« first day (3730 days earlier)      last day (51 days later) » 

9:34 AM
Good morning!
@FireQuacker What "legal action"? The "white hat" has absolutely no right whatsoever to any money. The company doesn't have a bug bounty program, and no reward was previously agreed on.
That's as if you shovel my driveway free from snow, then demand money from me and then threaten to sue me for not giving you any.
I heavily disagree with the idea that "something you know" and "something you have" are two distinct things. They're more like liquids and gasses. For example, the password Lemonade1 is clearly "something I know". The password K27%=Fj^d?xHQ7KgrBzhZtkn=qU8UB3Z, that I had to store in my password manager becomes "something I have". A physical key is "something I have", but if I know a key's depth and spacing, it suddenly becomes "something I know", because I can replicate it at will. What I am getting at is don't get too hung up on categorizations, as they're not as clear cut as it seems. — MechMK1 1 min ago
^ Your opinion on this?
 
10:26 AM
@MechMK1 I posted a comment to directly answer your comment. I also posted an answer for the OP's sake.
 
@MechMK1 Everything thing is actually just something you have. Knowledge is something you have inside your brain. Keys are something you have inside your pocket. Biometrics are something you naturally have. What separates them is that the attacker should have to attack each one of these separately and in a different way.
 
Basically, It's a guideline. Also, this doesn't answer the OP's question.
@nobody Exactly.
 
@nobody That is true
Also, I hate biometrics because the problem there isn't "how can I keep it secret" but "how can I make it difficult for the attacker to replicate it"
As in: An attacker can get my fingerprints much more easily than my password, and even more so if you are a PoI
 
Yeah you can only make them difficult to steal, never mathematically impossible.
 
But that's not the problem. the problem is once they're compromised, they're compromised forever
if I know my laptop is stolen, I can assume it will be breached and can rotate all my keys
 
10:29 AM
That's true too
 
If my fingerprints are stolen, well, tough shit desu
 
That's why biometrics should never be the primary factor.
Or they should be used only for identification (substitute to the login name).
 
Oh that reminds me, can you actually get fingerprints off a phone's screen?
 
@nobody Let me try
 
In theory yes, but I never tried.
 
10:33 AM
I can tell you that it works in practice too
I just took my phone as-is and it has a gorgeous, full thumb print on it
All the swipes have partial prints too
 
So how do phone biometrics counter that?
 
So if you can steal someone's phone without touching the screen, you can probably get a good print off there
 
They don't
 
@nobody Fingerprint sensors are distinct and not on the screen
And yes, they don't
Tap sensor. Doesn't work. Tap sensor again. Doesn't work. Wipe sensor clean. Tap sensor. It works.
 
The first protection of phones is that they are usually in your pocket or hand.
 
10:35 AM
So its best to keep biometrics off?
 
@MechMK1 Which method did you use to copy the print?
 
@A.Hersean For some people I know, that is nowhere near true
 
@nobody It's a tradeoff between convenience and security, as always.
 
Ofcourse the user always chooses conveniance
Well, to be fair, most really don't need that much security too
 
10:49 AM
@A.Hersean Sticky tape
@nobody I'm pretty sure it has remnant detection
So you probably couldn't use a residual print to athenticate
 
How does that work?
 
Residual print detection?
 
Yeah
 
Good question. Ask on the site :D
I don't know
Or rather, I forgot
Because I used to know for my PIB exam
 
Yeah I'm looking for existing questions right now
 
11:04 AM
9
A: iPhone 5S security: Given someone's fingerprint can I use a 3D printer to create a fake finger with a real fingerprint on it?

LateralFractalVendors of fingerprint scanners usually prefer security-through-obscurity, so open specifications of the hardware module ("TouchID" in this case) are unlikely available. Apple's firmware secrecy doesn't help. But we can speculate on common features of (good) fingerprint scanners: Capacitive to...

This answer lists the measures fingerprint detectors use, but I can't convince my self they are undefeatable even with just moderate resources
How hard can it be to fake a finger?
(I know I'm probably dumb since no one has done it yet)
 
Given that this question is 8 years old, it could be outdated by now
 
@MechMK1 The fingerprint sensor of my phone works through a sticky tape. I can't replicate using a finger unregistered in the phone to push through the tape (with a valid print on the tape).
 
@A.Hersean Yeah, that's unsurprising. I didn't mean I could defeat the fingerprint sensor with tape
I meant I could steal the fingerprint from the residual prints on the display with tape
 
Ah yes.
 
by that point, your "credentials" have been leaked
And at that point, your security no longer depends on the confidentiality of your key, but on the inability of the attacker to replicate it
For all we know, life-like "gel fingerprints" could hit the market tomorrow
Imagine if your password was assigned to you once and you could never change it, and the security of it would depend on the attackers inability to type it
 
J--
11:20 AM
I remember watching a video about it being somewhat trivial to get prints. But I don't remember the details so perhaps I misunderstood how feasible it is in the real world.
 
@MechMK1 That's one problem with stackexchange. You can't ask a question saying, "yes this question is answered here, is it outdated yet?"
 
@nobody Of course you can.
@J-- Getting fingerprints isn't even that hard
 
Technically you can, practically it will get closed as duplicate really fast
 
CCC demonstrated how to do it remotely
 
@J-- I saw someone using a high end Canon or Nikon camera to get a fingerprint from a glass
 
11:25 AM
@nobody Not if you specifically mention that the current answers are outdated
At least, you shouldn't
But hey, feel free to ask on meta
 
No I want to ask if they are outdated
 
J--
@MechMK1 Sorry, incorrect wording.
Not get prints. But get them and then make them usable on phones or really any fingerprint reader.
 
they later used glue and graphene and foiled the scanner
he took a picture from the minister 3 meter away... with today's zoom cameras, you could take a good picture from across the street, or from another building
 
Thanks, that's what I was looking for. Most method I found used a mold of the finger, and that defeats the point.
Well, one still needs to print a PCB / 3D print the fingerprint. That's not fast.
 
12:04 PM
25
Q: How can I accomodate custom pronouns in voice acting?

Alex FI am currently developing an RPG in which, during character creation, players may choose their pronouns as he/him/his, she/her/hers, or a custom entry based on their own text input. Whenever characters refer to them in dialogue, they will use the pronouns listed as they were typed into the charac...

In all honesty, I find the idea of making three sets of voicelines as "he", "she" and "they" to be more than accommodating.
That's just what happens when you are a minority - you don't get equal resources poured into your representation
Imagine out of 1.000.000.000 people, 499.999 would identify as "he", 4.999.999 would identify as "she", 1 would identify as "xe" and 1 would identify as "ze"
It's unreasonable for those two to expect 100% equal representation.
Let's make the experiment even more extreme, saying ~50% identify as "he", ~50% identify as "she" and 1000 people have 1000 individual pronouns. If we were to record voicelines for every individual pronoun, that would mean 1002 recordings would need to be made, meaning the voicelines >99% of people would get to hear would get <1% of the overall budget.
-2
Q: Encrypted communication system without CPU backdoor that is able to resist quantum computers

112358This is a process I invented for secure communications to be resistant against CPU backdoors and quantum computers: Personal public keys are transferred in person to each person's offline device. Messages are encrypted on the offline device using the recipient's public key and converted into a Q...

This question is fucking terrible
Did you actually read the "whitepaper"?
 
You read it?!
 
Yes
It's fucking shit!
 
Man you must be really bored
 
The tl;dr is: Alice and Bob meet in person and exchange a secret key. Alice wants to send a message to Bob. Alice encrypts her message with the secret key and then sends the cipher text to Bob. Bob decrypts the message with the secret key and reads the message.
Aka. Symmetric ciphers 101
His "mathemathical evidence" that it works is that the message space (aka. the number of all possible messages of a given size) is really big
"The number of pixel combinations in a picture is infinite" - Fucking hell
 
12:20 PM
And I assume, to avoid CPU backdoors, the cipher has to be simple enough to be done by hand?
 
The paper does not mention which cipher is used
He says brute force isn't possible because the attacker doesn't know what the correct image looks like
Sounds like someone has read the page on OTP and completely misunderstands how it works
 
@MechMK1 So I can flip one bit in an image, and now its secure?
Because the attacker doesn't know how the original image looked!
 
@nobody He assumes that every key leads to every possible ciphertext
But the chance of me encrypting the word "cunt" with key k and decrypting it with a different key k' resulting in a valid Windows executable are 0
 
0
Q: Is a question asking if old answers to same/similar question are still valid acceptable?

nobodyAs technology evolves, answers to some questions might get outdated. Now, if I see a question which I know has outdated answers, I can either post a new answer, or ask a question which points out why all the old answers are no longer valid and ask for newer answers. But what if I don't know whet...

Shameless plug for my meta question
Forgive the poorly phrased title
 
 
1 hour later…
J--
2:00 PM
What.
The.
Actual.
what the fuck am i reading.
@forest ^ you'll enjoy this.
 
@J-- Also his math is so fucking wrong
Since it's just black and white pixels, its 2^(H*W)
Which to be fair, is fucking huge
But that's not what makes crypto secure
 
J--
2:18 PM
@MechMK1 Yeah, he is totally clueless.
This line got me: "Do you think that average citizens like you and me are ready to use this kind of invention?"
I nearly fell out of my chair.
 
Does he say that in the whitepaper or the question?
 
J--
In the comments of the question. I am yet to read his paper in its entirety.
 
I think I got an aneurism when I read his PDF
I don't want to call it a whitepaper
 
J--
@MechMK1 Hahahahahahahah.
 
BWAHAHHAHAHAHAHHAA
HOLY SHIT HIS SEED GENERATION
Generate a SHA-256 hash, represent it as Hex and discard A-F
MY FUCKING SIDES JUST EXHAUSTED THE KEY SPACE
 
J--
2:21 PM
Wait...
He's
HAHAHAHAHAHA i see that
Is it Computer Misuse if I hack a website to remove misinformation? :)
 
It's a moral duty
 
J--
opens wpscan
 
also admin is the username
 
What's WP's password policy?
 
You see it because they say the password for this username is wong
 
J--
2:24 PM
^
 
Awww, admin:password doesn't work
 
J--
This guy's site is weird...
Why the fuck has he just got a page dedicated to OBS?
 
J--
lol. He has a PO box.
Johann Fradin - Aubingerstr. 156 - DE 81243 Munich
 
His fucking Spam Policy :D
 
J--
2:26 PM
@MechMK1 All these random pages, I feel like I'm about to uncover a cult...
 
> By sending unsolicited, commercial email to any address ending in kodbild.com, you agree to be fined a processing fee of $30 for each email message recipient. If you are using fake addresses in your email an additional fee for traceback and research will be added, depending on the technical and legal effort necessary to enforce our policy. The same fees apply to unsolicited postal advertisings.
 
@MechMK1 lmfao
 
Fuck, the website to the heaven's gate suicide cult looks more professional.
He can shove his policy right up his arse. I never agreed to this shit
Sick infographic
 
J--
LOL
Stupid question: I got an excel sheet with a column with a drop-down.
 
J--
2:32 PM
I have 600+ items in another column. I need to give them all the same drop down.
How do I do it?
 
@nobody The fuck is this?
 
J--
I have zero idea how to use Excel.
 
from his wp-content/uploads
 
J--
What a bizarre photo to upload to your own site...
 
2:35 PM
shit, wth don't they give the password too?
 
J--
Think they changed it not long ago.
It used to give you a password.
IIRC.
 
Does his PDF mention public keys?
His question mentions public keys
But his PDF doesn't
Only symmetric keys
 
J--
Who wants to place bets he has at least 5 people tied up in his basement?
What is this nonsense
This is really, really just odd.
The whole thing is odd.
He's also coining the term "kodbild"
"in a Kodbild is infinite"
like what in the world does that even mean...
 
"Bild" means "Picture" or "Image" in german
 
J--
I see.
But what is... "kod"
I don't get it.
 
2:42 PM
I assume "code"
 
J--
Right, makes sense.
 
The two words are pronounced somewhat similarly
 
J--
So "in a code picture is infinite".
 
Yes
 
J--
^^ there is text before that.
 
2:43 PM
I mean really, he discovered XOR
 
J--
Hahahahhaa.
 
Like every cryptonoob, he saw OTP for the first time, got a throbbing erection and opened his IDE of choice
 
J--
Hahhahahahahahahahhahahhahahahah ^
 
I believe not a single person interested in cryptography, who learned about OTP being perfectly secure, didn't immediately ask "So why don't we use it then?"
 
J--
I didn't :D
Oh, I just saw this... This is great, wait.
I'm dead.
and just fucking used paint to place images on top of them
wait.
i am pretty sure
he just used paint to put the phones
in the hands of a stock image
HAHAHAH
i cant tell
i think the person is actually holding them
either way its hilarious
 
2:49 PM
The green "OFFLINE" is the best
He just....took the two images, flipped them and scaled them
The same hand is just scaled down
Oh my god
 
J--
hahhahahahahahhahahahahaha
i cant breathe
hahahah
 
Also that sweater looks pretty feminine
I'm questioning Bob's fashion sense
Though to be fair, if my right side was just 25% smaller than my left side, I'd honestly wear whatever fits
 
J--
lmfao
 
-3
A: How do you know if the bios has been compromised?

Vincent RogiestI have been to the dutch police in eindhoven many times because equipment that was purchased in the mediamarkt is being vandalized and taken over by hackers for many years. I have also been many times to the mediamarkt in Eindhoven to return computers and drones that where still under warranty an...

WTF?
I wonder why everybody hangs up on this poor guy.....
 
J--
3:06 PM
The amount of unhinged people that exist on the internet never fails to amaze me...
 
@J-- become a mod and you will find so many more
 
J--
Oh I could not think of anything worse...
 
@nobody Clearly they're all in on the conspiracy
 
J--
^ hahah yup
 
I find it weirdly beautiful, like micro fiction
 
3:12 PM
I feel bad for laughing at so many mentally ill people today
 
The Kodbild one is sadder (I think) because the guy invested time and money in and thought he was inventing something amazing
 
J--
@MechMK1 Yeah, I often feel bad about laughing at them but I kinda' figure as long as I don't laugh in their face, i.e; ping the guy and laugh at him or comment something too mean then it is okay...
 
At least he isn't a con artist like that Crown Sterling guy
 
J--
Correct.
 
@FireQuacker The what guy?
 
J--
3:17 PM
End of the day, as crazy as his idea is, he isn't profiting from it. Sure, it is harmful to release such an application and call it secure but at the very least nobody is paying for this nonsense.
@MechMK1 You don't know about TimeAI?
 
Ohh, that!
 
J--
Yeah, Robert E Grant.
Their fearless CEO.
Who said he had a way of computing prime numbers infinitely then at a conference when it came to the demonstration he decided to only compute with values of below like 100 as it "wasn't the right setting/time to show the computation it can actually do".
 
Great demo m8
 
J--
Oh, then they tried to sue BlackHat.
 
I'm still amazed that he tried to speak at BlackHat
 
J--
3:21 PM
They paid $115,000 for a place at BlackHat, one of the sponsored talks, they got called out by Veorq and JP for being snakeoil.
Then they tried to sue BH for "allowing the company to be seen in a negative light".
 
Yeah, i remember
 
J--
They even claimed BH paid JP and Veorq to be there specifically to mock them.
 
Someone got escorted out for calling them out
Good times
 
J--
Yeah, that's correct.
I actually got into a 2 week long argument with a woman on Twitter about the whole thing.
She refused to accept that it was snakeoil then she mocked my rather technical blog instead of addressing the fact that she was A. totally wrong. B. had little to no idea what the paper actually said or how it worked.
This same woman is also the author of a "for dummies book" and we all know how good those are...
Before someone calls me sexist, I am not suggesting she was clueless because she's a woman.
It is merely a fact that she is a 50+ year old woman, with not a single day of experience working infosec at a technical level.
 
@J-- I find the idea that you're automatically sexist for telling a woman she's an idiot wrong
That Kodbild guy is an idiot, and I'm not sexist for saying that - I'm merely a sane person.
If a woman is an idiot, tell her. Equality for all.
 
J--
3:27 PM
Oh, I agree.
 
My Kodbild response
 
J--
I mention it specifically because she has about 15,000 followers on Twitter and many of them called me sexist for calling her an idiot.
 
@J-- Who cares? It just shows how easily people can be deceived into believing bullshit
 
J--
I don't care per se.
Just a thought that was in my mind when I mentioned her again.
 
@J-- Some people are just self-absorbed cunts, who think they ate wisdom with a fucking silver spoon
 
J--
3:30 PM
Just checked her Twitter, she is still promoting intelligence agencies and snakeoil on a regular basis. Nice to know some people do not change even when they are proven wrong.
All of this just made me realise that, this industry is actually filled with favoritism and quite frankly... Scammers/imposters. Take her book for example.
She isn't a cryptographer. She has no experience in cryptography yet she was asked to write a book for "For Dummies", quite a large publisher runs these.
It follows then that because of her name alone she got this position, after all, she couldn't have got it because of her technical or academic position, she has neither.
 
@J-- Why? I'm pretty sure they'd do it for free
 
J--
I mean, I kinda' knew that this industry had a lot of imposters anyways.
 
I mean mock people at cons
 
J--
Ohhhhhhhhhhhhhhhhhhhhhhhhhhhhhh.
Right, yeah. No, of course they were not paid.
Robert Grant is just a lunatic.
 
@MechMK1 Wait... does Kodbild ever actually say the key is to be used only once?
 
3:49 PM
the more you know, more you realize you knew nothing...
the kodbild guy need a course on crypto first
he know enough to create a product, without knowing why that's a bad idea, and that's dangerous
good thing his site is very amateur and very few people will consider downloading and using his software
 
4:26 PM
Rats... A "hi grandpa" scammer just called but hung up after my first response. I need to practice sounding like an old man.
I try to waste as much of those scammers' time as possible. I have zero sympathy for scammers who prey on the elderly.
Actually, I have zero sympathy for scammers in general, but I have even less for ones who prey on the elderly, if that makes sense
 
4:40 PM
@FireQuacker Those "people" deserve a short drop and a sudden stop.
@FireQuacker No
 
4:51 PM
why on Earth a website loads a ~900kb script to "record performance metrics"?
blessed be the noscript author
there are more scripts than content...
 
On the kobild guys site?
 
no, on a popular news portal in Brazil
there should be ~500kb of content (without images) and > 2MB of scripts
way more than 2MB, because one script is almost a MB, and there's at least a dozen
I am still trying to understand what the kobild guy achieves
 
0
A: Is a question asking if old answers to same/similar question are still valid acceptable?

schroederNo. The whole point of the site is to provide authoritative answers. If the answers need to change, then new answers need to be added, not new questions added. That way, even the historically-correct-but-currently-incorrect answers provide context. Plus, the SEO on those questions can remain poin...

 
looks like the encryption I made in 1998 in VB when I didn't ever heard anything of key, AES, IV, or cyptanalysis...
 
@MechMK1 Schroeder replied. What do you think?
 
4:59 PM
I just got the "girls cypher" and automated it...
 
@ThoriumBR What's that?
 
it's a substitution cypher used by the girls on my high school...
 
ohhhh... and everybody knew it?
 
it's the simplest substitution cypher possible, where one letter maps for only one other letter... so if X maps to T, T maps to X...
 
Caesar cipher?
Nope, I'm wrong
 
5:03 PM
@nobody I was on 7th grade, and the girls on the morning classeswrote encrypted messages to the girls on the afternoon classes... nobody knew I knew the cypher because I knew the names of the girls, so I could deduce a couple letters
within a week I had the entire dictionary, and after a year I told the girls I knew everything they were writing
 
lol
 
you write the letters A-Z on a circle, and draw lines connecting one letter to another, so every letter is connected to only one letter
 
In 7th grade, I came up with a slightly more complicated cipher (I forgot the details of how it worked). Then I found out I had nothing to encrypt
 
if there's only one CAMILA on the group, and a message starts with 6 letters, and the second and last letters are the same, I was pretty sure the encrypted word was CAMILA, and I had a couple letters on the dictionary... with 3 or 4 messages I had pretty much everything
 
Nice, looks like you're a natural cryptanalyst
 
5:07 PM
so I used that cypher to create my own crypto system... it was clever (for me), but it wouldn't resist Kerckhoffs's principle...
 
@nobody FYI, Stack Exchange announced that they are going to study the problem of outdated answers: meta.stackexchange.com/q/361097
 
the idea was to mix that cypher with another scheme where the first letter was a valid letter, the second letter was coded to say how much letters you would ignore, then that number of letters of random garbage, then the next valid letter
so if you would write HI, and that mapped to ZK, you would write ZBHEK (where Z is mapped to H, B means skip 2 letters, HE are garbage, and K maps to I)...
@FireQuacker yeah, somebody downvoted and commented an answer of mine from 6 years ago, when I recommended going from salted MD5 to salted SHA for password storage
 
@FireQuacker Thanks, I didn't think of checking MSE for this. Looks like all the sites figure out a solution for themselves.
 
1
Q: How can I improve my sheep dipping process?

PlasticCasioProblem: The hiring department occasionally sends me Word documents asking to clear the file as "safe" to open and review for purposes like resumes etc.; they can come from anywhere and are often unsolicited job applications. Based on the cornucopia of Word exploits out there and my relative inex...

what about sending me the files, and I sanitize them for $5 each?
"send me the files, and receive them back sanitized. formatting may not be preserved, images and tables may be on wrong positioning"
 
 
4 hours later…
8:51 PM
7
Q: Are ads on YouTube asking donations for sick children via drove.com a scam?

guestThe past few weeks YouTube has been showing me advertising asking to make donations to help pay medical bills for sick children via a crowdfunding site called Drove. However, the ads look very suspicious. In one example, a child called Tovi in a hospital beds talks in a Slavic language about bein...

Found a new low today
 
 
1 hour later…
J--
10:08 PM
@MechMK1 Yikes...
 

« first day (3730 days earlier)      last day (51 days later) »