The DMZ

nealmcb

01:34

Sony Hit Yet Again; Consumer Passwords Exposed | Threat Level | Wired.com - 50 k out of > 1 M passwords gotten in this one....

"Sony stored over 1,000,000 passwords of its customers in plaintext"

Scott Pack

02:24

Well sure. How else do you perform a password recovery?

nealmcb

03:48

Wow - seems like some sort of record - a question with zero upvotes and 5 answers all with zero upvotes (until I just voted on one of them)....

All at least 2 hours old, and non-bogus

For some reason the quoted text in this answer is invisible unless I move my mouse over it:

0

A: Cracking a linear congruential generator

Yes. There are extremely efficient ways to break a linear congruential generator. A linear congruential generator is defined by sn+1 = a sn + b mod m, where m is the modulus. In its simplest form, the generator just outputs sn as the nth pseudorandom number. If m is known to the attacker and ...

I'm using chrome on linux. Is that true for others?

OOOH - its a "spoiler" feature! Sweet. >! security.stackexchange.com/editing-help

Iszi

04:37

@nealmcb They might be using the spoiler tag? (Oh, you found it.)

@nealmcb This is getting old. At least it wasn't a Playstation or other gaming-related network this time.

@nealmcb Glad I didn't see this one at work. That sounds like such a euphemism that I definitely wouldn't have bothered with it there, and probably would have forgotten about it by the time I got home.

nealmcb

@Iszi It's all about how long your secrets are....

Iszi

@nealmcb So, these guys are essentially the "notary public" of the PGP world?

nealmcb

@Iszi Well, anyone can be a signer in PGP, but "notary"? Nah....

Iszi

@nealmcb I mean, in the sense that these particular people have gone a little out of their way to provide key signing services to the public. Same as a "notary public" is just someone who's gone through the small-ish trouble of obtaining and maintaining a Notary license so that they can offer document signing services to the public.

Okay, I'm thinking this guy seems to just not have a clue. Lots of very vague questions lately.

0

Q: Attacks against windows kiosk software

I am interested in potential/actual attacks against kiosk software. I am not talking about physical access, or specifically designed kiosk operating systems or shells, bur rather software that runs over windows and attempts to prevent access. All too often this software runs on top of explorer a...

Is this one really fit for SE?

1

Q: An analysis on the Sony attacks so far?

Does anyone have any links to a comprehensive analysis on the multiple sony attacks so far? First of all there was the PSN hack, which was compromised due to a vulnerable version of Apache and no Firewall and using a developer console. Then Sony Greece fell due to an SQL Injection attack. Then...

attacks intrusion

nealmcb

04:53

@Iszi Requirements for notaries vary widely, but they always do more than put their name on a web page.

Notary public

A notary public (or notary or public notary) in the common law world is a public officer constituted by law to serve the public in non-contentious matters usually concerned with estates, deeds, powers-of-attorney, and foreign and international business. A notary's main functions are to administer oaths and affirmations, take affidavits and statutory declarations, witness and authenticate the execution of certain classes of documents, take acknowledgments of deeds and other conveyances, protest notes and bills of exchange, provide notice of foreign drafts, prepare marine or ship's protests...

Iszi

@nealmcb True it's not a directly comparable level of effort, but (at least around here) the requirements for a notary are relatively simple.

As I understand it, they just need to take a class, pass a test, and pay annual fees.

And of course, maintain proper records of whatever they sign, I'm sure.

Is this one crossing the line, in terms of "exploit" code and potentially-malicious website references?

0

Q: Found some malicious Javascript - how did it get there?

Found some malicious javascript on a Joomla site which we noticed has returned after being deleted a week ago. Also noticed that www.cssstickyfooter.com is infected by the same code. If you're curious, here it is in whole below. function net_match ( $network , $ip ) { $ip_arr = explode (...

attack-prevention

nealmcb

@Iszi The PGP web of trust would be in much different shape if signers had to do any of those things.

Iszi

Different, as in "better"?

nealmcb

@Iszi I fear that the volume and quality level of questions is getting to a tipping point where it isn't sufficiently fun for someone with clue to try to whip every one into shape, as we have mostly done to date. Sigh.

@Iszi Well, requiring payment of money would make it worse for sure, at least in the eyes of many....

Iszi

@nealmcb Even a relatively nominal fee, say $50/year?

I think there's probably a number of people that could do with a class and test.

nealmcb

05:30

Why are good people still answering these ambiguous badly worded questions, from questioners who should know better by now? Rather than commenting or closing?

@Iszi Yup. But "nominal" costs in the US would close out much of the developing world entirely.

Iszi

@nealmcb Not sure which one particularly you're referring to, but I have seen a few. It's a pity.

@nealmcb True, I suppose.

But, if there is to be a real vetting process in place, there does need to be some way to cover the expense of maintaining it.

nealmcb

@Iszi We could use a system that would make it clearer and easier and potentially profitable to do pgp sigs that had some standards behind them for vetting, attribute claims etc. But it should be optional.

After all, the CAs have demonstrated the also-unfortunate other end of the spectrum

Iszi

I'm not even looking to have the system make a profit. Should be a .org or something.

Just break even, is all.

In related news, you might want to check out my latest PGP question.

0

Q: Does my PGP key really need to match the e-mail address for which I'll be using it?

In considering whether or not I want to join the big web o' trust and put my keys on a key server, I got to thinking about how it would affect my e-mail address' exposure. I generally try to keep my e-mail addresses from being too public, so as to avoid unwanted spam. Along this train of though...

pgp

Scott Pack

11:30

@Iszi I don't trust my memory of this enough to answer, but from a technical standpoint having your sending address in your key is helpful, in that email clients use that information to determine which key from your keyring to use.

C. Ross

12:55

Ask Slashdot: Verifying Security of a Hosted Site?

Iszi

13:56

@ScottPack That's definitely something I'd considered, but is it the only benefit?

Scott Pack

@Iszi I can't say, but I never really thought about it either.

In memory I've never received enough spam to really care about my address getting out.

Iszi

@ScottPack I could say the same, but instead of "to really care" I feel that it's "because I care".

@nealmcb Got another one: Why are good, reputable, long-time users answering exact duplicates instead of voting to close?

@CRoss What's the deal with that?

C. Ross

14:13

I just thought it was an interesting question

and I double posted, sorry

Iszi

14:40

How the heck can you have a gold badge, and <200 rep? That shouldn't be allowed...

Mark Hurd, Bull Creek, Australia

136 1 1 6

windows-7 windows windows-explorer firefox gmail google dns

Ormis

15:04

i don't get the consecutive days badges... it should be consecutive work days :-)

i would totally have that if that were the case

Iszi

@Ormis Haha... Totally in agreement with that one.

Ormis

15:25

god, my mind is shot....

working for multiple sec departments in my company at the same time means that you're forced to do multiple projects... from multiple perspectives each... tireing

Iszi

@Ormis Wow. How'd you end up in that pickle?

Ormis

contractor.... i signed my life away.... it was my own doing... why would i do this to myself

Jeff Ferland

@Ormis I work for a CPA firm... my life keeps getting signed away for me.

Ormis

today for me:

Me: "hay guys, is the all-hands meeting still at 10am?"

Boss: "No, it was canceled because the new code rolled out last night dropped all of our customers off line, conference call info in you e-mail, also wireless just dropped and we need someone from each of your teams to be in on it... OH and YEA, we also need you to finish that vulnerability report with recommendations and comments from a security engineering perspective."

Me: "did you breath at all during that?"

hey*

Iszi

Sounds like fun times.

Ormis

15:33

i wonder if they'll be mad if i just sleep....

Iszi

No department staff meeting for me today - boss is out.

Ormis

haha, that's always nice

rofl, "Great... now I'm a scapegoat of questionable gender." -Iszi

out of context that's hilarious

Iszi

Hehe. You're welcome.

Come to think... I can't remember why I was a scapegoat at that moment.

Jeff Ferland

@Ormis link to the context? I so want to know how that applies.

Ormis

haha, OH OH OH, but one good thing, i saw the midnight showing of X-Men First Class

May 27 at 17:41, by Iszi

Great... now I'm a scapegoat of questionable gender.

Iszi

15:37

@Ormis How was that?

Ormis

i didn't even read it, i just was amused by the comment and left it as that.... my assumption was that there was applicable context

Iszi

Gotta run for lunch now, but definitely want to know if the movie was as awesome as it should be.

The scapegoat context is readily available by following and reading the chat log. The "questionable gender" is a running in-joke.

Ormis

X-Men First Class?... i liked it, but there was definitely parts with shotty acting by good actors. But overall, it was good

It's something i recommend seeing. My friends and I tend to tear movies apart, but we had relatively few problems.... some camera shots were stupid, some dialog was a bit out of place, and we still are having issues with magneto's powers... but that's been going on for a while.

alright, so here's the problem.... if he naturally emits electromagnetic energy, then how is his body being controlled by his own powers.... also, if he's using magnetic forces to pick things up, what does he leverage those magnetic forces from?

if you watch the trailer you'll see him holding up a sub while standing on a plane..... HOW IS THE PLANE NOT DRAGGED INTO THE WATER?

unless the plane has the power to life both the mass of the plane and then sub.... which doesn't make sense either because the force needed would have effected the surface of the water below the plane much more......

ok, so i'm overthinking this... but it's what i do best.....

Jeff Ferland

15:53

I get the impression that Magneto can control a field around an object, and that field is not dependent on being in relation to him... so he's not supporting the sub from the plane, but rather the sub from the field influenced around the sub. How's that for on-topic?

Ormis

16:07

But, in that case, why was he drawn towards the gate when he was pulled away fro his parents as a child?

Jeff Ferland

@Ormis lack of effective control at a young age?

Ormis

16:27

but his body was physically being pulled towards the metal gate....

meh, i'm content in leaving it at he controls metal, the true way he does this may be unclear

but he's still col

cool*

you know who i don't think is a cool superhero? Capt. America

Jeff Ferland

@Ormis Commie! I feel the random need to look up his wikipedia article now... don't know the backstory at all

Captain (America|Crunch|Obvious)... what else am I missing?

Iszi

16:56

@Ormis Was he wearing a belt?

Any crypto wizards in here?

Ormis

17:16

was magneto wearing a belt? i dono, he was going into a concentration camp so i doubt it, but his hold body was suspended horizontally... so even then, it would have been awkward...

also, it's not that i'm doing like America, i just think captain america is lame. He's just a guy with some drugs that made him strong... and then put on this outrageous outfit and fought on America's side during wars.

*its not that I don't like America.....

Jeff Ferland

18:08

@Iszi I'm good with crypto, though I'm no Thomas Pornin

@Iszi What's up?

Iszi

18:21

Trying to figure out to what extent does a digital signature really protect non-repudiation/authenticity/integrity of a message.

Like, with normal messages I can modify any e-mail that's come to my Inbox. Can the same be done with a signed e-mail, and the signature still be valid? I've tried a bit with some e-mails I have here at work. It seems I can modify the Subject line with no problem, but the encryption software throws up a warning if I modify the body - is that a matter of software implementation, or is it the nature of digital signatures?

nealmcb

Bruce Schneier live on Science Friday talk show: sciencefriday.com/program/archives/201106032

just started

Iszi

@nealmcb Supposed to be a video or something there? I'm not seeing it.

nealmcb

@Iszi It's this cool broadband technology called "radio". You need a "receiver" and tune in if you're near a "transmitter"

Iszi

@nealmcb I "need to tu"? Do I look like a ballerina to you?

Wait... Don't answer that.

nealmcb

But the audio will be up at that page this evening

Jeff Ferland

18:41

@Iszi So, if you open your signed message as plaintext you'll see that only the body is signed. Otherwise, it would interfere with the email headers

nealmcb

It lasted perhaps 15 or 20 minutes - talking about cyber attacks and the challenges in defining and fighting cyber warfare.

Jeff Ferland

@Iszi Where to / from / etc. are all standardized by the email spec so one can't shove random things around them, you can do whatever you want to the body of the email. As far as as I'm aware, PGP, S/MIME, and every other system out there can only mess with the message body.

@Iszi So, that's a specification / software / nature problem all at once. Only the body can be signed without messing up the specification of email format.

Iszi

@nealmcb Wait... what's that? Is it sort of like Wi-Fi for your ears or something?

Anyone want to join me in vote-closing this one?

0

Q: How do security questions work?

Is it true that on some websites (e.g.: free webmail) there are "security questions" - if the user forgets about his password he could answer the security question, that he provided before, and then he could change his password. BUT: isn't this a security issue? What happens when the security que...

web-service

nealmcb

18:57

@Iszi No, but wow - that sounds like a great idea. Like, if you actually got close enough to another human, you could just directly send audio from the throat to the ear. There's gotta be some way to monetize that idea....

Iszi

@nealmcb Yeah, but how do you teach the end users about CSMA/CA?

nealmcb

@Iszi Aye - close/dup!

@Iszi Especially a problem when gateways are introduced, e.g. via cellular technology on a bus :/

Iszi

19:17

@JeffFerland I'm still not 100% sure I'm clear on the whole "private key protection" topic.

I think I get it, but only sort-of.

Jeff Ferland

@Iszi In one sentence: The file on your disk containing your key is encrypted by your passphrase.

If that simplifies it, I'll go re-word my answer. I probably went all rabit-hole with the use of passphrase vs. not

Iszi

What I'm having a hard time finding (maybe just not looking hard enough) is the part of the specification that requires encryption of the private key.

Jeff Ferland

19:33

@Iszi Nothing requires encryption of the key. You can use a blank passphrase, and thus have an unencrypted key

Iszi

@JeffFerland So, the private key .asc file is always encrypted, except when a blank passphrase is used.

Jeff Ferland

@Iszi yes

@Iszi Also, I just tested that with OpenPGP, but I'm not pasting my secret key ;)

Iszi

@JeffFerland Muahahaha....

Kinda reminds me of the time one guy tried to get my ATM PIN from me. Don't know if he was just out of his mind or what, since he didn't have my bank card, but that just plain wasn't happening.

Difference here of course being that I haven't (and never would) actually asked for your key.

Jeff Ferland

19:54

@Iszi I might generate a new one for you if I'm given a candy bar.

Iszi

And how would I test it? Import it and see if it's immediately usable?

Jeff Ferland

@Iszi sure

-----BEGIN PGP PRIVATE KEY BLOCK-----
Version: GnuPG v1.4.9 (GNU/Linux)

lQHhBE3pPSARBACX0W1K2I863rxdWHvGtFD7itYMnvA9+wmhLU1Xy0x21eT/TD7z
5dtQSn0RuqW0PjMDoYlz3E28HT8eTu/qa0cuvJ2BrpJEGHdLXfyIhYJWBEgGRLe6
qd6VmtzRW0J0LU1vChb1l3yMLFf6Dq3Q6ODt73hUGWZ/ZKpTW+70gipsrwCgqwKD
UW5fBRZUeNn9tNpy+QjqWcEEAI74BJRcXODNXDuEUOwAi2B74bQsWQhk6IvwJqxv
DpIdzaerdvuCg2T2zqyBslNNWVgky5MdiCJ/euvD89FM9CPXpkkIZZ6WEKtk4Lq/
uyeobfsidNAUFF+U79wCAUKd5RobDec0xRjpzPeSYrkUXzxmD1EOvAQANMjNAUjq
H9ITA/9H0VFpcv0A1RR6Ek/soZesaEB9RdE/suLrlyCaJbwXjYE3OXRkHpFmjbNQ

And the matching public

-----BEGIN PGP PUBLIC KEY BLOCK-----
Version: GnuPG v1.4.9 (GNU/Linux)

mQGiBE3pPSARBACX0W1K2I863rxdWHvGtFD7itYMnvA9+wmhLU1Xy0x21eT/TD7z
5dtQSn0RuqW0PjMDoYlz3E28HT8eTu/qa0cuvJ2BrpJEGHdLXfyIhYJWBEgGRLe6
qd6VmtzRW0J0LU1vChb1l3yMLFf6Dq3Q6ODt73hUGWZ/ZKpTW+70gipsrwCgqwKD
UW5fBRZUeNn9tNpy+QjqWcEEAI74BJRcXODNXDuEUOwAi2B74bQsWQhk6IvwJqxv
DpIdzaerdvuCg2T2zqyBslNNWVgky5MdiCJ/euvD89FM9CPXpkkIZZ6WEKtk4Lq/
uyeobfsidNAUFF+U79wCAUKd5RobDec0xRjpzPeSYrkUXzxmD1EOvAQANMjNAUjq
H9ITA/9H0VFpcv0A1RR6Ek/soZesaEB9RdE/suLrlyCaJbwXjYE3OXRkHpFmjbNQ

passphrase is chat.stackexchange.com

Time to make the quick commute home

Iszi

@JeffFerland Time to wish mine was quick.

nealmcb

20:19

@JeffFerland dkim can be used to sign mail headers

@JeffFerland Oh, gross! It's so dirty to share private keys :)

2

Jeff Ferland

20:40

@nealmcb Didn't you know that more than 70% of users will give up their passwords for candy bars? He implied I would get one! news.bbc.co.uk/2/hi/technology/3639679.stm

nealmcb

@JeffFerland :) But this is new: 1) you did it in public, like on a talk show 2) you made the offer. Maybe we'll see celebrities with "nothing to hide" doing this on talk shows next....

Iszi

@JeffFerland I implied nothing. No agreement was made whatsoever.

Jeff Ferland

Maybe I just wanted candy! I always wondered about that study... did users give up real, useful passwords?

Scott Pack

@JeffFerland That is an open question :)

Jeff Ferland

For a candy bar, I'd give anybody a password. It wouldn't work on any of my accounts.

nealmcb

20:55

And on the same talk show, Sony should offer 100 M people their choice of candybars!

1

Q: Is it safer to host your own email server rather than use a 3rd party server (such as Gmail or Yahoo, etc.)?

Defining 'safe' as prevention of personal information from being given to 3rd parties.

webserver email

Subjective?

Iszi

22:32

@nealmcb It... depends. Generally, yes. If he could narrow the scope (is this for a home user, or for a large corp) then it would be a much better question.

Iszi

22:45

@nealmcb - I'm not sure what you're getting at with the GPG-AGENT thing. Does it not require a password at all? Or, does it only require a password at the start of the session, or during service configuration?

Scott Pack

22:56

@Iszi With the agent you unlock your key with your passphrase, then your unencrypted key gets stored in memory and made accessible through the agent.

Iszi

@ScottPack Unlock per-session, or permanently?

Scott Pack

Depends on the agent, but normally one assumes until the process terminates.

Iszi

So, if someone were to steal your hard drive, the key would remain protected then.

Scott Pack

Looks like gpg-agent has a timeout that defaults to 5 minutes.

Right. Your key on disk is always kept encrypted, it only gets decrypted into memory.

Iszi

The only risk then becomes whether your key ever got put into the swap file.

Scott Pack

23:01

I would hope that those memory segments would have the no-swap bit set.

Iszi

@ScottPack That's a matter of software implementation.

Scott Pack

So if I'm reading the manpage right, gpg-agent will only keep your decrypted key cached for 5 minutes. After that point you would have to unlock it agian.

Iszi

Not necessarily (just) the specification.

Scott Pack

Granted.

If there is a spec for key storing agents.

Iszi

Of course, it really does all come down to how well you trust the software anyway. For all you know, it could just be writing your cleartext key to disk when it's decrypted and then transmitting it out to Dubai or somewhere.

Scott Pack

23:04

To be fair, that would be true of any software. Even your email application GPG/PGP plugin has to decrypt your key in order to do the various and sundry whatsits.

The gpg-agent application that @nealmcb and I are talking about is officially distributed as part of the GnuPG suite.

Iszi

@ScottPack Right... that's really my point.

Scott Pack

Speaking of all of this PGP nonsense.

Is there a functional way to use it with Outlook 2010 yet?

Iszi

I don't know that there isn't...

Scott Pack

I'm not sure I understand what you mean.

Rory Alsop

@ScottPack Not one that works well. The Lotus notes plugin is pretty good, the gpg4win is good as a standalone, but outlook just seems to break everything

p.s Good evening

Scott Pack

23:11

@RoryAlsop I started seeing that with 2007, so I'm not entirely surprised. When we made the jump to Exchange I switched from Thunderbird, and as such made the subsequent switch to S/MIME :)

Also. Hi.

Rory Alsop

I just tend to use gpg4win with windows privacy tray and don't bother to try and automate the process

Scott Pack

:O

Rory Alsop

Just got home from an excellent day in London - looks like I now have 3 job offers...all of which sound great. Need to start making decisions...

yay

Scott Pack

Congrats!

Rory Alsop

decisions like - do I keep consulting or go permy

:-)

Scott Pack

23:12

Are they all perm?

Rory Alsop

yep and for a variety of orgs but all similar role types - senior security, looking after business development, team growth etc

Scott Pack

Local?

Rory Alsop

all except one - which does have a higher salary, but as to whether it would make up for the move...I dunno

Scott Pack

Always seems to work that way doesn't it?

Rory Alsop

fraid so - but the others are Edinburgh based, and although involving a fair amount of EMEA responsibility, the core focus is on central Scotland, so would be able to spend some valuable time with the family

Scott Pack

23:17

EMEA?

Rory Alsop

Europe Middle East and Asia

Scott Pack

Oh, so fair amount of travel, but still based at home. Excellent.

Here, nursing is in such high demand that anyone with any experience can reasonably expect their pick of jobs no matter where they go. Are you guys in the same boat?

Rory Alsop

Nursing is going through a bit of an issue - UK government has had budgets slashed, and NHS (National Health Service) as the biggest employer in the UK is suffering

Security, however, is in a great place

demand is high at all levels

Iszi

@RoryAlsop Looks like development on WinPT is discontinued. Do you know of anything else comparable in form and function?

Rory Alsop

Hmmm - I don't actually, but I will ask around. Admittedly, for personal and educational use, pgp desktop is still free, and the only downside is that the key block will say something like personal/demo version

Scott Pack

23:21

@RoryAlsop Do you see that as a fad, or just an indication that the field is getting more mainstream acceptance?

@RoryAlsop Unless you cough edit the text file and remove it?

Rory Alsop

@ScottPack LOL

@ScottPack Definitely getting more acceptance at senior board level, regulators, shareholders and investors

folks are finally realising it may save them money and is a good thing

Scott Pack

@Iszi In my "research" I tended to see gpg4win recommended quite frequently.

Rory Alsop

@ScottPack It does work really well, and is a fully compatible drop in for pgp in all instances I have seen

Scott Pack

@RoryAlsop That's good to hear. All the trade rags in the US I see talk about how crucial security is at all levels/phases/whatevers, but I hear from a number of people about how their orgs say the same things and then never provide funding or support.

@RoryAlsop That was my understanding as well. As a recent and accidental Windows user, I just always smiled, nodded, and went back to /usr/bin/gpg

Rory Alsop

@ScottPack It varies across industries, for example:

Banking - very well embedded, however bare minimum to meet regulatory reqs is all you get until a major hack, at which point there is overbudget for 6 months

Insurance - getting there.

Pharmaceuticals - security around protecting IP is the best there is:-)

Scott Pack

23:28

And then there's education and small business :)

Rory Alsop

Law firms - beginning to understand they should do more to protect client data (you'd think they would have got it first)

Small Business - I do a fair bit here helping them figure out what they can do that is effective with a budget of x

ie what are the 3 things they can do this month that will make a difference

Education......

tricky

never any budget

and I don't think that will change

It requires sponsorship by a company (eg along with a research grant, a security grant to protect it)

Scott Pack

Or a sufficiently large black eye.

Although, some of the legislation that's coming out around these parts, is almost forcing the issue.

Rory Alsop

@ScottPack I have seen universities suffer from attacks, but generally shrug it off, as there is a general culture that openness is good, and as ever there is no budget, due to the powers that be saying "well, what is there of value to protect"

I do see decent security around financial and HR databases, but that is about it

Scott Pack

There was a sweet spot a few years ago where a breach was cause for alarm and attention, now (with notification laws the way they are) they happen so frequently that it would have to be really bad to make someone stand out.

So, yeah, I can agree with some amount of shrugging off. We are, however, getting more stringent legislation that I think is pushing them to, at least, attempt compliance.

Rory Alsop

excellent

Scott Pack

23:43

Oh cool, just read an article that 10 of our students were awarded Fulbright scholarships. Unrelated to our discussion, but nice to see.

Rory Alsop

@ScottPack Very cool (sorry - had to go and google that, which took a wee while)

Scott Pack

Heh, no worries.

Oy. It's the little one's bedtime. I should probably go do something fatherly like read a story or some such.

Rory Alsop

And I need to head to bed I reckon meself - catch you later

have a good weekend

Transcript for