« first day (1002 days earlier)      last day (4176 days later) » 

00:34
@Iszi I thought it was F**k the f**kers.
courtesy of the esteemed Mr. Carlin....
NSFW on sound.
00:46
@RoryMcCune I'm still trying to convince myself I need IDA Pro.
And that thing only cost 1k~
@TildalWave Do you go about endorsing people on LinkedIn when you can't sleep? :P
@TerryChia hehe and LinkedIn is making it so convenient you can endorse 4 people at the same time too. I think I endorsed anyone I have in my list from Sec.SE today for all the skills they had listed and I didn't yet endorse. Still waiting for someone to list "beer drinking" in their list of skills tho :|
@TildalWave Do you have "logo making" on your list of skills?
@TildalWave @ScottPack You're up.
@TerryChia Depends on what you need. I can navigate my mouse through PS, if that's what you're asking LOL. What's with that mail pinging? :O
@Iszi I'm just about to fall unconscious
sup?
@TildalWave That's from TheDailyWTF.
00:58
@TerryChia They need a new logo? :)
@TildalWave Maybe. :P
@TildalWave logos? now you do logos too?? I thought your speciality was Icons....
@AviD You forgot I made you your own Sec.SE logo? Need I mention I do wallpapers too? :))
hehe, right, right.
sleep time.
01:01
@TildalWave YES!
I was also testing a bit, how that @ThomasPornin's push to change from the lion to a bear could look like LOL
Stick that on Meta.
@TerryChia Tomorrow,... I really barely keep my eyes open. Good night all!
BTW @TerryChia:
@ Terry searched your name there. Search result: A$$ — Andrew 13 mins ago
I already flagged it
@TildalWave Hehe. I'm not offended.
@TerryChia I am. His name is Andrew
01:09
0
Q: Does a OS manufacturer have permission to access your computer unauthorized?

the_stackXMany services such as email and online storage have stated in their Terms of Service that they have the right to view and delete your files at any time. I'm wondering if they same applies to software and especially Operating Systems as well, since the software manufacturer essentially owns the so...

Think it can be salvaged?
Well... In general, the question can be considered too broad because it does not specify jurisdiction nor which OS they're asking about. In the end, it will come down to "Ask a lawyer" and/or RTFM.
So.... I'd say no.
@Iszi I was thinking about removing the legal parts entirely and focusing on the technical aspects.
I can't make up my mind if that would make it a semi-decent question or not.
@TerryChia Oh, no. It's totally about the legal parts.
It's still kinda crappy.
There's no point to question technical capability - if the OS vendor wants to stuff a backdoor in, they've got access.
01:13
@Iszi Alright, I won't bother then. :)
Coffee time. brb.
 
4 hours later…
 
3 hours later…
07:46
Fucking threading...
08:02
Luckily multi threading with shared mutable state is pretty rare
@CodesInChaos It's pissing me off nevertheless, given I have next to no experience with it. :P
0
Q: Python Watchdog: Is there a way to pause the observer?

Terry ChiaI am using Watchdog to monitor a directory and keep it in sync with Dropbox. I am facing a situation where every time I download a file from Dropbox, I trigger an upload event as I need to write to the directory Watchdog is monitoring. Is there a way to "pause" the observer while I apply the d...

In case anyone here knows the answer.
08:22
multi-threading is one of those things that get more frighting as you gain experience
what's great about C#5 is that it allows you to do async IO while keeping your code single-threaded
09:37
I feel like I'm in a 3rd world country. Germany, compared to Finland, is ridiculously cheap.
We had 4 beers, 2 shots, two quiche dishes, one salad, and two glasses of porto... For 25 euros
AAhhh.. I want to live here (and still work in Finland)
10:08
hi there
 
2 hours later…
12:18
lucaskauffman on September 13, 2013

An often overlooked and misunderstood concept in application development is the one involving secure hashing of passwords. We have evolved from plain text password storage, to hashing a password, to appending salts and now even this is not considered adequate anymore. In this post I will discuss what hashing is, what salts and peppers are and which algorithms are to be used and which are to be avoided.

Hashing is a type of algorithm which takes any size of data and turns it into a fixed-length of data. This is often used to ease the retrieval of data as you can shorten large amounts of data to  …

12:29
@LucasKauffman really nice blog post, I'm tweeting this :)
@ManishEarth where the heck did you find that?
@M'vy Hey!
RT @securitymoey @infodel: The best part about a CISSP joke, is you don't have to know anything about security to get it #protolol
Heh, I'm bored.
12:50
Morning.
@Simon Morning
afternoon
(geez that morning seemed to go quickly :op )
If only.
@Simon It's Friday night man!
@RoryMcCune facebook
12:59
@TerryChia I wonder how it feels to live on another planet.
13:22
@Simon seems about the right time to invite you to our Space Exploration then... unless you wanna travel on some psychotropic substance, since it's Friday and all LOL
@TildalWave Nah, I'm not wild enough to do any of these, hehe.
I just wrote an answer describing mountains made of marshmallow floating on an otherwise chocolaty planet, too. :)
14:05
Ahh, one of my favorite Defcon talks ever.
Anyone in there around Cork this week-end? (Ireland)
14:25
haha, zoz is awesome:D
low security = possible recovery
@Simon Already flagged.
Super Terry.
Wait, there's no way to flag it to be migrated to Crypto?
@Simon Flag for mod attention.
@TerryChia Yeah, that's what I did.
14:59
0
Q: SQL Injection with pass MD5

stefanoI want to know, if in my login form there is any SQL injection possible. If there is, what could the exploit's web form entry look like? I send username and password by html form (POST). The login function code is: $username = $_POST['user']; $password = $_POST['pwd']; $password = md5(password...

Oh wow.
@Simon Free rep for you. Gogogo.
What's the name of your website, young man? I swear nothing bad will happen to it if you publish it.
15:12
@TerryChia Well, I just had to do it. I'm not sure if it's gonna stay opened but I really felt the need to post an answer.
No wonders why you guys laugh at PHP developers, wow.
@Simon I would post an answer but I'm too busy surfing porn. Server porn.
Damn, we could dominate the world if we had a farm like this.
@Simon There is no "migration path" to crypto because crypto.SE is a beta site.
@ThomasPornin Oh ok, thanks.
@Simon I'm busy jerking off to these photos. porn.serverbear.com
15:23
@TerryChia Well, just because of the name I'm not gonna click it at work.
@Simon It's totally safe for work.
16:06
@ThomasPornin well the path is "flag it for mods, let them migrate it" :)
16:44
Interesting chat on the new iPhone fingerprint sensor , apparently not vulnerable to the chopped off finger or gummi bear attacks... citeworld.com/security/22399/…
17:18
If I was a slow day, I'd be today.
were*
I'm also almost falling asleep on my keyboard.
@Simon Indeed. I have not even repcapped.
Yet.
I like the confidence.
There has been a kind-of-official answer for the site name change:
5
A: Let's change our site's name to Information Security, or just Security

Anna LearWe have renamed sites in the past when it became clear that their scope has either changed significantly or that the name was actively harmful. The most notable change was probably Fitness & Nutrition becoming Physical Fitness. So, in principle, we're open to discussing the name change for this s...

Salient point being: "We'd like you guys to take more time to discuss"
So let's put on our best boots, and kick that dead horse again.
I enjoyed her point of "there is no clear consensus" except I think there actually is...
@ScottPack which is my I pointed to the other question, which makes the consensus more visible.
17:30
Furry muff
She shares exactly my opinion about "Information security" vs "Security".
Most of ours, I think.
@ScottPack The only reason why she says that is because I haven't posted my opinion. Therefore, she's unsure if I approve it.
@AviD I agree. It does feel nice to be back on your face.
Just. Fucking. Burn.
0
Q: CAN ANYBODY HELP ME TO FIX THIS PROBLEM

manisha kanungoI AM HAVING A PROBLEM WITH MY GMAIL ACCOUNT.I CAN'T SIGN IN.AN ERROR IS OCCURING:Error 150 (net::ERR_SSL_PINNED_KEY_NOT_IN_CERT_CHAIN): The server's certificate appears to be a forgery

17:32
@Simon Don't forget to say "eh, sorry"
Caps lock panic always pisses me off.
GO AWAY TOM LEEK.
@Simon UPPERCASE IS GOOD. PANIC IS WHAT HAPPENS TO OTHER PEOPLE.
Wow. That was weird.
Does that mean that only small bear yells?
I'm surprised that I'm the only one who downvoted. You guys are nice.
Onion Bear, much like Death, is only capable of speaking in uppercase.
You're weird too.
I have 3 pending flags, it's even a slow day mod-wise.
Oh by the way, how many characters are there in a keyboard?
17:41
Depends on the keyboard.
So, typically how do you calculate the odds of bruteforcing a password?
x^n
I need the x.
No, I'm not asking a homework question, it's not my fault if I'm thinking of homework questions all by myself.
Basically the question would be how many different characters can there be in a password?
Does it depend on the encoding?
@ScottPack You're retagging your answers again, I see you.
/me sighs
pulledpork is cranking me out
The number of characters on a keyboard isn't the same as the number of characters available in a password set.
What's that number then?
Depends on what character set you're looking at. Does it allow specials? Non-ASCII? French? Kanji?
@Simon Typical 105-key keyboards happen to contain, on average, 105 keys.
17:49
@ScottPack Let's say UTF-8.
Since it's the most popular.
@Simon UTF-8 is an encoding. You mean "Unicode"
My keyboard has 94 direct characters it can type using the shift key.
@ThomasPornin I have no idea.
In Unicode there are about 105000 code points
I just want the damn number.
You guys are being soooo vague.
17:50
there is room for more than a million, but 105000 are defined
I think you are confusing vagueness with specificity.
On a normal keyboard you can type at least all the printable ASCII, so all characters from 32 (space) to 126
Oh, right. Space. So on my keyboard I can reasonably type 95 characters.
@ThomasPornin So, 126-32?
which means 95 distinct characters. You can also type on arrows and Esc and Enter and so on, but you cannot enter this keys in the password entry field
@Simon +1. Don't forget the boundary. So 95, not 94.
17:51
Yay! Thanks.
However that doesn't mean that the password set would allow all 95.
But, of course, a French or, God forbids, a Canadian, can also type accentuated letters.
And you can enter extra codes with some combinations, e.g. Alt+three digits on Windows.
There are plenty of places that I see don't accept special characters which would be....62. Maybe 63 if they don't consider space to be special.
With the X11 "input methods" you can type thousands of characters
Jesus, we're still not quite close.
17:53
Ok, let's make things simpler.
Suppose that you want to crack the password of an American user.
Yes. Let's dumb it down to Simon.
LOL asshole.
Alright, let's go for an American.
Then it is highly improbable that the password contains non-ASCII characters.
Yes.
That Yankee would not know how to type a "é" or a "€" anyway.
17:54
Damn rednecks.
so he has 95 characters available.
HOWEVER,
That's true, I don't know how to type blocks.
not all characters are equiprobable.
See, even @Scott had forgotten about the space
Like the alphabet + numbers are far more probable.
@ThomasPornin Don't you just copy and paste from charmap? I always assumed that was how foreigners typed.
4
17:55
@Xander I am not foreigner. You are.
@Xander ferner
Man, bruteforcing is an art.
@Simon It is partly psychological
@ThomasPornin Your mother smelled of elderberry.
Do bruteforce algorithm actually take this into consideration?
Stuff like location, etc.
17:57
@Simon Sometimes, yes.
Competent attackers do.
However, it might be hard to tell the location of the user depending on the situation.
That's pretty neat.
If I were to try to break the password of a German, I'd use a German dictionary to begin with.
Yeah.
@ThomasPornin It's so cute how uneducated and primitive you foreigners can be. Don't worry though, one day we'll send the Peace Corps to your land to teach you about tupperware and basketball.
@Simon If I don't have the slightest idea of who my target could be, then why would I spend efforts to break his password ?
17:59
@ThomasPornin Well yeah, you have a point.
Unless you know that this person has access to a certain system.
But yeah, chances are that you know some stuff about him.
@Xander And McDonald's
@Simon Also it helps to know the system the passwords came from. If, for example, the service won't let you start your password with a number then you can take those out of your dictionary.
@ScottPack Impossible ! How would you call a quarter-pounder in a country which uses the metric system ?
@ScottPack So, you should never implement requirements like these.
@Simon I've known of people, when attempting to brute force passwords from webapps, attempt to sign up at that website. Try a bunch of weird passwords and figure out what their requirements are.
@ThomasPornin A Royale with Cheese.
@ScottPack That's clever.
@Xander Where did you find this video of my mom?
Ok, so that place requires password of between 4 and 25 characters, must contain a number, and no semicolons.
@Simon My camcorder.
@Simon Your mother is a Mulumbo tribeswoman?
@ScottPack Actually it is "Royal cheese" (both in the movie quote, and in the real World)
@ScottPack So, it becomes quite easier to bruteforce.
18:03
@ThomasPornin Sorry, it's been a decade since I saw that.
@Xander She's very special.
Or longer.
@Simon Exactly. You can take all those out of your dictionary and not bother checking them.
Brute forcing is usually considered cheap and weak. But you know what? It's what everyone does.
You get a hash list and start your brute forcer. Let it run while you go do everything else.
Well, I'm sure it's unsuccessful most of the times anyway.
Maybe you get in a different way, maybe your 'root' password is 'toor'.
I really should code a bruteforce.
And definitely not in PHP.
18:06
I recommend Erlang.
Never heard of it.
I was thinking Python.
Developer Ericsson
Really? Weird.
had my first social engineering assigment today
What's her number?
Was it about figuring out a person's password by learning stuff of his life?
Because we had the same here.
My ex still hasn't replied to how she wants to split stuff.
She has a degree in Law, I think I might be fucked.
@ScottPack 't was a client, not a she!
18:22
@LucasKauffman Clients are only worth an "it", indeed.
That was rude.
/me sighs
Trying to help debug a relatively minor bug in pulledpork.
Such that every time you update the rules it appends instead of replacing.
REALLY? Youtube is already showing me dating ads. I swear they're spying on me.
@Simon Facebook account, maybe. Yours or hers.
@ThomasPornin Nothing was posted there.
That'd be creepy though.
18:29
@Simon they know
Google must work with the government quite a lot.
18:44
@Lucas Company said no Belgium :(
@Simon Broke up with your hardcore DJ?
9D89Y23473HUJFNDSKFDSJFDS
HEADHUNTERZ SAID HARDSTYLE IS GROWING IN FINLAND HOW CAN YOU STILL BE SO RETARDED?
Man, it feels great to hit the caps lock button twice.
@Simon Only two glassesthings grow in Finland: Potatoes and metal music.
TTwo things*
Just wait, just wait.
FTucking Mobile!!!!
@LucasKauffman coolio, what sort, on-site, phishing?
18:51
@Simon We should start dating
@RoryMcCune on-site
I don't know it's only been 5 days.
@RoryMcCune had to bullshit myself in
we used a double approach
I feel like our relationship would be a rebound.
@LucasKauffman how did it go?
18:52
@RoryMcCune we got in, but we weren't able to steal the token
@LucasKauffman what was the token?
@RoryMcCune a special document which said top secret
@Simon 5 days!!! That's very long already!
@RoryMcCune but I feel that they knew we were coming
@LucasKauffman interesting, quite a specific target... what ruse did you use to get in?
18:53
So, any melons while I was away?
@LucasKauffman yeah that's always a potential problem, that sort of info gets around in a company I reckon.
@RoryMcCune I walked in with a 1850 under my arm and a tool box, told them I was going to place a new server. I made sure the IT guy was out for lunch when I walked in
and she almost let me pass, but then another lady came in and she called the it guy
and then it went down hill from there
@Adnan Might want to see a doctor.
@LucasKauffman ah tricky one. if it's a smaller office that could be difficult..
@RoryMcCune It's an office with 10 people max and only 1 entrance
18:55
It's also suspicious when someone with a German accent says they're here to install the new server. It's too much like the opening of a cheap porno.
I remember the EY UK guys got into some bother 'cause they impersonated people from a real utility company, which apparently isn't allowed...
@LucasKauffman oy that's nasty for a first assignment
big offices are much easier..
@RoryMcCune I made a fictitious company with a fictitious invoice
@LucasKauffman safe. when I'm doing wireless gigs and wandering around offices with a laptop, I always wonder how long it will be before I get challenged... almost never happens..
@LucasKauffman I'd actually LOVE to do that.
18:57
@RoryMcCune if you get past the initial security, especially in a large company, no one will bother you at all
@LucasKauffman heh that does sound like something a pen. testing company would do , the USB stick is like a standard one these days I recon
@RoryMcCune the complete story about that is really really good though :P
@LucasKauffman heard about a good technique at a meeting I was at. When someone sends out papers for a meeting, send out a follow-up spoofed mail with "updated papers" to your target
@RoryMcCune ooh interesting
@RoryMcCune there's another technique we're going to do :P
@RoryMcCune do you have gtalk?
or skype
@LucasKauffman I got it from a Gov.CERT guy it was cool
19:01
skype you have
@LucasKauffman also gtalk [email protected]
 
1 hour later…
20:26
evening all
some quick questions: anyone else think this is unanswerable and should be closed?
-1
Q: How trustworthy is SELinux?

0xC0000022LGiven the ongoing leaks concerning mass surveillance and the fact that the NSA is the original developer of SELinux, I'm wondering whether that means that backdoors should be expected in there? As every other obfuscated C contest, not at last the Underhanded C Contest, shows, well-written backdo...

@RoryAlsop yup
and I agree with @Gilles on this one - shall we close as dupe?
0
Q: How to defeat software keyloggers

Rubber DuckIs it possible to defeat software keyloggers? I remember reading long ago about programs run from a USB which will defeat keyloggers. The software works (if I remember correctly) by intercepting keyboard events to the system, and randomly replacing your keystrokes with random keys, and then co...

@RoryAlsop Who else here has ever written a keylogger?
It's a fun exercise.
@tylerl did one in Z80 back in the day :-)
not done one since
never properly learned the Intel code set. Got pretty good at 6800 and 68000 though
@RoryAlsop Mine was for Windows back in the win2000 days. Turns out that windows actually provides a "log all keystrokes" hook right there in the API.
20:41
@tylerl of course, how else would you program alternate keyboards, global keyboard shortcuts, and other useful applications?
@RoryAlsop meh, if you close this one someone else will ask it, and the Bear's answer is good
@Gilles the good answer is what saves it...maybe I'll see if I can slightly reword the question
@Simon Eh. Done.
Dammit, undone.
Some rogue mod migrated a question, exporting 30 rep points from me.
@ThomasPornin probably me - which question? Oh I migrated a crypto one - to Crypto :-)
@RoryAlsop Yes, I cannot even rationally complain. I can still irrationally grumble, though.
@ThomasPornin pffft - my thinking is that if we can ping good crypto questions (or even average ones) over, it speeds up your graduation
20:48
Turns out that a lot of my rep in crypto.SE over the last year is from migrating questions from security.SE.
and here we are in a position where we aren't substantially impacted by the loss of it (in terms of numbers etc)
@ThomasPornin not surprised
you answer very quickly here, before the mods can migrate em
It has been brought to my attention that my #1 status on crypto.SE might be threatened, so I should go there a bit more.
@ThomasPornin - this question. You say it is the same as the previous one - do you think same enough to close as dupe?
3
Q: Is there any way to cryptographically hash a human thumbprint?

makerofthings7Is there any way to cryptographically hash a human thumbprint into a form that can be consistently reproduced by thumbprint readers? Assuming that it would be possible to create a database of thumbprint-hashes, my intent is to salt that hash with a "something you know", preventing the thumbpri...

and secondary to that - should either/both of them go to crypto?
@RoryAlsop no: there's a nontrivial step to reduce one to the other
@RoryAlsop no: it would probably be on-topic on crypto but it's also on-topic here
@Gilles no worries - I thought that but your statement made me think twice
time for me to go and have wine then...
later folks
20:51
@RoryAlsop have you got me confused with a bear?
@Gilles ah - yes
mushroom / bear / so easily mistaken...
(wups)
obviously really need wine
@RoryAlsop Yes, they both are biological entities.
@RoryAlsop More wine or much less wine, indeed. You can't stay stuck in the middle.
@RoryAlsop strictly speaking, I'm not a mushroom, I'm part of one
@Gilles And strictly speaking, Thomas is only the head of a bear
@tylerl I think Thomas's avatar represents a whole bear, even though it does not display a complete 2D projection of a bear. Conversely, my avatar displays a complete 2D projection of a mushroom, but that is not what it represents.
u_______
^^^^ this is not a pipe
20:56
@Gilles I think you need to quit smoking yourself
21:20
Good lord I hate other people's PHP code.
WHY IS EVERYONE SO STUPID?
@tylerl I dislike other peoples code in general. Other people don't think the way I do so my mind rejects it.
@Griffin There's some truth to that, but I read other people's code so often that I'm used to that. But PHP programmers. Wow they are a clueless lot.
@tylerl :P Maybe they think really different?
so next time we'd like an answer from @ThomasPornin I reckon this graphic should be used.
user image
3
@Griffin Yeah. Really, really different.
21:23
@tylerl They're just "special"
@RoryMcCune Bear, batman, and Game of Thrones, all in one.
@Griffin I wish I could show you this code. Because this certainly is "short bus" material.
@tylerl Why not? PHP is rarely all that special.
@tylerl In basic form.
@tylerl Then again if it's short bus material.... it could be a problem. It's still not as bad as a guy that included his private key for captcha in a comment in HTML.....
@Griffin why not what?
@tylerl Show me.
@Griffin client=NDA.
as a rule
21:26
@tylerl Do more basic things so you can show me.
@tylerl NDAs are important. Secrets are good.
22:10
@tylerl So work some magic with black text + black background.
@Gilles Flag.
@tylerl why?
I voted to close, what else should I do?
@Gilles I flagged, cause this is more than just off topic, the user knows its OT and was hoping to get some tech support before it was closed.
23:05
Vote to close almost got it, but the flag did point me straight at it :-)
@RoryAlsop You're too quick! Cost me a first post review. :-P
But the time I got it open it told me "The post had already been closed."
Opinion Poll: Centos 6 or Ubuntu 12.04 LTS? (or something else?)
(for server)
23:24
@tylerl My vote is for Ubuntu 12.04 LTS, but my opinion isn't worth much. I'm a Linux hack, and I only run it personally and in labs. For me, it's a bit easier to work with than CentOS, but that may be primarily due to my lack of experience with it.
My Desktop is ubuntu, but of the servers I've managed for people, some 90% use centos
@tylerl ubuntu
for a server, or debian
@Gilles why's that?
@tylerl religion?
@Gilles what, for a server, does debian have over ubuntu that doesn't apply for a desktop?
beside religion
23:29
@tylerl because in terms of automating things like package provisioning, dropping libraries and documentation in the right place, registering handlers for file formats, etc., debian > ubuntu >> centos
but in terms of support for recent hardware and nice out-of-the-box configuration for desktop users, ubuntu > debian >> centos

« first day (1002 days earlier)      last day (4176 days later) »