
 
I don't care what the logo is if they give it to me for free
I don't have to wear the shirt in public
 
3:21 PM
and right now, "in public" means in front of my wife and kids...
 
When political organizations I don't support send me mailings, I will happily keep any pens or stickers. The jokes on them; they're wasting money and I'm not changing my mind.
 
@FireQuacker Now I am halfway tempted to send you a SS uniform, just to see if you'd keep it
Imagine a company that sells the most angelic t-shirts you've ever worn. Like just touching the fabric will make you fill endless bliss. But the flipside is that whatever is printed on the front is just absolutely horrible. Pictures of mutilated children, animals being tortured, etc. etc.
Jesus, sometimes I wonder what the fuck is wrong with me
 
I think the same...
 
@MechMK1 You're a hacker, MechMK1
 
I am a hacker too, but my imagination is not that dark
 
3:36 PM
I have a system, you're looking for vulnerabilities
 
4:08 PM
@MechMK1, I'm going for a walk, I imported your key and I'll write something to you later, encrypt it and past it on pastebin.com (unlisted, expiration after 1 day). BTW pastebin now has password protected pastes, cool (but nothing beats GPG of course)
 
5:02 PM
@ThoriumBR Something in my brain is seriously fucked and to be honest I don't even want to begin debugging it
But hey, at least we're having fun :D
 
5:19 PM
@MechMK1 it can be changed... thought patterns are only neural connections. thinking on different subjects can reconfigure the connections
 
 
1 hour later…
6:31 PM
@MechMK1 Here merchandise about fascism is actually sold and some people collect it
I would actually accept an SS uniform, it would be cool stuff to wear for fun, trolling, comedy, etc.
Recently there was a bit of a scandal because a politician sung an old fascist song on a radio program, so I found myself singing it too lately, because it's catchy and there's also a dance version, lol
 
 
1 hour later…
7:43 PM
@reed Didn't you wan to send me something?
 
 
2 hours later…
9:13 PM
@MechMK1 yeah but I needed to finish writing it, now I'm done
 
@reed nice
 
@MechMK1 apparently I have a problem (might be a conflict in my distro) when encrypting using the key that you pasted here, but I think I can encrypt it with your rsa4096/D284BE8A key
 
@reed Not sure if this is the same key, but I have this rsa key
-----BEGIN PGP PUBLIC KEY BLOCK-----

mQINBF3uO8EBEADrTi5iIb/zgAm1UwT62DHXhEvOjhFktW3JdmWrUTDS96If5SFE
LYxxCoVd3cE6Cg3Qi8g81UDYYLvR5hL8vtrkAjMzmYWXzbG2AAW7zqmcvGglpHl5
Ee2HJUywts+X+pcfpKVUPS6Z/6vF0i0S5OaxQ6RnlhZX+49lFdGbZ6qU8xGXnItK
NtOIW3ST0+4aK+u4JfWT5r6/Kq7RhcjiRXXfSWPJqbmRjA+eUY0quBLyh7X71rQB
jMDDBvz2xyCCMfyDxeJ/2oY5kLduez8aG1um0TaznKQ6ADAE4QnxJ1uc52W4HPpN
AdHtBBMOlpXmCEyoTcYmmgQNfwGVdGO+QsvxgrsZ1P8CeWug6vviVL2Uuexl0pCz
tCMF8QBnQNjJ8oE/r2Ev2EPfwuwr/e1+4detlYDZejHOIZvjcCCUf5C9K1muCmfI
rkKUwO6q+gny6/xEEHBo+vTSxkwDzok5kX5/iqa5f+8hRBYZCmm73ArclOsU5Guo
 
yes, it's the same, I got it from your website
 
Honestly surprized me that that one is still valid
I tend to lose my keys a lot
 
@reed Yes, I am aware of this and some people here actually know my full name
I don't treat this identity as "anonymous" and consider that anything I say here can and eventually will be connected back to me
 
ok, good
 
One thing I do always stress is that my views I present here, on SE or elsewhere are my personal views and in no way related to my employer.
I never state who I work for, but knowing where I live and what I do for a living (which both can be inferred through publicly available information), it will not be too difficult to figure out who I work for
I consider myself "MechMK1, that one dude from the DMZ" and not "MechMK1, an employee of _________"
 
I always find it funny that people say that, I mean, saying that "my views don't reflect those of my company/employer".
 
@reed Well, in the current political climate, people are very quick to say "Hello <company>, did you know your employee holds <these views>!?"
The only policy in regards to what I am able to disclose publicly is our document disclosure policy, which states that only information that is classified as "Public" can be disclosed publicly :D
But that is mostly for "Don't talk about the cool vuln you found" and not "Don't be right-wing on Twitter"
 
9:37 PM
Yes, but stating that your employer or company doesn't necessarily share the same views, won't change much, will it?
 
@reed No, but I also don't want people to think my employer tells me what to say
Because as long as I don't disclose confidential information, my employer could not give less of a fuck what I say
 
"Who are you going to vote for? I don't know, let me ask my employer" LOL
 
I wish I could say that this is just fiction
But there are companies out there that are like that
 
I know
 
My grandfather tried to pull this, wanting my parents to take pictures of whom they voted for
Both refused to do that, and that created quite a fight that lasted for weeks
Anyways, if I need a fake identity, I pick a name generator, generate a first and last name, then pick a fake face and let's go
Hi, my name is Benjamin Greene
 
9:42 PM
I've always had issues with anonymity, online identities, etc. On one hand, if you want to be somebody, you need an identity. On the other hand, if you want to be free to express yourself, you need to be as anonymous as possible. That's my view, but I understand not everybody agrees
 
Here comes Thomas Campbell
@reed That's why I have several accounts which have no connection to me at all
 
are those pics AI generated, or stolen at random somewhere?
 
oh ok, that site is cool
 
AI generated. You can see it well in "Thomas"' shirt
Pretty easy to spot if something is AI generated if you know what to look for
And generating some fake names is very very easy. There's lots of "name" generators out there, which even ask for nationality, date of birth, etc...
The easiest givaway is that the background is usually extremely blurry
Earrings are also a huge problem for the AI
Glasses work...sometimes
Sometimes not
The AI hasn't quite figured out that the "has glasses" vector is an absolute. You have to be on one extreme - you can't have a bit of glasses
Because that ends in disaster
 
9:47 PM
AI is still too stupid
 
Also 2 people in one image...nah
Two people usually means that the AI is going to go completely bonkers
 
but I believe one day they are going to take a huge leap forward with some new discovery, like, merging images with semantics, then AI might start to understand what glasses are, what they are used for, etc.
 
@reed We already made one huge leap
We learned that these vectors are actually vectors
You can add them and the result is what you expect
So you can add the "is man" vector to "has glasses" and you will get a man with glasses
Here's an example where glasses work correctly
But here too you see that the background is just empty
Here the person itself is generated fine, but the background is a horrible mess
This picture would be unusable
Even a casual glance at the picture would raise questions
Whereas the one before is "Random tech company employee #7230598"
 
these might be AI generated, and therefore not exist in theory, but I'm sure in practice there are several people who look like that, so in practice these people do exist, LOL
 
Yeah, certainly
But the tech company dude, even if you I would be tasked with telling whether or not this guy is real...I wouldn't know
But just a few minutes on that site and you will have a collection of faces that would all pass casual scrutiny and some even more focussed scrutiny
Too bad I compromised the tech company dude, that is an amazing picture actually
Could have easily passed for a Senior ISMS Consultant with various certifications
 
9:55 PM
I once used one of those faces to create a fake Linkedin account, but it was suspended pretty quickly
 
Why do you think that is?
 
But I don't think it was the picture that was suspicious. It was probably all the bullshit I put in the CV/resume, total nonsense
 
Probably, yeah
I mean, it reminds me a bit of the SIN system in Shadowrun
A SIN (System identification Number) becomes more valuable, the better "curated" it is
 
I'm also not sure if it was suspended by a human moderator, or something automatic. I'd guess it was a human, but I can't be sure
 
Makes you wonder how they flagged you
Like, a rating 1 SIN just has a random person. Random age, nationality - just nothing. That's as if I would try to pass as a 78-year-old chinese woman
Rating 4 is "casually plausible": Sex, age and nationality match, supporting data seems valid on a cursory check
Rating 6 is basically an alternate life: All statistics match, valid biometrics, samples, believable history, etc...
The more time you put into a fake profile, the more believable it becomes - but also, the more effort you have to put into maintaining it
 
10:02 PM
The only thing that bothers me about fake accounts nowadays is that you often need a phone number. Facebook asks for a phone number, I'm pretty sure
 
Yeah, getting a prepaid sim isn't that easy anymore either
Here, since 2019 people need to register themselves when buying a prepaid sim
Yada yada anti-terror and all that shit
You could literally tell the fucking ministry of interior that a guy is a terorrist and they won't do shit
 
A SIM card in my country requires personal identification (with documents). Maybe I could get one anonymously from a foreign country, not sure if possible. Otherwise, well, "they say" immigrants here can sell SIM cards in front of the train station, you know
 
If I wanted to buy an anonymous sim, I probably could
The thing is, the black market is a weird thing
You come to buy an anonymous SIM card and a burner phone so you can shitpost on Twitter
And you leave with a SIM card, a burner phone, a kilogram of weed and a machinegun
2
 
VOIP numbers might be an option too, but I'm not sure if there are providers that you can fool with fake personal data
that is, they will give you the number without needing any documents, etc.
Stupid story of the day: yesterday I went to a porn website and saw that there were live cam shows for free. I entered a room, and I was wondering if those girls were actually streaming live, or if it was the usual trick (recorded video)
there was a chat, and the girls seemed to react to the chat, when somebody said "hey how are you", the answer would be "I'm good, thanks", just as an example
I mean, they answered by voice, to what was sometimes being written in the chat. Looked real! But I was still curious
After all, they could have recorded a video, and then programmed a chat in sync with the video. So I wanted to say something too, but I needed an account. I usually pick something like mailinator for throwaway emails, but it's usually rejected: "please use a real email!"
I don't know why, but there is another well known provider of throwaway emails that actually works most of the time, so I used that and I get an email to activate the account. Guess what? The activation link in the email did NOT support HTTPS
everything was HTTPS (I use HTTPS-Everywhere), the website is one of the major porn websites, everything is HTTPS BUT the activation link. That's unbelievable. I refused to activate the account. That's all, LOL
 
10:23 PM
@reed The whole point is to curb anonymous registrations. I'm sure if you know where, there is a huge market for anonymous phone numbers
and that's quite the story. Was the registration link pointed to a different domain?
 
@MechMK1 I don't remember, but I guess it was a subdomain
 
Very weird
I've stopped watching "live" pornography and instead subverted a group of hentai manga artists and subtly influence them over the course of two years to get them to draw my fetishes more. They won't feel like they're being pushed, but rather like it was their own idea
Now they will draw my sick and twisted kinks like "romance" and "true love"
 
I've never been interested in cam shows, I was just curious to see how it works. I just don't understand how some people can pay for porn
 
@reed Would you like to know?
 
Until recently I didn't even know that people "tip" the girls, and the more they pay the more a "toy" vibrates in the girl's vagina
 
10:32 PM
There is quite a lot of psychology involved, actually
 
that's insane, I mean, lol. Why do people even pay for that
 
For that specifically? I would guess the novelty of it
Most camgirls build parasocial relationships with their viewers
 
there's a lot of free porn, and I, as a good old pirate, keep on enjoying free stuff
 
They give "pretend care" in exchange for money
 
or maybe I'm just poor. If I was rich, maybe I'd waste my money for that too. But I'm not sure those people actually have much money to waste
 
10:34 PM
A lot of the guys who pay for that genuinely believe that if they just "keep at it" a little longer, she will "eventually realize his feelings for her" and she'll fall in love with them
No, they don't
To them, it's like an addiction
Because in real life, they have nobody who cares about them and gives them affection
The perverse thing is, a lot of people know that it's a parasocial relationship, but to them wasting thousands of dollars every month merely to hear someone say "Oh thank you for your donation, you're such a sweetheart. I love you so much!" is worth it
As for other forms of pornography, the above mentioned hentai manga is usually bought to support the artist
 
There is even a porn category (actually, a sexual deviation) that is called "financial domination". It's when you like girls that demand money from you. One of these days somebody will probably also invent "cyber domination", and guys will have orgasms when girls attack their computers
 
Oh yeah, I know about findom
A friend of mine recently upset a bunch of them by calling them "glorified e-bums"
Since well, it is the same profession. Their job in society is to beg for money, and make people feel good for giving away money.
 
"Oh yeah mistress, please, keep sending me infected attachments in my email, oh yeah, yeah, what a nice office macro you sent me, oh yeah"
 
> My port 445 is wide open for you
Actually you know what, I will do that
 
do what?
 
10:40 PM
Cyber domination
CyDom sounds great, doesn't it?
Tell my subs to put some BTC in a wallet on their machine and I will hack them
If they throw in some extra BTC, I'll even record my screen as I do it
 
yeah, but it only works if you are a girl
 
I'm sure there'd be some gays out there who'd be into that
And if that doesn't work, I look great in a maid uniform
2
 
although now that I think of it, there's some AI that can turn your face into a girls face
some youtubers have done pranks with that AI
 
Nah, I'll do the real deal
I can still do good enough voiceacting to immitate a woman
 
alright, maybe it's time for me to go. See you around!
 
10:48 PM
See ya
 

« first day (3688 days earlier)      last day (42 days later) »