« first day (3723 days earlier)      last day (48 days later) » 

1:18 AM
if i have a webtotp prototype solution and would like feedback to see if I'm missing any security flaws would this site be an ok place to ask?
 
@J-- If you're interesting in hardware security: igor-blue.github.io/2021/02/04/secure-boot.html
@depperm Dunno. We can't analyze complete designs for you, but we can help if you have specific questions.
 
so if I asked about security flaws in a web based TOTP app (app prototype: depperm.github.io) is that too broad?
 
@J-- More interesting hw stuff: dramsec.ethz.ch
@depperm Depends on the question. You can always ask and see.
But a question that boils down to "is it secure" would not be on-topic.
 
1:42 AM
@forest the question would boil down to what security flaws are there besides x, y, and z.
 
@depperm I guess it depends on how you word it and if you specify a threat model. Worst case, the question gets closed. Best case, you get a good answer.
 
 
8 hours later…
10:17 AM
morning. I don't think this would fit the main site, but I am curious to see if someone here can give me a tech reason / explanation for this behavior
Premise: I don't have access to the actual hardware involved, this is something a friend told me
Basically, they own a small 4g router/modem from a local Internet provider.
The modem works "fine", they just use it as a secondary connection to play games on consoles due to issues with the main connection coverage
the weird thing is that when the modem is turn on, the console can connect to it just fine.... yet, the internet connection won't work..... until they visit a specific site from the internet provider.
 
sounds like a captive portal
 
After that, all works normally until the modem is shut down for some hours...
Next day, the same procedure will be required.
The site in question is a portal that shows you the data for your sim - number, credit, used GB on your offer etc
it does so without any auth - that I guess is easy to do... after all the provider has to know your identity, so it can provide a personalized reply
Problem: the site now has a banner that warns of a "some time in the future" shut off, and a replacement smart phone app that requires a login (YAY! FREE SPAM!!!!)
so, the fear here is that since the modem REQUIRES access to that site to work...
what will happen if the site is killed?
@JourneymanGeek interesting, didn't know the term
 
10:35 AM
No idea
 
I admit my ignorance, had to look up what a captive portal is on google...
But, it seems quite "stupid" to kill the portal of your captive portal infrastructure...
 
maybe different auth methods
our local free wifi net went from captive portal to a 802.11x cert system managed by... a smart phone app
they'll need to check with the ISP though. It isn't exactly a security issue
 
@JourneymanGeek that said, why have a captive portal on a paid offer?
 
10:51 AM
\o/
 
11:05 AM
I mean, maybe I was not clear...
> Captive portals are commonly used to present a landing or log-in page which may require authentication, payment, acceptance of an end-user license agreement, acceptable use policy, survey completion, or other valid credentials that both the host and user agree to adhere by
just to use the wikipedia description. Not great, I know, but it gets the point.
 
Its a landing page ;)
 
We are talking about a 4g modem with a sim inside, and you pay a monthly fee for a fixed monthly total available GB traffic.
there is no password or other user initiated authentication involved
 
as far as you know
 
I said user initiated
my friend does not need to input anything on the page, they just have to visit it
so, if there is some form of authentication, it is automated by the router/modem (I assume it uses a customized firmware)
so, it seems stupid in a way, only an annoyance that provide no real security whatsoever
Furthermore....
> Captive portals often require the use of a web browser; this is usually the first application that users start after connected to the Internet, but users who first use an email client or other application that relies on the Internet may find the connection not working without explanation, and will then need to open a web browser to validate. This may be problematic for users who do not have any web browser installed on their operating system.
the device is a portable 4g modem, devised to be small and easy to bring with you and use in case you need to have internet access anywhere and you don't have other options.
Again, seem stupid to implement a captive portal that requires a browser
May I add... a recent browser that support some specific technologies.
I am quite sure that wouldn't probably work if someone tries to connect a PS Vita, for example
 
 
1 hour later…
J--
12:30 PM
@forest I don't particularly, no. This is from a general introduction to LFSRs for building a key stream for Stream ciphers.
I am just very confused why the placement of P_0, etc is different on each diagram.
Not even sure this would be a useful question I could post on cryptoex since it is likely a mistake.
 
 
2 hours later…
2:13 PM
good morning guys... shitty day down here...
 
 
5 hours later…
7:04 PM
Are these questions duplicates?
8
Q: Is it secure to store a two factor authentication seed in a password manager?

ProgramieI wonder whether it is really secure to store the Two Factor Authentication seed code (e.g. the secret key for TOTP) within a password manager together with the user and password for the service. If someone gets access to the decrypted password database (e.g. while the password manager is unlock...

2
Q: Storing 2FA seeds in a password manager

EMLDoes it make sense to store the 2FA seeds (i.e: the codes used to generate a time based OTP) in my password manager? If my password manager has a strong password and 2FA using a third-party app, is storing 2FA seeds for the accounts saved in my password manager poor practice? Ultimately I would e...

6
Q: Why would password managers provide support for OTP codes?

Ay0Can anyone explain me what's this trend of providing passwords and OTP codes on the same service? What benefit or value are they trying to bring to the table? We, as security professionals, have been fighting for the adoption of 2FA for a long time, and now that we are reaching a wider coverage, ...

 
 
1 hour later…
J--
8:12 PM
@forest Turns out it was a printing issue :D
 
J--
8:28 PM
Hey @MechMK1 :D
 
8:59 PM
@J-- Hey
 
J--
How are you doing? :D
 
So-so
Had worse days
 
J--
That's good I guess.
I decided to buy Offensive Security's new course, finally.
Hopefully I don't fuck this up...
Their prices have gone up so much, requiring more lab time would suck.
 
I'm sure you can do it
 
J--
I hope so. It is the introductory to exploit development course and I have previously studied for it a lot.
So I already have a decent amount of pre-course knowledge.
But for some reaosn I can't believe in myself till I do it..
The same thign happened with OSCP
I didn't think I could do it at all. THen I finished in 6 hours and I was like "oh..."
Honestly, the main thign I worry about is just having to keep buying exam retakes.
Like $300 a time is just stupid.
A total waste of money in a sense.
 
9:10 PM
I'm sure it'll be a breeze
 
J--
Yeah, I am going to go with 60 days lab time only because I know if I take 90 days I won't put in enough effort.
Thanks :D
I am sure I will be in here every day screaming "I DONT UNDERSTAND THIS" :D
 
I'd offer my support, but I am sure you know more than me already
 
J--
I've never asked you actually. What are you specifically interested in within pen-testing? Like web, right? Or that's just your day job?
 
9:25 PM
Yeah, mostly web stuff
And I honestly don't know anymore
Recently, I kinda don't have joy in anything
 
J--
Yeah, I thought it was. I really, really despise web stuff. I enjoy web code review but I don't enjoy black box testing web app.
Sorry to hear that :(
 
It really depends on the app
Sometimes they really nice and broken
But recently I worked with a lot of customers who have their shit together and their apps are usually really good
I only find minor things usually, stuff that isn't even a vuln really
 
J--
9:45 PM
Yeah, my web skills just.. Aren't that great.
Unless it is custom apps, like you say, I often find minor things only.
That just kinda bores me.
 
@MechMK1 same here...
 
God the DMZ used to be funny, but now it's just depressing
 
J--
I guess I just have a more fun time with more technical subjects.
 
I'm just not in a fun mood recently
I'm just so tired
 
J--
Maybe you just need a break?
 
10:07 PM
I do
Just from everything
I need my life back
Need to be among people
Eat in a restaurant again
In the office
I miss having a life
 
J--
Yeah, that makes total sense.
I am really anti-social and even I feel like that.
But you got us until that point :D
 
I'll be fine, nothing I can do about it anyways
 
J--
Well, if you want to talk :)
Of course...
 
10:37 PM
Sure thing
@AnneBatch Hey, welcome back
 
J--
@MechMK1 If I am completely honest, only recently I found my will to live again.
So I get it.
 
How so?
 
@MechMK1 Hey there! Thanks, it's a pleasure to talk with you
 
J--
So, how I kinda' realised is quite "funny" I guess.
For a very long time, I cannot remember being afraid of death.
 
@AnneBatch Thanks, and likewise. I hope you're doing well
 
J--
10:39 PM
I never considered death from any action because I wasn't really afraid of it, I would have been happy to die.
 
@J-- And now you are?
 
J--
But recently, I started to notice that I feel scared by things.
I started being scared by being in cars with people who I knew drive unsafe (Im a petrolhead)
That never scared me before.
I started feeling unsafe in other areas too.
And that made me realise now I gained my will to live back. I really don't want to die.
When for most of my life, I did want that.
 
@MechMK1 Same!
 
@J-- Honestly, I'm glad to hear that! Really man, I am so glad to hear you're better
 
J--
It is the strangest thing, really.
 
10:41 PM
But it gives me hope too
 
J--
I would happily jump in a car and drive 130mph (on empty roads of course). I would take corners at 50-60mph for the rush of it.
But I guess a few months ago I kinda realised that these things which were so normal before started to give me anxiety.
Which only led me to one conclusion: I want to live now. A very odd feeling considering I've almost never felt it before.
@MechMK1 Thank you :D
@MechMK1 And, I'm glad!
That was my intention :)
But yeah, if it is possible for me, I really believe it is possible for you too. Of course, there will always, always be ups and downs especially in the current world situation.
 
I hope things will get better
 
J--
And welcome back @AnneBatch
I am sure they will :D
ANd if you want something to occupy your time
you can buy OSEP materials and study with me :D
 
Not at the moment. I need to find back into some real life
 
@J-- Thanks! Nice to talk with you
 
J--
10:49 PM
@MechMK1 Yeah 100% understand that :D
I am lucky, I guess.
I had some form of real-life during all of this.
 
Make use of your luck then
 
J--
Living with friends + girlfriend.
So as far as pandemic specifically goes it hasn't been all that hard on me.
Which I am very grateful and fortunate for.
 
I'm lucky that I can still do my job
 
J--
Why would you not be able to?
 
But I haven't had much luck with my friends, or finding a girlfriend
 
J--
10:50 PM
That is the beauty of IT :D
 
Well, if I worked in a different industry
 
J--
Were you worried you would not be able to do your job?
Ohh..
Yeah, that is a good point for sure.
I am also fortunate for that. WE all are here, really.
I cannot imagine losing your job because of all this.
@MechMK1 I think you just need a wingman to help you with that last mission :D
lol.
 
As long as your name isn't Pixie :D
 
J--
Hahahaha, it isn't :D
Or maybe it is... :D
I actually remember when I first used this site
My name was my full name.
FOr some very retarded reason
how far i've come in 2 years...
 
So was mine
Which is why I don't consider this persona to be "anonymous"
 
J--
11:01 PM
Yeah, I am lucky enough my name is so generic that it looks like a fake name. It also means it is a lot harder to find me. On-top of that, this is pretty much the only site I use with anything even remotely close to my name. I don't have a LinkedIn or use job boards or anything. Which would likely be the easiest place to mine information.
But I too don't consider this persona to be that anonymous. If you knew me well enough you could ID me from my messages, for sure.
 
Of course, someone could get butthurt and call the police over me saying I'm NatSoc
But fuck, if you're this petty, please fuck off :D
 
J--
Hahaha :D
With the current state of the world, I could see that being a possibility.
 
Yeah they can fucking try
I have guns and nothing to lose :P
 
J--
Hah :D I didn't know guns were legal in your parts.
 
Of course they are
Austria has very lax gun laws
 
J--
11:15 PM
Oh right. Didn't know that.
 
It's awesome
 
J--
Yeah that is awesome.
I quite often wish I could have a firearm.
I don't really feel safe here, anymore.
 
A gun will help
 
J--
Yeah, it really would.
Watching Hikaru clips of chess is actually... Insane.
just... wow.
It actually hurts my brain to watch this.
 
11:37 PM
Holy shit
 
J--
There are clips of him premoving entire games.
Oh and this...
he cant even see the board. first clip of this.
and he knows every move, lmfao.
 

« first day (3723 days earlier)      last day (48 days later) »