The DMZ

Simon

14:00

Screw this. This chunk is now part of me.

David Freitag

@ScottPack I modified my potato gun to fire specially molded thermite cupcakes. It ignites a magnesium strip as the cupcake exits the barrel. A few hundred milliseconds later and its showering a few thousand degrees worth of awesome.

Scott Pack

Seriously?

Adnan

@Simon Keep searching on Facebook. I'm sure you'll find it.

Simon

@Adnan I'll try to remember when I get home.

David Freitag

@ScottPack yes

Adnan

14:01

@DavidFreitag Video, please.

Scott Pack

Yes. This.

David Freitag

I can't even count the amount of barrels i have melted. It has about a 40% chance of brutally melting the user to death.

@Adnan I'll have to make a parts run. It's not exactly in... operating condition.

Simon

I have no idea how they've never heard of your thermite canon.

Terry Chia

@Simon Indeed... I think that's like the fourth time it's been mentioned in here...

Simon

@TerryChia Minimum.

Adnan

14:05

I wonder whether it's possible to shoot thermite using a shotgun shell.

Simon

I wonder if guns solve problems.

Adnan

I've seen videos of people shooting pretty much everything: Ice, M&Ms, spoons, glass, etc.

@Simon In the right hands, yes. Yes they do.

In the left hands, not so much.

Simon

@Adnan Thing is you can control those hands.

@Adnan Clever.

Adnan

@Simon Well, I hope we don't get into gun laws discussion.

Simon

@Adnan Oops, I didn't mean to.

CAMELS AND TURTLES.

Yes, they're awesome.

Adnan

14:09

@Simon I'm more of a cocky rabbits fan.

Simon

wat

David Freitag

@Adnan I don't see why not, you would have to suspend the thermite in something that isn't going to break when you shoot it

I make my cupcakes with plaster.

Adnan

The Tortoise and the Hare

The Tortoise and the Hare is one of Aesop's Fables and is numbered 226 in the Perry Index. The account of a race between unequal partners has attracted conflicting interpretations. It is itself a variant of a common folktale theme in which ingenuity and trickery (rather than doggedness) are employed to overcome a stronger opponent. An ambiguous story The story concerns a Hare who ridicules a slow-moving Tortoise and is challenged by the tortoise to a race. The hare soon leaves the tortoise behind and, confident of winning, takes a nap midway through the course. When the Hare awakes howe...

Simon

@Adnan Aaaaah.

David Freitag

Mmmmhm. That's right, Qemu inside Virtualbox.

Lucas Kauffman

14:14

@DavidFreitag Because fuck performance!

David Freitag

@LucasKauffman Well, I'm running a kernel that i have written in Qemu. An arduino would even laugh at how big my program is.

So honestly it isn't affecting anything.

Terry Chia

@DavidFreitag Have that Qemu run VirtualBox.

Lucas Kauffman

@DavidFreitag you wrote your own kernel?

David Freitag

@LucasKauffman Yep

Lucas Kauffman

@DavidFreitag why?

David Freitag

14:17

It doesn't do much anything but print characters to the screen and freeze abruptly when you hit the memory limit.

@LucasKauffman Why not?

Lucas Kauffman

true

David Freitag

I'm a comp sci major. Need you know more?

Lucas Kauffman

@RoryAlsop right so I'm in Luxembourg can get whiskey super cheap (bottle of laphroaig was just 29 euro), highland park or springbank?

Terry Chia

@DavidFreitag I won't be impressed until you write it in JS. :P

Lucas Kauffman

Make your kernel run in JS

like terry says

David Freitag

14:20

@TerryChia That would involve writing, or extending, a JS interpreter. That sounds really fun, but, at this point in my life I'll stick to C++ based kernels.

Terry Chia

@DavidFreitag C++? Don't you know Linus hates C++? Pfft!

David Freitag

Maybe in ten years when i understand more how a kernel works in code i can do that.

Simon

@ScottPack Did you know that your Grand Daddy used to wear a hat like yours?

David Freitag

@TerryChia That's good for Linus.

Scott Pack

@Simon Yes.

Simon

14:23

Oh.

Scott Pack

His were cheap polyester.

Lucas Kauffman

I'm going to write a kernel python

and it will be slow

but it will be awesome

because it's pythonic

Simon

@ScottPack Yours is in top notch polyester?

Scott Pack

Wool.

Lucas Kauffman

too snarky? security.stackexchange.com/questions/44969/…

Simon

14:26

@ScottPack No wonders why the young one is fancy.

Adnan

14:38

@Simon The fuck is "TY"?

Simon

@Adnan ty in caps.

Adnan

@Simon What's that too?

Simon

"thank you".

Adnan

@Simon Is there some sort of page where I can learn all of those things you say?

Simon

@Adnan Nope, you just need a few years of video gaming.

Adnan

14:39

A page that contains all of your vocabulary

You know, like a 2-3 page PDF

Simon

Would need more pages than that.

Oh wait, I just got it.

Le fu-.

Adnan

@Simon :D

Rory Alsop

@Lucas - both are good. If you have never had a Sprinbank, get it, otherwise the Highland Park. Actually, get both.

Terry Chia

@Adnan Niiiiiice!

Adnan

@TerryChia Yeah, I'm getting better and better.

Lucas Kauffman

14:42

@RoryAlsop 3 bottles of whisky it is

Terry Chia

@Adnan Maybe @Simon is just getting easier and easier.

Simon

@TerryChia Maybe because I'm slowly dying.

Terry Chia

@Simon Ok.

Lucas Kauffman

also got the glenmorangie sherry wood finish

Simon

@TerryChia I know you cried.

I dedicate this song to @ScottPack:

►

And the girl on the cover is dedicated to @Adnan.

Scott Pack

14:46

I don't like that man's voice.

Simon

Why?

Adnan

@Simon She's very unattractive.

Simon

ALRIGHT GUYS, I GOT THE MESSAGE.

Scott Pack

Because I don't like his tonal quality.

Adnan

@Simon Why would anybody be that thin?

Simon

14:50

@Adnan cuz

Adnan

I don't know, but I'm sure I'm not the only one to say/think that such physique is a big turnoff.

Simon

Well, when I see bones it's a turnoff.

Adnan

Imaging being with such girl. "Oh my god! Did I break her? Should I hold her from here? Oh no, what if I broke her?"

Simon

Her arms look indeed tiny as hell.

Adnan

@Simon No shoulders, at all.

Plus, she has the famine face.

Simon

14:58

@Adnan The other way around is not better: "There's no way I can lift her. I bet she's hiding stuff underneath all that. IS SHE REALLY GONNA SIT ON ME?"

Adnan

I wanna take her home and cook her a healthy meal.

@Simon Well, understandable. Because you're tiny.

Simon

:(

Adnan

@Simon Have you started eating and gymming?

Simon

I eat just fine. Gym, I should.

kalina

no point pinging me multiple times about stuff like swag

I always turn it down, even when I'm eligible

Adnan

15:01

@Lucas For example...

Lucas Kauffman

@Adnan mmmm?

Adnan

@LucasKauffman Later on Skype.

Scott Pack

You guys Skype without me?

Simon

@ScottPack It's an Euro thing, we're not allowed.

Rory Alsop

I'll have @kalina's swag

Simon

15:13

^

Adnan

@RoryAlsop Oh no, don't ping her about swag. She said so.

Terry Chia

@RoryAlsop That only works if they are giving them out. So get to work and ping SE. :P

AJ Henderson

any ideas why I got a downvote on security.stackexchange.com/questions/44972/… Am I missing something

Adnan

@AJHenderson Yes, I downvoted you

You're missing the whole point of the question.

Actually, I was just about to ping you about it

Terry Chia

Moot point, it's a dupe anyway.

:P

AJ Henderson

15:19

ok, what was the point of the question then, because I didn't really understand what they were trying to accomplish

it looked like they were trying to use SHA2 as a key derivation

or as a secure password generation

Terry Chia

@AJHenderson The guy doesn't want to use the same hash he uses for authentication (which is stored somewhere) as the key to an encryption function.

Adnan

@AJHenderson Client side encryption. Derive a key from the password and use it to encrypt data client-side, and use the password itself for authentication.

It's a very popular scheme.

The same scheme is used by CounterMail

Once authenticated, the encrypted data are transmitted to the client and decryption happens on the client.

AJ Henderson

is key derivation a proper use of SHA2?

I've not personally used it that way, but I suppose I don't know for sure that it isn't a valid method of key derivation

Terry Chia

@AJHenderson No, but that's beside the point really.

5

A: User authentication + database encryption with same password

As far as I can tell, your scheme is this: Compute scrypt(pass) and store it as the authentication key in your database. Compute sha256(scrypt(pass)) and use that as your data encryption key. The problem with this technique is that an attacker with access to your database can simply compute t...

Lucas Kauffman

@AJHenderson it depends

Terry Chia

15:22

This answer by @Poly is a really elegant solution imo.

Lucas Kauffman

@AJHenderson mostly we use pbkdf2

which can use SHA2

Adnan

@TerryChia Exactly what is used by CounterMail. Brilliant answer by Poly!

@AJH What @Lucas said

AJ Henderson

@Adnan yeah, I wasn't saying that client side encryption is bad, I was just pointing out separate problems. He appeared to be saying he wanted to hash the password client side and then send it after it had been salted and hashed to store and see if they match in the future

Terry Chia

@AJHenderson This is the gist of the question really.

> One of these passwords is used to authenticate with the server side (and stored there salted and hashed), the other password is used to encrypt the information client side before sending it to the server.

AJ Henderson

and then he also seemed to be doing a client side key derivation that appeared to be a roll your own implementation rather than using a best practice, it wasn't a complaint about client side encryption, just the mechanism of key creation

Adnan

15:25

@AJHenderson Sorry, your answer is still useless.

@AJHenderson Don't get me wrong, I'm not saying you provided incorrect information. Not at all.

The information are good, for a blog post on the topic.

AJ Henderson

well he only asked if it was valid, not asked for alternatives

Adnan

But not good to answer the question

@AJHenderson Sorry, but wrong.

> Now, I am unsure if this is a scenario that SHA2 is designed for, and I don't want to abuse it. Is there a better way to generate these passwords or is SHA2 suited for this?

AJ Henderson

ok, that's fair. I hyper focused on the main heading and missed the Is there a better way part

Adnan

@AJHenderson Hey, if it's gonna create anything between us, I'll remove the downvote at once.

I don't want to annoy you or anything.

Terry Chia

Just delete the answer and VTC it as a dupe. :P

Adnan

15:29

@AJHenderson But, still, you haven't told him why SHA2 is a bad idea here. You only talked about sending the hash of authentication.

AJ Henderson

@Adnan nah, I just wanted to understand

I added a bit about PDKDF2 as a suggestion

Adnan

@AJHenderson Great. I'm happy to hear that.

AJ Henderson

so that an alternative is given

it's a good improvement to the answer

Adnan

@AJHenderson Sorry, still you're missing the point.

Oh, seems that the OP has commented

I seem to have been not very clear in my question, sorry. I wish to have two passwords, one to authenticate with the server, another to encrypt data. I don't want to send the second one to the server, and I don't want the user to have to enter two passwords, just one. "secure key derivation algorithm" is good google-fodder. Thanks =) — Jens 47 secs ago

1 min ago, by Adnan

@AJHenderson But, still, you haven't told him why SHA2 is a bad idea here. You only talked about sending the hash of authentication.

Poly's answer fits the OP's case like a glove.

In the spirit of the DMZ: newsfeed.time.com/2013/10/29/…

AJ Henderson

yeah, with the new comment I agree

sorry about the delay, had a meeting

I've deleted my answer as I concur it is the exact same scenario now

and btw, just for future reference, if I'm ever actually upset about something I'll mention it explicitly, I just tend to be aggressive in my discussions :)

so if I ever seem like I'm upset about it, I'm probably just giving a vigorous defense

Lucas Kauffman

15:53

@AJHenderson le me pets the kittyz

Adnan

@AJHenderson Good to know :)

The latest visual fingerprint question (which I find silly, by the way) reminds me of a very interesting thing @lynks said

Jul 30 at 13:30, by lynks

Reminds me of trying to convince my friend that a 6x6 grid of black or white squares is enough to give each living human a unique representation.

kalina

in The Bridge, 30 secs ago, by fredley

Oh God I regret ever visiting the DMZ

TildalWave

hehehe nice

Terry Chia

@kalina Sweet!

Scott Pack

@kalina Who?

TildalWave

16:00

A new user: "Oh look, DMZ, this looks cosy..." DMZ: "WAF WAF!"

Lucas Kauffman

@TildalWave well the barking depends on the retardometer's output

I think malfunctioned when @Simon came in though :(

Simon

EVEN @LUCAS NOW?!?!?

Lucas Kauffman

@TildalWave you should change your name to SeniorTildalWave

TildalWave

there was no return address on the package he came in ;)

Lucas Kauffman

@Simon It was too easy

Simon

16:02

My poor self.

TildalWave

@LucasKauffman you mean "senor"?

Lucas Kauffman

hugz

@TildalWave yea sorry ^^

amazon.com/Passion-Natural-Water-Based-Lubricant-Gallon/dp/…

because share all the things

TildalWave

hehehe

Adnan

@LucasKauffman I'm pretty sure somebody already posted that

Simon

@LucasKauffman Looks like the kind of hugs you get after you told a girl you love her and she friendzoned you.

Adnan

16:03

Mar 13 at 17:41, by Scott Pack

Passion Natural Water-Based Lubricant - 55 Gallon

Passion Lubes

What are you going to do with all this lube?! Wrestling match? Biggest adult party ever? If you are looking for a simply jaw-dropping amount of lube, Passion Natural Water-Based Lubricant is ready to get the fun started with this 55 gallon drum! With its superb formula you will have a natural feel that keeps you moist longer and also works great with all toy materials. Easily washes away with warm water and mild soap. You may never run out of lube again! Size: 55 gallons. Note: Includes pump. Ships via freight due to weight limit.

Terry Chia

My Amazon recommendations is seriously screwed since I started hanging around here.

3

Adnan

Oh, also this

Oct 22 at 23:50, by tylerl

Passion Natural Water-Based Lubricant - 55 Gallon

Passion Lubes

What are you going to do with all this lube?! Wrestling match? Biggest adult party ever? If you are looking for a simply jaw-dropping amount of lube, Passion Natural Water-Based Lubricant is ready to get the fun started with this 55 gallon drum! With its superb formula you will have a natural feel that keeps you moist longer and also works great with all toy materials. Easily washes away with warm water and mild soap. You may never run out of lube again! Size: 55 gallons. Note: Includes pump. Ships via freight due to weight limit.

TildalWave

you're stacking your lube rocket?

Ladadadada

@Adnan That link gets posted about twice a week in the Comms Room.

It's appropriate for so many situations.

quazgar

@Adnan Hi @Adnan, care to elaborate?

Adnan

16:05

@Ladadadada I don't expect anything less.

kalina

@ScottPack it's the scheduled event spam

joining the channel signs you up for it

TildalWave

We should really have an option to change our vote to close reason on revisions

so many that go from "Unclear" to "We don't care"

Terry Chia

I suggest we have a "Pizza Party" event in The DMZ hourly.

Scott Pack

@kalina Excellent. Maybe I should add more events.

kalina

heh

Scott Pack

16:07

@TerryChia Also, all amazon links in chat get some kind of subscriber or affiliate code for StackOverflow added to them. Consider what that looks like.

Adnan

@quazgar The way I see it is by bruteforce. You'd have start with the an ASCII image that looks similar to the key you're trying to replace, then start bruteforcing your way until you find the key corresponding to that image. Honestly, I see nothing interesting or new here.

Simon

@ScottPack Oh please do it! I want an event where I can freely admire you and let you know how awesome you are without receiving any negative comments from others.

kalina

I haven't made a negative comment, even jokingly, about any of you for 24 hours

Adnan

@quazgar I'm not saying the question is bad, I'm just saying it's uninteresting.

Simon

@kalina "without receiving any negative comments from other s

Adnan

16:09

@quazgar I wouldn't downvote it or vote to close it, but at the same time I would upvote it or think about writing an answer.

kalina

@Simon +"

Simon

@kalina + le fu-

quazgar

@Adnan Well I was wondering more if there could be estimates how large the space of distiguishable images is, compared to the space of fingerptints

mapping to an image certainly seems more attractive and easier to remember than similar approaches, such as PGP's word list, but maybe that's just my intuition

Adnan

@quazgar That very very subjective. I'm very good at recognizing small differences, my gf isn't.

Give me the two visual hashes with one 0 changed to o and I'll tell them apart.

Simon

@Adnan So, we can't find your wiener?

Lucas Kauffman

16:13

@kalina you remind me a lot of my ex girlfriend for some reason

Adnan

@quazgar But, maybe, I won't recognize if you change ( to )

kalina

strangely enough, I seem to remind everybody in here of their ex-girlfriend

Simon

@kalina Yes, because our exs were awful.

quazgar

@Adnan Interesting differences :-)

Lucas Kauffman

Yea it's a bit like, I'll try to be friends, but it will probably just not work out

kalina

16:15

there's no sexual history between us, all of the problems are caused by your assumptions

Scott Pack

@kalina You're not ignorant or crazy enough. Sorry.

Adnan

@quazgar The key thing to keep in mind here is this: The more tolerance you have -> The smaller your search space is.

kalina

I am not ignorant and I'm not crazy enough?

interesting

Lucas Kauffman

@kalina no but your behavior reminds me of the tension I had with her afterwards (we frequented the same irc channels)

kalina

tension you say

Adnan

16:18

@quazgar It's actually quite intuitive, and I think you already figured it out. If there are 100000 visually similar fingerprints to the one you're trying to find, that will cut down your search space. But, your search space is usually 10000000000000000 (I just kept pressing zero, you get the point), I don't see how big of a difference that will make.

Lucas Kauffman

@kalina yes, what's wrong with that?

Adnan

@LucasKauffman That's your problem. Never date someone who frequents IRC channels.

kalina

interesting

Lucas Kauffman

@Adnan exactly I almost made that mistake a second time

but then I was like FUCK THAT SHIT

Adnan

@LucasKauffman Good man Lucas.

Scott Pack

16:20

@LucasKauffman You must be German.

Lucas Kauffman

@ScottPack she wasn't polish

Adnan

@LucasKauffman Were you so close to march into her land with your tanks?

@Simon You remind me of all my exes

Simon

@Adnan ughey

Adnan

All one of them

Lucas Kauffman

@Adnan I don't do blitzkrieg, it takes a long time.

Adnan

16:25

Who am I kidding? All zero of them :(

@LucasKauffman I usually blitzkrieg in the right amount of time. The problem is when ever I blitzkrieg, it gets so messy.

Lucas Kauffman

@Adnan Sex is like a competition, if you want to have an orgasm you need to win!

Adnan

@LucasKauffman What?!

We need @Terry to explain this to us

@LucasKauffman But, seriously, what does that mean?

Lucas Kauffman

@Adnan that you need to be the first, because there is no second place.

meaning second place does not get an orgasm

Adnan

@LucasKauffman So it's a race and a competition and it's not about having fun and enjoying each others?

Well, I've been doing it wrong all these years!

Lucas Kauffman

@Adnan exactly

AJ Henderson

16:31

@TerryChia oddly, mine don't seem to have changed much

Scott Pack

This conversation sure took a turn for the awkward.

AJ Henderson

@kalina then clearly you aren't doing it right ;)

@kalina you don't remind me of an ex-girlfriend, but I have no ex-girlfriends

Adnan

@AJHenderson Well done, sir. Well done.

AJ Henderson

@Adnan what if they are an IRCop?

Adnan

@AJHenderson At this point, it doesn't matter.

AJ Henderson

16:37

@Adnan they were dudes?

@Adnan true

Adnan

@AJHenderson They were tiny and hairy.

Bad memories.

AJ Henderson

@LucasKauffman yes, but if you win too often you stop having races

and races aren't very fun by yourself

unless you have :12024953

ok, that didn't work

Adnan

@AJHenderson Hehehehe

AJ Henderson

how do you do a quote

I've never figured that out on here

Adnan

@AJHenderson You can copy the link.

AJ Henderson

16:42

ah

Adnan

30 secs ago, by AJ Henderson

I've never figured that out on here

@AJHenderson Or use > Quote

AJ Henderson

I see chat.stackexchange.com/transcript/message/12026213#12026213

ok, that didn't work either

Adnan

@AJHenderson It must be in a message on its own

AJ Henderson

ah

42 secs ago, by Adnan

@AJHenderson You can copy the link.

Adnan

@AJHenderson Sweet!

AJ Henderson

16:53

@Adnan oh yeah, and that isn't a result of having no girlfriends, I just was really picky and knew exactly what I was looking for and got lucky with the first one.

Simon

17:14

I miss @ScottPack

Scott Pack

I'm about to go downstairs and eat lunch.

Simon

NOOOOOOOOOOOOOO

Iszi

17:33

@Simon Whassamatter with you? Is @ScottPack's lunch your friend or something? Or is that his nickname for your mom?

Simon

@Iszi I remember saying stuff like this when I was jealous about something too.

Iszi

I'm wholeheartedly in agreement that this isn't a great question for our site, but since when is "Homework and easily googleable" a valid close reason?

0

Q: EKE and SSH protocol

Encrypted key exchange (EKE) protocol and the SSH protocol encrypt passwords using asymmetric encryption algorithms. However, there is an difference between them. What is the difference?

protocols

Also "The OP has not provided enough information to answer this question." is not a valid "off-topic" close reason. It's an excuse to close it as "unclear what you are asking".

Simon

Grumpy grump of the grumping grumper.

Brandon Kreisel

hey, O don

Iszi

0

Q: What is the attacker trying to do? (maybe just spam my form)

I have a PHP-included form that tells me the URL the customer was visiting when they fill it out. The content of the message was either jibberish or poorly handled by the form. (it looked mostly like this: Ð£Ñ‚Ñ€Ð¾Ð¼ ÑÐ...) The URL that was reported was URL encoded, I had to decode it twice and t...

http spam

Brandon Kreisel

17:38

hey, I don't know if this is off topic but does anyone know where to acquire the 38 million adobe leaked password list?

for analysis

Iszi

Google will help. Most likely you'll end up on pastebin if it's anywhere public.

Simon

^

@Iszi Do you laugh sometimes?

Adnan

@BrandonKreisel internode.dl.sourceforge.net/project/…

Or u1398024.letitbit.net/download/…

Or mega.co.nz/…

Take your pick!

@BrandonKreisel Next time, try Twitter twitter.com/search?q=users.tar.gz&src=typd&f=realtime

Much more useful than Google search.

Brandon Kreisel

17:55

thanks @Adnan, I really appreciate it

Scott Pack

Mm...sweet&sour chicken with fried rice followed up by a nice chicken soup with kale, carrots, sweet potato, and quinoa.

Xander

@ScottPack That sounds better than my chicken nuggets.

Iszi

@Simon In general, or at anything in particular?

Simon

@Iszi In general. Do you even smile?

Iszi

@Simon On rare occasion.

Simon

18:08

I can't tell if you're playing with me or not.

Scott Pack

@Xander Leftovers. Both of them were yummy.

Simon

@ScottPack When you met @Iszi, do you remember if he smiled or laughed at least once?

Xander

@ScottPack Very nice. We moved into a new house last weekend, but due to the fact that my Internet tubes haven't been installed yet, my office is still in the old house for a couple of days. So, I'm left to forage from the remnants left in the freezer here.

Scott Pack

@Simon Vague memory of such, though the laughter may have been sardonic. That was a long while ago.

@Xander Too bad. Also, congratulations on the move.

Simon

@ScottPack I feel like I'd be scared of him if I'd meet him.

Xander

18:13

@ScottPack Thank you. I hate moving more than anything short of death by fire. I'm happy the worse is over, but I'll really be glad when it's finished and we're settled.

Scott Pack

I cannot begin to explain how I sympathize.

Simon

@Xander Congratulations on 1k first post reviews!

Xander

@Simon Thanks! It was a haul to get here. Now I'm just waiting for the site to give me my new shiny.

At which point, I'll be the only user on Sec.SE with a steward badge.

Scott Pack

We moved in on July 31st and am still trying to find places to put things. Only began hanging up pictures last week.

Xander

@ScottPack LOL. My wife was hanging pictures on day two. That woman can't stand to be without her art.

Scott Pack

18:19

We were too busy trying to put in furniture and such.

Lucas Kauffman

@CodesInChaos do you know if traditional unix crypt which uses 25 iterations of DES is considered secure for password encryption?

Simon

@ScottPack I hope you know that I'm expecting a picture of you for Christmas.

Xander

@ScottPack Understandable. We had to buy a few new pieces, and we're in a holding pattern there, because I'm not sure exactly what we're going to do with some of our current stuff until we see what the situation looks like with the new stuff in place.

Scott Pack

Quite.

Xander

@ScottPack It's all such a massive hassle. I'm yearning to be set and settled again. A couple of months, and we'll be there.

Lucas Kauffman

18:23

does anyone else know if Unix crypt is secure?

Xander

@LucasKauffman Looks like "No." en.wikipedia.org/wiki/Crypt_(Unix)

CodesInChaos

25 iterations of DES sounds far too cheap

@Xander I think that's a different "crypt"

Xander

@CodesInChaos In that case, I have no idea. :-)

Simon

@CodesInChaos Are you in a better mood today?

Iszi

Anyone here really good with Spybot?

1

Q: Is there a way to disable specific Spybot Immunization rules?

I've been having problems using a desktop sharing application, which I've traced to the Immunization protections applied via Spybot S&D. Specifically, the problem has been narrowed down to the rules in the \SOFTWARE (Plugins) categories under the Internet Explorer groups. Once I disable these Imm...

windows-7 spybot-sd

Simon

18:36

@Iszi -1

CodesInChaos

@LucasKauffman truncates passwords to 8 bytes, ASCII only, 12 bit salts and only 25 iterations of a hardware friendly cipher. What's there not to love.

Lucas Kauffman

@CodesInChaos Any ideas on benchmarks?

CodesInChaos

I'd expect bitsliced password crackers to be pretty fast

David Freitag

Ugh. The Grub2 multiboot specification is giving me a brain ache.

Lucas Kauffman

@CodesInChaos days, hours or minutes :P?

CodesInChaos

18:45

as usual that depends on the password quality. You could throw hashcatocl-lite at it and benchmark yourself

Iszi

So, I tried using Process Monitor to check out the registry changes and... well, damn that was noisy.

David Freitag

19:01

@Iszi noisy?

Simon

@DavidFreitag He's just trying to make me call him grumpy again.

Iszi

@DavidFreitag It's really not simple to sort out the meaningful data from the flood of output.

Lucas Kauffman

@RoryAlsop got a bottle of Highland Park and a bottle of Taketsuru (they were out of Springbank :( )

CodesInChaos

Filtering by source process usually trims it down quite a bit

Iszi

@CodesInChaos Yeah, done. But the hard bit is that there's 900 actions being taken, each having several Registry operations, and none of the registry keys have human-friendly names.

Simon

19:08

Doesn't belong to us, right? security.stackexchange.com/questions/44991/…

David Freitag

@Iszi Ah.

Simon

19:29

@Xander You just ruined your 1k.

Xander

@Simon But 1001 is so pretty...And...Symmetrical.

Simon

True.

Xander

@Simon Plus, now we each have 8 reviews on the day. So it's (temporarily, at least) all nice and even.

Simon

That too.

Xander

Yay! security.stackexchange.com/help/badges/103/steward Shiny. :-)

Scott Pack

19:41

Boo.

Simon

le shiny shines

Iszi

Anyone else trying to figure out the XKCD?

explainxkcd.com/wiki/index.php?title=1286

Looks like 38a7c9279cadeb44, 9dca1d79d4dec6d5, and a8ae5754a2b7af7a are the only blocks left to solve.

Simon

@ScottPack Thanks for breaking the symmetry. I don't like you anymore.

CodesInChaos

I suck at crosswords

Xander

@ScottPack :-P

Scott Pack

19:54

We just need to wait for 7 more

Simon

Should I bother to watch Project X?

@ScottPack What about now?

Transcript for