@Iszi well for mom's post /r/gonewild/ would be the ultimate embarrassment for the teenage boy set on reddit I'd imagine... but /r/nsfw/ wouldn't be good either..
@LucasKauffman ah ah I never said I'd been.. There's loads of bits of reddit that I know of and have never been to /r/spacedicks/ for one. I don't even know what that's going to be but enough people refer to it in other subreddits , I know not to go there :)
@RоryMcCune Kinda like I practically know nothing about Reddit, but I'm not even going to look to see if /r/goatse or /r/tubgirl/ or /r/2girls1cup actually exist.
@Adnan ahh I've seen it suggested that they're doing this as some of them are actually professionals and use the site to drive traffic to cam sites and the like...
@Iszi It has been reported that Kim Basinger, in her early days of acting, posed for a series of Playboy photos precisely in order to boost her career -- and it worked.
Sean Connery (not yet Sir Sean Connery at that time) noticed her and gave her the lead role in Never say never again.
@Adnan No i already had it pinned to the taskbar. All you need to do then is right click the task bar, then right click the program that is to be opened. The taskbar is really just a folder with .ink's in it anyway. From there i set the shortcut in the ink and voila
@DavidFreitag However, it is an "open once". If you type Ctrl+Alt+T again, you don't obtain a new terminal ; but you get the focus back to that terminal.
@DavidFreitag I am using the terminal to run command-line tools, mostly the command-line C# or VB.NET compilers, and the crypto-related tools I write.
I am not allowed to install external software on that machine, but I am allowed to write code and compile it, which means that the sysadmins here have not really understood where the danger lies.
@Adnan There is a setting in the DC that allows certain users to install software. Basically on vista+ it pops up UAC asking for admin privs to install anything.
@DavidFreitag I cannot abide the way VS autocompletes things and spawns zillions of popup boxes just right above or under the line I am typing in, obscuring what I am looking at.
@Adnan Actually that's the trick. I am not allowed to install software. But I can use a USB stick, and nothing forbids me to run software from that USB stick.
@Adnan They have it set to reset everything to the settings they setup even the hard drive. That means that when the 10 minute inactivity timer goes off and you get logged out, anything you were working on is now completely gone.
I'm trying to figure out on how I would generate SSL public and private keys on the fly, in such a way that the client can trust it. And also, I have no control over the server, and it's not even guaranteed that it will have any Internet connection. Exactly how that server is going generate SSL public and private keys, and have it be sent to the client and stored in its keychain as a trusted certificate, I have no clue.
Bear in mind that the server (as in the physical device) will have a screen on it that can display texts to the user. Maybe that can be a way to temporarily identify the se…
@SalehenRahman Not enough information to help you, sorry.
@SalehenRahman My initial thought, however, is to get the client to trust you as a CA, and then you, as a CA (yaaay) can sign the keys public keys whenever you generate them. That way, you guarantee that the client will always trust them (and, more importantly, that they're actually trustworthy).
I assumed that you'll generate many keys while communicate with the client (I have no idea why you'd want to do that).
No just one key for the server. But that server, when booted up for the first time will create a public and private key pair forever, at least that's what I had in mind.
The issue is, how to ensure that when the client connects with the server (and it will always do so wireless), that it can indeed verify that it's talking to the server?
What is it?
The XY problem is asking about your attempted solution rather than your actual problem.
That is, you are trying to solve problem X, and you think solution Y would work, but instead of asking about X when you run into trouble, you ask about Y.
The Problem
This can lead to frustrati...
I'm working on a hub for homes. It will most definitely be reading energy use data, but it can also turn lights on and off. That hub will be redistributed to many homes, and hence, why I believe that I, the developer, will never have any control over it (but I might be wrong about that).
That hub doesn't have that many inputs, other than ethernet, bluetooth, and USB, and a few buttons. Even though it has an ethernet port, it is not guaranteed that it will have Internet, and so I'm not ruling out that possibility. But regardless, a typical use case would be that a mobile device will be talk…
I forgot to mention, the hub also has an 16x2 ASCII LCD screen on it. Maybe I can display some sort of a secret, similar to how two-factor authentication (TFA) works. But unlike TFA, nothing will be sent, but merely displayed.
@SalehenRahman SSL trust is based on the hostname which you use to access the device. The chances of a consumer getting a signed cert for their own device is minimal (nonexistent), so you'll probably just have to live with self-signed certificates. You get a browser warning because teh identity of the destination can't be verified, but the connection is encrypted anyway
@Adnan: yes it's a smart phone with a hub-controlling application.
@tyler: since you put it that way, is there anything wrong with taking the server's public key and then adding it to the mobile device's keychain? I'm thinking on doing that after the first time the mobile device connects with the server. The first time the mobile device tries to connect, there might be a warning, and the user will simply have to say "I trust this source" only once, and it's now trusting the source forever.
@SalehenRahman When the user is setting up their device/hub, ask them to point their mobile's camera to the hub (showing the screen). On the screen you'll show the SHA-1 fingerprint of the key, and your application will easily OCR it. On the first connection, you verify the fingerprint of the key received vs. the one scanned from the LCD.
@tylerl @Adnan: Either the screen approach or the different keys per device approach. The former kills two birds with one stone: you uniquely identify the hub while authenticating it at the same time. The latter is much easier for the user; they just connect. Decisions, decisions.
Any thoughts on the former, before I flip a coin and decide?
If you can go with the PKI solution, then go with it. That's the best one
I suggested the screen thing because you didn't reply to my PKI suggestion. I assumed it doesn't apply to your case. However, now that you fully explained your situation, I can see that signed keys is the way to go.
@tylerl everything is exceptionally speedy until outside my house (I used to be a network engineer so have reasonable kit here) - talktalk are just pretty rubbish. And I have no alternative provider (the copper is owned by BT, who actually tell me I can't get the speeds that I occasionally get with talktalk)
So anyways, about SSL/TLS: I need help with 1) setting up a root certificate, and 2) signing certificates based on the root certificate.
I would imagine generating and self-signing private and public keys for the root will be pretty identical to the one explained by the [Node.js TLS documentation](http://nodejs.org/api/tls.html#tls_tls_ssl).
But what about when it comes to signing *other* SSL certificates? What command do I run, then?
I'm sorry for the "email me the codez please!" type question, but I haven't worked with openssl much.
Customer: Hey, can you change our registrar too? Me: Like, for you company's domain name? Customer: Yeah, we are **done** with GoDaddy Me: Um, Sure. Customer: That guy kills elephants, man. Me: Elephants? Customer: Yeah, dude. It's some crazy shit man.
@SalehenRahman i post unusual work-related things here all the time
The plot thickens:
Customer: Yeah, one of the reasons we want to switch away from Godaddy is because if they get a subpoena they'll turn over your data Me: Everyone will do that Customer: Wait, everyone? Me: Unless that want to go to jail for you. And you don't mean quite that much to them Customer: Oh.... I'll call you back.
Is it better to hash passwords on the server, or is it better to get a "verifier" from the client (e.g. via SRP)? And this is assuming that it will only ever be a android application talking to the server, and not a web app.
Better question: should I stick to the old hash(password) (assuming that function call auto-generates a salt) to store passwords, or should I move to SRP?
> I, for one, completely cyberagree with you. However, as a cybermod here on cyber.security.se, have to cyberpoint out that this isn't really a cyberquestion, and doesnt even really fit on cybermeta. That cybersaid, I can completely cyberfeel your cyberpain - I am cyberassuming this is the cyberresult of cyberstration from silly cyberreports. Then again, that is one of the ENTERPRISE RISKS from cyberworking at a BigCyber4... Consider this cyberflagged. – AviD♦
What is it?
The XY problem is asking about your attempted solution rather than your actual problem.
That is, you are trying to solve problem X, and you think solution Y would work, but instead of asking about X when you run into trouble, you ask about Y.
The Problem
This can lead to frustrati...
