The DMZ

Jeff Ferland

02:36

Iszi: That is a separate attack from the "Hole 196" issue.

Having the PSK and observing the initial key exchange would allow them to decrypt everything without associating or performing a MITM attack.

That is separate from Hole 196, and that only applies to a PSK instance, not 802.1x instances.

Iszi

03:34

What's the point of me seeing my own suggested edits in the queue, if I can't approve them?

@JeffFerland I'm not sure I follow. The article you linked is quite clear about addressing Hole 196, and that it does not give access to the PTKs which would be required to "decrypt everything".

airtightnetworks.com/WPA2-Hole196

(Just to make sure we're on the same page.)

Jeff Ferland

04:16

@Iszi That is correct. I'm discussing two distinct compromises.

Iszi

04:32

@JeffFerland Is there a paper or something that covers the other? I'm not familiar with the vulnerability. Though it makes sense in theory, I haven't seen anything particularly calling it out yet.

Iszi

05:19

Looks like we've got a spammer on our hands... Any diamonds around?

0

A: How can I prevent someone from accessing a Windows XP system via boot disk?

please help attacking my testing site: dc-inc.info thanks

And here.

0

Q: Please help find vulnerability of my testing site: dc-inc.info

Please help find vulnerability of my testing site: dc-inc.info this is for testing purposes only thanks a lot

mod-security

Iszi

05:39

@AviD to the rescue! Thanks! Now, can you delete the tweet?

Please help find vulnerability of my testing site: dc-inc.info http://bit.ly/iQYaGr #modsecurity

Tweeted by StackSecurity on June 9, 2011 at 5:25 AM

Also, feel free to join the thread I made about this on Meta.

2

Q: How did this get tweeted?

Please help find vulnerability of my testing site: dc-inc.info Screenshot around time of tweet: I thought the Twitter bots were only supposed to tweet "interesting" questions. This one has a down-vote, (probably worth noting the down-vote happened after the tweet) two close-votes, very low u...

bug spam-prevention twitter-feeds

AviD

@Iszi yeeehaaa! flagging works!

but um... no idea about the tweet.

I'm running out now - kids on vacay, takin em to the pool - but later I'll try to ping the SEI guys (@Robert, @Rebecca, @Dori....), I'm sure they have recourse. Unless @RoryAlsop gets to that first...

Iszi

05:56

@AviD Hehe... he's gonna drop the kids off at the pool.

@AviD I just hope they fix the Twitter thing. I've seen too much junk seemingly tweeted just because it's the first question in some hours.

AviD

@Iszi umm, click on a different tab, next time you come to /questions it stays on the same tab? Or am you meaning something else?

@Iszi heh, I keep forgetting thats a euphamism....

Iszi

@AviD I mean, every time I start a new session on xyz.stackexchange.com I want it to be at xyz.stackexchange.com/questions

I don't leave tabs open much, except for this room and Twitter.

I wish there was a way to flag a tweet, for the Twitter mods (if there are such things). Then again, I'd hate to flag one from an otherwise friendly account.

AviD

@Iszi hit this:

security.stackexchange.com/questions?sort=newest

then hit this: security.stackexchange.com/questions

/questions?sort=newest -> /questions (keeps the sort as default)

Iszi

Nope, didn't work.

security.stackexchange.com still defaults to "active".

I think the functionality I'm looking for just doesn't exist. And, knowing how things go around here, probably won't.

Scott Pack

11:37

@Iszi You could ask for it on meta, get a bajillion condescending responses that involve unicorns and you going back to your cave.

Iszi

13:06

@ScottPack Hmmm... wonder why I haven't done that yet?

Scott Pack

13:36

It's a wonder, eh?

nealmcb

14:06

@JeffFerland good stuff in your 2-factor answer - thanks! But I'm puzzled by your intro - what "reply" are you referring to?

Ormis

check out theinquirer.net/inquirer/news/2077521/chrome-adds-raft-features

new anti-malware features in chrome.....

AviD

@Iszi ah, didnt realize, you're talking about the homepage. I was referring to /questions.

nealmcb

@AviD Oohhh - I hadn't noticed that on e.g. the active questions page, the time-delta link goes to a ?lastactivity URL which takes you to just the right place. Handy - thanks!

AviD

@nealmcb yeah, its cute how theres a dozen hidden things all over the place, right? ;)

does anyone really think this is ontopic?

5

Q: Gmail account hack prevention and recovery

I am doing a research on how to prevent my gmail account from being hacked and what are the options of claiming it back. The associated phone number and recovery email can be changed, in fact I expect the attacker to change them immediately so there is no real value in them. Is there a way how ...

attack-prevention incident-response

not a bad question per se, I just dont think its the right place for it here.

nealmcb

14:31

@AviD Can you explain where you'd draw the line, and why it would be helpful? I think that this site does a nice job of collecting experts with a security mindset, which other sites don't. That mindset is good for that question.

AviD

@nealmcb oh, that part I definitely agree. But (a) it's not really IT security, which was an important element of defining the site scope. Agreed, that is often a gray line, but this one seems pretty clear on the other side.

and (b) it just feels... I dunno, too localized (i.e. to gmail), though thats not really what I mean. It just feels... more of a "how to" use a web app, i.e. it should fit better on webapps.se.

now, if it was more of a "in principle" question, or "gmail as example", why then I'd probably be on board. Because that would deal with both sides - since there are orgs building it (i.e. from the other side), it would make sense to deal with here.

@nealmcb is that making any sense?

Jeff Ferland

@nealmcb ehh, I have a habit of not proofreading on forums.

AviD

hi @JeffFerland

Jeff Ferland

@AviD good $time_of_day to you

AviD

heh, its afternoon here

Jeff Ferland

14:46

Re: RSA SecureID compromise: I bet somebody at RSA was hedging the idea that individual tokens couldn't be mapped to individual users. I bet what happened is that somebody used the full list of token ids to dictionary-force (yes, I'm blending those terms) login credentials from a captured packet.

nealmcb

@Iszi Great meta-message on tweeting standards!!

@AviD Well, some organizations use gmail for IT, and certainly use google accounts. But I'm moving towards dropping the "IT" aspect, unless it hurts the site overall to drop it, which was the goal of my question to you. As for "too localized", I'd love to see some questions like that for each major openid provider et al.

That particular question can be edited to make it better, but the intent seems useful

AviD

@nealmcb the second is a good point, but at some point it will become too localized.

The idea behind insisting on the IT, that I still agree with, and the slew of the last few days kinda proves it out, is that without the IT, it will degenerate into "what antivirus should I use at home", and "my mother got this weird email, is it virus", etc....

Iszi

@nealmcb Thanks.

AviD

@nealmcb perhaps if it didnt focus specifically on particular gmail features, but treating it as an example of a generic case...

nealmcb

@AviD If you mean that someone someday will ask "hack prevention for owij2o3ir2 service" used by them and their brother, well yeah - and we can close that one.

Iszi

14:54

Is this one setting off anyone else's black-hat radar?

nealmcb

what's wrong with questions about home solutions for antivirus? Unless they have some highly localized requirements....

AviD

@nealmcb oh, I agreed on that point. But if we accept those types of q's, we'd need to be clear and upfront about what and why, and what not and why not.

@nealmcb its very low level. Not an expert type of site.

@Iszi @nealmcb btw, do you think that twitted hacker q should be deleted, or enough to leave it as closed?

my thought was to leave it as a "signpost" for others....

Iszi

1

Q: Bypassing a captive portal

What would be some hypothetical ways to bypass a captive portal? For example when you connect to a public EiFi hotspot, you often are on a seperate vlan, only moved to the real vlan when you agree to the terms and conditions. How could you bypass this? Only via attacking the webserver directly,...

network wifi vlans captive-portal

@AviD I don't like it sticking on the front page for as long as things tend to around here. But you do have a point about a signpost.

AviD

@Iszi and on that note, we really need higher rep requirements for creating tags...

nealmcb

@AviD Expert opinion isn't useful for deciding on antivirus solutions?

AviD

15:02

@nealmcb if an AV question were phrased, "which are the important factors in selecting and AV", then sure.

(thats without getting into the whole discussion if AV is even really security... ;) )

but odds are, as I described the original home-AV q', it would probably be aimed much lower.

and thats the problem with "home users" - they're not professional. I'd prefer to keep this as a "professionals-for-professionals" site, and not a charity-help-your-grandmother site.

not that I have anything against anyone's grandmother.

diferent topic - @nealmcb, you commented on this q that its not security (and apparently several others agreed with you) - should it not be closed as offtopic?

-2

Q: Can you pick up any device specific information by monitoring bluetooth signals?

Could I use some sort of permanent device ID broadcasted by the bluetooth radio in my phone to do something like unlock my door? I don't want to have to ever pair the device, or take it out of my pocket (rfid, nfc). I just want to be able to pick up some unique identifier being broadcast from ...

authentication access-control wireless

(would migrate, but no clue to where...)

nealmcb

@AviD As asked, it seems like a superuser q, though I don't do much at SU. I.e. "what cool things can I do with my bluetooth".

AviD

15:17

@nealmcb yeah? so should I migrate to SU then?

nealmcb

If you think it fits...

AviD

@nealmcb pinging one of the SU mods to check...

@nealmcb nope, its not. close anyway?

nealmcb

BOOM!

AviD

@nealmcb I took that as a yes :)

nealmcb

I feel like the commanding officer on a destroyer. Of course I have no idea what is like... Well done!

But I think we do need more bluetooth questions here

AviD

15:25

@nealmcb ahem, bluetooth security questions ;)

nealmcb

Maybe some day they'll trust me with the missiles :)

Yup

AviD

@nealmcb hehe, I used to push the button / pull the cord to fire missiles / shells (both in artillery)... it gets old real quick.

but, the first few times pulling that cord is fun.

nealmcb

@AviD I was thinking you could set me straight :)

AviD

"fun"...

@nealmcb hehe, never on a destroyer, and never a commanding anything. The army and I didnt really get along...

mostly that "follow orders blindly" thing.

nealmcb

@AviD So I guess your country has a very high percentage of folks with military experience, and I wonder, what other countries have that kind of demographic?

Thomas Pornin

15:29

@nealmcb Switzerland !

All citizens are supposed to actively participate to the defense of the country and do a bit of military service (a few days) on time to time

AviD

@nealmcb some of our friendly neighbors here.... ;)

amazon.com/Start-up-Nation-Israels-Economic-Miracle/dp/…

very interesting book, has a chapter on that part of demographics, how it compares to other countries, and also the effect it has on the culture....

Thomas Pornin

Also Yemen has a very high percentage of rifle-savvy people because assault rifles are felt as a mandatory element for growing into adulthood.

AviD

and now I'm curious for the whole list of sites that are oneboxed.

Thomas Pornin

In quite the same way than cars for Americans.

AviD

@ThomasPornin and assault rifles in certain areas of USA.

Thomas Pornin

15:36

Cars kill more people in USA than assault rifles in Yemen, although there is currently a very spirited attempt at reversing that.

AviD

@ThomasPornin lol. Cars dont kill people, people kill people.

Cars dont kill people, bad drivers talking on cellphones kill people.

Cars dont kill people, its the sudden stopping of motion that kills people.

Jeff Ferland

Well, just talked one of the lawyers for the PATCO v. Ocean Bank case that just ended up all over the news

2

They're right across the street from me.

AviD

@JeffFerland oo exciting.

gonna take you on as expert witness?

thats something I'd like to get into, though no idea how to go about it....

Jeff Ferland

@AviD Too far in the case for that. Maybe if there's an appeal. I did give them some apparently good fodder on flaws in the magistrate's argument.

Off to a client in the next state over. Ciao.

AviD

@JeffFerland fun fun

DING DING DING!!! @ThomasPornin just hit 10K. wooohoooo!

Congrats @ThomasPornin! (and, you're welcome for the final clicks... ;) )

Thomas Pornin

15:44

@AviD Yup, there was much upvoting last night (in the European morning)

Now I have a rep with a "k"

it's kind of neat

AviD

@ThomasPornin so you owe me and @RoryAlsop a cake. redeemable for a beer each. no, cake. or beer.

those were the terms of our 10K race, back in the 6K's, before we realized you'd overtake us.

Right, @Rory? a beer? or was it 2? ;)

Thomas Pornin

@AviD ok, I'll drink a beer and eat a cake while thinking about you two.

AviD

@ThomasPornin aww, no, he found the loophole...

Feeds

Stack Overflow Blog: 1,000,000th user!

Posted by Joel Spolsky on June 9th, 2011

Like most sites, it’s hard to figure out the number of users on Stack Exchange. The widest possible number is the number of unique visitors, most of whom just read our content and move on. That number is now around 19,000,000 according to Google Analytics or 14,000,000 according to Quantcast – the difference comes from the fact that Quantcast has some “de-dupe” technology to try to estimate the number of human beings while Google Analytics just counts unique cookies.

Another number we track internally is “number of human beings who type on one of the Stack Exchange …

Thomas Pornin

16:19

I edited a tag wiki this morning, but I do not have the "tag editor" badge yet. Is there a normal, expected latency ?

Scott Pack

Different badges run at different frequencies.

For instance, I qualified for Electorate several days ago.

Ok, more than several days ago. Must have been last week.

Thomas Pornin

@ScottPack On Security.SE you "only" have 317 votes on questions; that's not enough for Electorate.

Ori

16:40

@AviD I hestitate to create any, since it already seems pretty messy.

nealmcb

Too bad - no ipv6 for SE for a while, despite World IPv6 day (which was fun!):

7

Q: World IPv6 Day?

Following on from whether it would be possible for StackOverflow to be available over IPv6, will the StackExchange network be participating in World IPv6 day this year (8 June 2011)?

discussion feature-request status-deferred ipv6

Karrax

17:23

@nealmcb Lets hope everyone has their ACL's and firewalls updated for IPv6 :) I know I double checked ours when we launched at the World IPv6 Day

AviD

18:05

@Ori thanks, thats a good idea. I'll be honest, I believe its rare at this point to need new tags. Not non-existent, just more rare than the number of new (pointless) tags that keep popping up.

and, in other news - the singularity has arrived.

dukenukemforever.com/full/us

though judging from the trailer, really not worth the wait...

nealmcb

18:47

Huh - no ipv6 support in mysql? Another disappointment....

@AviD I don't know if I want to know, but -1 for linking to a site that asks for security-sensitive info for no good reason

Well, I'm being a bit too rude on a point unrelated to your point, but I am curious about what it has to do with the singularity...

AviD

19:48

@nealmcb huh? what security sensitive info? doesnt it just ask for "Jan 1, 1970"?

I agree about the no good reason, but I guess thats their form of ensuring minors cant watch it...

nealmcb

:)

AviD

@nealmcb I just figured, if they're already actually releasing dukenukem forever finally, it must be the singularity. Or doomsday. Or some other worldshattering event...

its the game that will always be "someday".

nealmcb

Hmm - never thought about that before, but Unix is now able to order a drink....

oops - off by a few decades...

AviD

hmm, if Unix were to order a drink, what kind of drink would it order?

though I guess it would make more sense to differentiate by flavor of unix.

AIX would probably go for some singlemalt scotch... SystemV a fine cognac.

openbsd - tequila?

netbsd would be designated driver :D

(what other unix'es are there?)

okay, lets do Linux now...

Iszi

20:09

@AviD If it matters, all the other sites seem to have deleted the questions.

AviD

@Iszi which one is that now?

ah right.

shure, why naaat

@Iszi done

Scott Pack

@ThomasPornin Electorate requires 600 votes, of which 25% must be on questions.

Iszi

@AviD Spiffy. Thanks. I hope this doesn't affect the Meta Q. Sure it'll break the link, but SEI should still fix it.

Thomas Pornin

@ScottPack Aah, no, I looked it up recently because I had my 600 votes on SO

Scott Pack

@ThomasPornin Oh, no! you're right!

Either they changed it, or I misunderstood it before.

AviD

20:12

@Iszi I think they got the point... besides, you included a screenshot. Worse is the twitter link... though thats not a bad thing.

Thomas Pornin

It is 600 votes on questions, and at least 25% of all votes must be on questions

@ScottPack I don't think it changed, but the description is easy to misunderstand. There are explanations in some posts of meta.stackoverflow.com

Scott Pack

@ThomasPornin Well, I read it again and I do think, while poorly worded, is pretty clear. Apparently, I had it chunked up incorrectly in my head.

Thomas Pornin

@ScottPack So had I.

Scott Pack

20:25

Disregard my previous complaint :). I do recall one badge job only running every day days or a week, though. It's been so long since I saw/heard that statement that I can't recall what it was.

AviD

@ScottPack I think there is a nightly job, for the badges that need to be calculated.

Thomas Pornin

The "cryptography" tag appears in both SO and Security.SE; would it be considered bad form to copy&paste the tag wiki contents from one to the other ?

AviD

need second (and third) opinion: was I wrong in making this c-wiki?

3

Q: Crowd sourcing response planning to very public security issues

INTRO: More often than not, there's a security issue that's popular in the news, and I'm interested in what might happen if response planning was crowd sourced based on public information alone. Clearly, a 24-hour limit is in most cases not going to fully address the issues at hand, but believe i...

incident-response

@ThomasPornin lol, go for it. unless one of them is not very good text....

Thomas Pornin

@AviD Well, that's the point, one of them is not very good text (it is a single half-sentence copied from Wikipedia) and I am suggesting replacing it with the text from the other, which is very good since I wrote it myself

AviD

@ThomasPornin well, now that you've passed 10k, you can repeat that freely.

but I meant the other way 'round - dont copy bad text.

out of curiousity, which is which? (too lazy to go check.)

Thomas Pornin

20:33

I wrote the one in Security.SE

now I notice that my 15k rep in SO is not sufficient to edit tag wiki without peer control

AviD

@ThomasPornin well if you wrote it, no bad form in copying your own text.

on 2nd thought, the point of view there may be different from here. And on SO you might want to point out coming here for all but the standard "which library should I use" and "which class does this encryption" etc

@ThomasPornin 15k not enough? really? wow.

Thomas Pornin

@AviD Full privileges are at 20k

At 15k you can protect questions

AviD

@ThomasPornin lordy

@HendrikBrummermann I must ask... what is devisee?

nevermind, I looked it up...

Will (law)

A will or testament is a legal declaration by which a person, the testator, names one or more persons to manage his/her estate and provides for the transfer of his/her property at death. For the devolution of property not disposed of by will, see inheritance and intestacy. In the strictest sense, a "will" has historically been limited to real property while "testament" applies only to dispositions of personal property (thus giving rise to the popular title of the document as "Last Will and Testament"), though this distinction is seldom observed today. A will may also create a testamentar...

also known as "will". or even, "last testament". never heard the other term...

mind if I change that tag to law?

Hendrik Brummermann

21:15

@AvID, hm, that's not exactly what I ment; i am not a native English speaker. changing to law is okay with me.

AviD

@HendrikBrummermann its not? I wiki'd devisee and thats what came up. It also made sense in context, so I figured...

and since I find it highly unlikely that there will be another q (okay, except for the paired one by the same user) that is relevant, its not really a useful tag...

changed to law. I think that makes sense.

Hendrik Brummermann

What I had in mind was not a written will but the things that are passed on.

Anyway, you are right that there will likely not be many questions in this area.

Thomas Pornin

@HendrikBrummermann Things that are passed on: isn't this called a "legacy" ?

Ormis

haha, @AviD in the time it took me to respond to D.W. in the Security Risk of Ping question, you already responded.....

AviD

21:38

:)

AviD

22:34

I really want to close this question, but the answers do justify it. Sort of.

2

Q: Denying login after incorrect attempts - ineffective

Generally denying logon attempts after X amounts of incorrect attempts for Y amount of tries is a very basic way to prevent bruteforce attempts or malicous logon attempts. Yet, surely doing this is meaningless if you allow successful logon with the correct password? In which case getting an erro...

authentication passwords

the question really should be "how to do account lockout"....

Transcript for