The DMZ - 2011-05-23

« first day (158 days earlier) ← previous day next day → last day (5020 days later) »

Scott Pack

00:06

@RoryAlsop Is this related to your statement a few days ago about spinning off different divisions so that you could stay at home more often?

@Iszi I think I'll make building out an old school games rig my next project.

I recently got a new case for my HTPC, so tonight's project is hardware migration.

Iszi

Couple things it feels like I got right in this latest re-build: 1.) Putting my VMs on a separate partition. 2.) Making a VM dedicated for work connections.

Scott Pack

That's probably a good idea, yeah.

I'm really looking forward to the day when it actually makes sense to run your laptop as a hypervisor

Iszi

You mean, dedicated hypervisor?

Scott Pack

Right.

Typically, whenever I heard the HV word used, that's the idea.

Hardware support just isn't quite there yet. Plus, the whole 3d video thing.

Iszi

Yeah, got it. Well, I like the concept but I don't. Kinda don't like the idea of divvying up my system's resources full-time.

Scott Pack

00:12

The resource pool management will have to be customized, but I think it's probably worth the dev effort.

You'll basically end up with something like ESX/HyperV for Enterprise and ESX/HyperV for Clients

Iszi

Guess the gamer in me just likes having 100% of my system's resources fully available.

Scott Pack

Then only run one VM. Even now, the performance hit of ESX is pretty negligible.

Iszi

Well, with that there'd be no point in running a VM at all now, would there?

Scott Pack

Snapshotting is the quickest win, migrations would be another.

Iszi

Hm. Suppose you're right there.

Scott Pack

00:17

Imagine coming in in the morning, plugging in your laptop, and by the time you've poured coffee your "Work VM" has migrated from your laptop to your desktop.

Iszi

Why migrate at all? That's what docking stations are for, and laptops with enough horsepower that you don't need a desktop.

Scott Pack

That's a weaker one, granted.

Separating the OS from the hardware is really the key. And given your support background I think I can imagine your face when I brought up snapshotting :)

Iszi

It's definitely got its benefits.

Scott Pack

Riddle me this. The new case had the Power LED positive and negative leads broken out into two separate connectors.

Iszi

I've seen it before. Makes it easier when the layout is wonky on the motherboard end.

Scott Pack

00:29

Does that often happen?

Iszi

I actually had one time where I had to take scissors to an audio connector for that reason.

Scott Pack

Come on! The motherboard make/model isn't on the board

Iszi

It's gotta be there somewhere... what are you doing with a mystery board anyway?

Scott Pack

It's an atom based thing. Apparently, without the hardware rendering of Silverlight4, it's not quite beefy enough to play NetflixHD.

So I bought it from a coworker for relatively cheap. Since I don't have an HD netflix package, it has worked like a champ for me.

But, that also means, I didn't purchase it originally

Iszi

Hm. Never built an Atom system. 'Course it's been awhile since I've custom-built anything.

Scott Pack

00:35

I've been a mythtv user for years, so I've gotten a bit in bed with the whole homebrew media PC thing.

4 hours later…

nealmcb

04:55

@ThomasPornin Any comments on supergenpass.com? CV the critique and my response at stackoverflow.com/questions/554224/…

2 hours later…

Iszi

06:54

@nealmcb Wow. If I didn't know better, I'd say I actually know a guy in that thread. But, his name is spelled different and his location (while still in-state) is a bit far from anywhere I'd expect the guy I know to live.

5 hours later…

Scott Pack

11:41

@Iszi Does he have an awesome mustache in real life too?

1 hour later…

Iszi

12:55

@ScottPack I don't think we're talking about the same person.

In other news, found an annoyance with Firefox 4. Minor thing really, but an annoyance nonetheless. I've pretty much gotten used to how they've done away with the status bar and all - nice way to save screen real estate. However, some of my add-ons still require it. So, I've enabled the "add-on bar". The annoying bit is how now, with the add-on bar where status bar stuff should normally be, the status bar stuff now pops up above the add-on bar.

Why can't they just put it right where it used to be?

Scott Pack

13:12

@Iszi There was a dude on that thread from FL who's gravatar had an awesome mustache.

I found that on Linux hitting the alt key does not bring up the menu bar.

So I had to just change the display settings to show the old school menu bar instead of the new hotness.

Iszi

13:28

I don't have a problem with the menu bar being gone - don't really use it that often. But yeah, I'd find it really frustrating if Alt doesn't bring it up.

Ah, totally forgot that gravatar had the mustache.

Thomas Pornin

13:57

@nealmcb I have looked at it a bit

On the use of MD5, you are right: the security relies on preimage resistance, for which MD5 is right now believed to be robust.

Personally, I would have used SHA-256 or SHA-1, and HMAC with the master password as key, but that's nitpicking.

The concept is a bit flawed, though: basically, the site domain name is used as salt.

Hence, two people using the password generator on the same site end up using the same "salt". An attacker who could read the database can then attack all those passwords in parallel.

The weakness is mitigated by the extra length of the master password:

- since there is only one master password to remember, it can be a "heavy" password

nealmcb

@ThomasPornin md5 "robust" even vs primage attacks - wow. I heard a talk from Lenstra once where I got the idea that folks were quite nervous about hashes and how little they knew.

Thomas Pornin

- the "stealth password" is just some extra password characters which you do not need to remember, and they add to the password entropy

nealmcb

the stealth password should also deepen it against rainbow attacks

Thomas Pornin

@nealmcb There is an attack against HMAC/MD4, which is quite beyond collisions, so you could be nervous about using MD5 at all.

@nealmcb Rainbow tables are just precomputed tables; to defeat precomputed tables, use a salt (which makes precomputing meaningless) or a long enough password (which implies too much work for precomputations)

The "stealth password" makes the password longer.

@nealmcb We do not know how to make robust hash functions. The SHA-3 competition is showing that we do know how to make hash functions that the colleagues cannot break.

nealmcb

@ThomasPornin well for rainbow tables those are the same thing - salt just lengthens the password, right?

Thomas Pornin

14:06

@nealmcb The salt is meant to be a public data (otherwise we would call it a key).

Its purpose is to prevent the attacker from reusing his guesswork from one attacked password to another.

The "stealth password" is secret (the author insists on it) so you can consider it as being the second half of the "true password"

In practice, if you run into issues with SuperGenPass, it will be because of Javascript integration (a nasty script on the page able to snoop the master password, for instance)

nealmcb

Sounds like Mike the "cryptography researcher" there should study the algorithm a bit more and reconsider his "utmost certainty" :/

Great - sounds like I did understand the major issues. Now it is a matter of comparing the google chrome implementations - 3 of them - which address the javascript issues and assessing whether they can even make it ok to store the master password for the chrome session

Scott Pack

I get very nervous anytime I hear phrases like "utmost certainty" or "supremely confident".

nealmcb

@ThomasPornin Any thoughts on bitcoin? As far as I can see the crypto is cool, the anonymity has some issues but is handy, and the politics and monetary/investment issues are quite something....

and as always, who knows if it will fly....

Thomas Pornin

14:21

@nealmcb Electronic cash systems are notoriously difficult

in particular defining what you want with enough precision

I have not looked at the internals of Bitcoin and I would not make any statement on it without a thorough investigation.

Iszi

14:34

Proof you're addicted to SE. You initially think any Tweet with a "?" at the end is something on SE.

Trying to think of a way that would get this question answered for me, but still generally acceptable as an SE question: "How can I easily determine what IT security-relevant regulations the company I'm servicing should be subject to?"

Scott Pack

Well, the easy answer is to ask the client and assume they know.

Iszi

@ScottPack Client is small enough and ignorant enough that I don't trust them to know.

Scott Pack

It's been my experience that clients can't reasonably be expected to know, in the general case. Which is rather unfortunate

Iszi

So, should I try to wordsmith the question or pretty much just post it as that?

Scott Pack

14:50

For instance, were I consulting I might not want to deal with GLBA. So I I wouldn't want to be an expert in GLBA just so I could know to whether or not it would apply.

Iszi

@ScottPack GLBA = Gay/Lesbian/Bisexual/Androgynous?

Oooh... Wiki says...

Gramm–Leach–Bliley Act

The Gramm–Leach–Bliley Act (GLB), also known as the Financial Services Modernization Act of 1999, () is an act of the 106th United States Congress (1999–2001). It was signed into law by President Bill Clinton and it repealed part of the Glass–Steagall Act of 1933, opening up the market among banking companies, securities companies and insurance companies. The Glass–Steagall Act prohibited any one institution from acting as any combination of an investment bank, a commercial bank, and an insurance company. The Gramm–Leach–Bliley Act allowed commercial banks, investment banks, securities fi...

Scott Pack

That would be GLBT (transgender)

Just beat me

Iszi

I'm a bit familiar with SOX, but never heard of that.

Welcome, @drachenstern

I do wonder though, how vulnerable would consultant be for non-compliance when the execs don't even know or inform him of their compliance requirements?

Scott Pack

Welcome to the Wide Wonderful World of Contract Law

Iszi

@ScottPack Oh, this presumes existence of an actual contract.

Scott Pack

14:55

DOH!

Iszi

Yeah, this one's gonna be very ad-hoc it seems.

It's a very small org, with a very small IT budget. So essentially, whoever handles their IT work is just a "poor man's Geek Squad".

Scott Pack

I can understand that.

It's just scary when dealing with potential compliances when you're a) not an expert in each one, and b) you don't have strong enough indemnification clauses.

Iszi

So, yeah... what do you think of the question as SE questions go?

Scott Pack

It's a toss-up. I'm not sure there is a generalized answer, given how broad the compliance aspect of our job is.

For each one there might be hard lines where you can say "This definitely does not apply." and the size of grey zones of 'maybe...' will vary greatly depending on the specific organization.

drachenstern

15:20

@Iszi thanks.

Iszi

Would really be nice if there was some "if you are/do/work with x, then you need to comply with y" flowchart.

Scott Pack

I totally agree.

2 hours later…

Ninefingers

17:15

@ThomasPornin quick question seeing as you've been discussing salts - is there any harm in generating salts based on publicly known userdata (e.g. a hash of their email address + firstname+lastname+date of birth) or some such computation? Said data would be known and easily generated (since the algorithm wouldn't be a secret), it just wouldn't be explicitly stored. Or is that considered bad practice?

Iszi

17:44

@ScottPack Well, I suppose I'll just have to give it a shot.

Worst case would be it gets down-voted or closed into oblivion and I'll just delete it.

0

Q: How can one easily determine what IT Security related regulations apply?

Joe Tech gets a job managing Acme Startup's IT services. Acme Startup handles information of X, Y, and Z data types, and offers services A, B, and C. Joe Tech is aware that some of these data types and/or services may fall under government regulations, but is not sure which. He also knows that...

Iszi

18:06

I love this. On the same page, Microsoft is both telling you "Your company doesn't want you to do this." and "Here's how to get around that."!

office.microsoft.com/client/…

nealmcb

18:31

@Ninefingers The risk with predictable salts is that someone will simply construct rainbow tables or the like for the users/salts that they care about. So it helps a bit, but not nearly as much as a random salt.

AviD

18:41

heeeyyy guys.... been long time...

I see I've missed a lot... :)

had to jump on to give this to @Ninefingers...

Iszi

@AviD Welcome back.

AviD

22

Q: Non-random salt for password hashes

UPDATE: I recently learned from this question that in the entire discussion below, I (and I am sure others did too) was a bit confused: What I keep calling a rainbow table, is in fact called a hash table. Rainbow tables are more complex creatures, and are actually a variant of Hellman Hash Chains...

security authentication hash cryptography password-protection

@Iszi ta

btw @Iszi wrt your q "how to know what regulations...", there were a couple similar q's awhile back, more per the answers there might be helpful.

Scott Pack

@AviD!

AviD

2

Q: What security requirements are a defacto standard in the Financial Industry?

What technologies, processes, or laws that relate to InfoSec apply specifically to the Financial industry? If you're familliar with the Financial Industry, can you share details? For example: What are specifics on common controls What technology (or widely deployed product) satisfies a partic...

@ScottPack @ScottPack!

6

Q: What is an appropriate auditing standard for a law firm?

I'm an IT Admin at a law firm. We handle sensitive customer data and some health records. I'd really like to have an outside consultant assess our data security practices, but I'm not sure what to ask for. I realize that the real answer is "It depends based on which regulatory framework you fall...

compliance audit business-risk

Iszi

@AviD Add them to comments on my thread?

AviD

18:44

@Iszi sure...

so I see I'm gone for a few days, and the site practically explodes??

Scott Pack

@AviD It's funny. My friend's 4 year old says the same thing right before running up for a hug.

AviD

dozens of new q's I've yet to see, and no idea how many new answers.

Scott Pack

@AviD How do you mean?

AviD

wish I had time to go thru them all now.. will take me days to catch up!

Scott Pack

We're down on visits. We were up to 836

Weekends will do that, though.

AviD

18:46

@ScottPack lol, yes I've been told before that I'm like a 4 year old....

Scott Pack

Is it immediately followed by the culturally appropriate version of "yes dear" ?

AviD

@ScottPack hehe

@ScottPack but still nice - 3 xlnts, 2 okays. basically we've got a solid site, just need more traffic.

Scott Pack

Yuppers

AviD

@ScottPack hmm... there was a dip in visits, roughly coincides with my absence... curious how much of that traffic is from me??

Scott Pack

It's all your twattering

AviD

18:53

@ScottPack nah, I dont twoot

still, there is a rough upward trend, though only slightly. We do need to hit that critical point to make it curve more....

Scott Pack

It seems like we've gotten a lot of crypto related questions lately.

AviD

@ScottPack that explains why I'm in 3rd place ;)

Ninefingers

@AviD thanks, that's excellent. I've always felt I understood the purpose of salt and how rainbow tables work, but not the intricate details - that answer is the missing piece.

AviD

and @Rors in 2nd...

@Ninefingers yeah, that kind of made me remember that a secure crypto-system is not just the crypto- bits and -analysis, but also (probably more) the real-world implementation, environment, etc

AviD

19:17

btw, of interest here:

user image

Rory Alsop

20:07

@AviD @AviD

etc etc

@AviD Whut - 2nd again? But I was only 1st for such a short time...:-(

AviD

heya @RoryAlsop!

hehe - blame the rash of crypto questions

neither of us stand a chance...

so whats this about you disbanding the elements??

sorry to hear about that bro

Rory Alsop

well, yes - considering how much business we were doing it is very sad. The money was excellent

AviD

is it all because of the David....? ;)

See, you should have insisted on Rorifying him! :D

Rory Alsop

just wouldn't change his name...:-)

AviD

was actually talking about you today

with ian amit

Rory Alsop

20:09

So anyway - moving on, so I now have a company of me to do consulting with, and I'm applying for perm roles with a few folks

oh is he out your way?

have pinged him a couple of things re PTES, but had challenges with connectivity/logistics

seems like a good bloke who is quite practical about security

@AviD wow, Thomas really shot ahead:-) He'll be first to 10k

AviD

@RoryAlsop yeah I agree. I do a lot of (subcontracting) work for his company...

you came up re PETS

make that PTES... actually you should make it PETS, a lot easier on the tongue :)

I suggested they expand and have you open their UK office ;)

Rory Alsop

I think PTES has the potential to be really useful, but is currently at the stage of too many rock stars. So loads of good ideas, and folks like Ian trying to pull the useful bits into one doc

@AviD cool

AviD

@Ams hiya

Rory Alsop

@Ams hi

AviD

@RoryAlsop but dont get your hopes up ;)

Rory Alsop

20:15

hehe - actually one very interesting role I am interested in has a challenging interview - I need to present to their board on the benefits of their product line.

AviD

I was talking to some folks at Sage a few months back, but fell thru mainly because of the location issue... They're close(ish) to you, arent they?

Rory Alsop

Nice tactic:-)

AviD

omigosh, that sounds.... vaguely evil

Rory Alsop

@AviD Think it will be kind of fun though, if a tad stressful

AviD

@RoryAlsop yeah, sounds like it...

Rory Alsop

20:18

How are you anyway - you been away on a job for a bit? Or just letting me have my shot in first place:-)

AviD

@RoryAlsop uhhh, yeah.... thats what it was! ;)

actually I've been swamped with a couple of parallel projects... didnt have time to stay up to date.

happens, comes in waves....

and now, reading >35 q's all at once seems daunting

@Ams why delete your profile???

@Ams the only acceptable one is trying to kick the addiction ;)

Rory Alsop

@Ams They should remain as anonymous user

@Ams SE in general, or just us here at Security.SE?

AviD

@Ams so why not just leave it as is, and just not come back? you might change your mind later....

Rory Alsop

you'll be missed - lots of good input from you

AviD

@RoryAlsop not completely anonymous, still would have his name (i think)

Rory Alsop

20:22

@AviD pretty certain it pops them into the anonymous pot under (?)

AviD

@Ams is it cuz of all the crypto questions? we could block some of the crypto questions.

Rory Alsop

but I'll go and check now

you can block a particular tag in your preferences

eg on gaming.se I block minecraft and a couple of others

as there are a million questions on them that I have no interest in

AviD

@Ams yeah, I was afraid of that happening.

its getting hard to keep it strictly ontopic of IT security - a lot of those lines are fuzzy.

Rory Alsop

(imagine how much chaos the merge between music performance and guitars is going to cause) - think I'll just pop most things in my ignore tags pref:-)

yeah - in looking at other betas there always seems to be a spread. I think some of it is good, but I know I'm as guilty as anyone else of adding to the management side, as although I was a good pen tester (and still can, only I'm not as good as the new kids on the block) I find myself getting more of a pointy haired boss every year :-(

AviD

there was also some discussion on meta about that.

several proposals were merged into this one.

Though @Ams at the beginning I thought like you - different site for each segment / profession, in short order I changed my mind.

Rory Alsop

20:34

@Ams hoping I still have time to enjoy someone elses:-) My core mid life crisis is my rock band - keeps me young!

@AviD loads of crossover

AviD

personally I like the management questions, often it reflects realworld security tradeoffs better

nealmcb

@ams Have you considered just blocking [cryptography] and tags you don't want?

AviD

though we have been quite limited on the app/pentest/technical side of q's....

nealmcb

the latest question about regulations seems off topic though

AviD

@Ams so? dont read em if you dont want em, but they there when you need em.

Rory Alsop

20:36

@nealmcb But they are real world questions security & risk folks get every day

I know maybe half my security work is down to DPA, PCI or similar

nealmcb

I think a site that broadly covers the security "mindset" is a good thing, and what we've pretty much got now

and could use a 'legal' site to deal with the stuff lawyers argue about

Rory Alsop

@nealmcb there is an intellectual property proposal I'm following

not sure how narrow it is though - will it ever qualify

nealmcb

@RoryAlsop me too

since IANAL but my daddy was and I have lots of opinions :)

AviD

@nealmcb I agree

Rory Alsop

Ahhh - I am definitely not a lawyer, but had to negotiate many many contracts across multiple countries these past few years, so I have learned a good chunk on what I can do before I have to get legal involved:-)

nealmcb

21:27

@Ams Thanks for your many contributions to date, and for dropping by to fill us in. You're welcome anytime you muster the time & interest. Do you want to be pinged about any particular topics? Bon voyage....

« first day (158 days earlier) ← previous day next day → last day (5020 days later) »

Transcript for

May '1123

The DMZ

A serious place where infosec is discussed PS we don't do hard...

404-errors moderate-anarchism pretending-to-work staring-into-the-abyss

join this room
about this room

00:00

06:00

12:00

18:00

all times are UTC

site design / logo © 2025 Stack Exchange Inc; legal

mobile