The DMZ

Rory Alsop

15:00

@AviD ping

AviD

dammit, saw that coming.

Rory Alsop

:-)

Adnan

@AviD Hey, Avi.. hey hey.. AVI!!!

AviD

@Adnan yeah, that too.

Xander

@FEichinger Yes, there was that whole "Imperialism" thing. That was a bit racist.

Hey @Avid, you off the phone yet?

AviD

15:05

actually yes.

Xander

@AviD Boo.

Simon

Why didn't I yolo when he was on the phone?

AviD

@Xander heh. Ping away.

Rory Alsop

@Simon I don't know

Simon

He would have been like "Sir, please hang on, I must do something important".

Rory Alsop

15:05

@Simon I reckon he can do it with one hand

6

Simon

@RoryAlsop Oh lawd.

Rory Alsop

He'd probably tell the client, "Need to kick Simon - you understand"

5

Xander

@AviD That was a short call. They must not like you very much.

Simon

@RoryAlsop I'm sure his client knows who I am by now.

AviD

@RoryAlsop yeah, I dont use "sir". Unless I'm being ironic.

kalina

15:06

@AviD no

AviD

@Xander true. postponed till later.

this time I wont tell you.

FEichinger

@Xander Hey, now, we helped a lot of countries develop infrastructure and shit!

And we mostly left peacefully when they no longer liked us.

AviD

@FEichinger Oh didja now? Tell us all about it.

Simon

@FEichinger Please. Us, Americans, destroy infrastructure and shit. That's way more badass.

FEichinger

@AviD I did say mostly.

kalina

15:08

@FEichinger yeah, tell me about it.

Simon

Did I ever tell you guys that my last name means "From Scotland"? I must have some French Scottish blood.

FEichinger

Also, I'm home.

AviD

@Simon you must be really attractive and reliable.

kalina

@FEichinger how'd your exam go

Simon

@AviD You just described some of my virtues.

FEichinger

15:10

@kalina I'm ... uhh ... sorry for what they do to you?

@kalina Meh. Should be enough to pass.

AviD

@Simon It wasn't a compliment.

Rory Alsop

@Simon what is it?

Simon

@FEichinger Sociology exam? You're not gonna pass.

@RoryAlsop Hey, I'm following you on Twitter, go find it out!

FEichinger

@Simon Could you talk less out of your ass, please. It's starting to smell around here.

AviD

@FEichinger Rejected. Come back with an Ace Ventura reference.

Simon

15:11

@AviD lulz

Rory Alsop

@Simon that means opening twitter...

back shortly

Simon

lawl

FEichinger

@AviD ...

Adnan

►

@Simon That's for you

Or, actually, even @killana

Simon

@Adnan Aaaww, thanks <3

AJ Henderson

15:16

@Simon wait, you're in french canada?

Rory Alsop

@Simon totally failed to find you. Why doen't twitter let you scroll through followers alphabetically?

FEichinger

@RoryAlsop Because you're not supposed to know your followers, just the amount of them.

Rory Alsop

Ahhhh - now I have found you

Simon

@AJHenderson Ya, I'm in Montreal.

Xander

@RoryAlsop Because Twitter was written by morons.

Rory Alsop

15:18

yup

AJ Henderson

@Simon it makes so much more sense now

Rory Alsop

@Xander and I haven't learned how to use it properly

Simon

@AJHenderson Does it?

FEichinger

Twitter is not intended to be a social network, but a microblogging/broadcasting system. As such, people relations are irrelevant to twitter.

There's a reason why DMs and @-replies took a while to get properly supported.

AJ Henderson

and even more terrifying, Simon is only a little over 3 hours away from me

Simon

15:20

@ton.yeung That's how you pronounce it, yes.

Rоry McCune

@RoryAlsop I usually go to followers scroll to get them to fill in then CTRL-F after that found Simon...

AJ Henderson

@Xander what do you expect, they couldn't even figure out how to send a message longer than 140 characters

Simon

@ton.yeung I played the first 3 I think.

Rory Alsop

@RоryMcCune even on a mobile?

kalina

I have never even played an assassin's creed game before

Xander

15:21

@FEichinger "Twitter is not intended to be a social network, but a microblogging/broadcasting system, and was written by morons." // Fixed it for you.

Rory Alsop

I don't have twitter on desktop. I might have tweetdeck on one, somewhere, maybe

Simon

@ton.yeung I don't even remember that, did he really say that?

Rory Alsop

@kalina All I know is there's a hoodie abusing his ASBO

FEichinger

@RoryAlsop Chances are, that version of tweetdeck no longer has API access.

Simon

Of course it would make sense because Ubisoft Montreal made the game but still, that's the lulz.

Rоry McCune

15:21

@RoryAlsop ahh mobile <barf>

FEichinger

@Xander Twitter is actually pretty well-written for its original purpose. The years of "extending" it have taken their toll in almost every direction.

Simon

@ton.yeung Ahh, nice.

AJ Henderson

but yeah, simon is like directly on top of me

3

errr... that came out wrong

FEichinger

@AJHenderson You knew exactly what you were doing.

Simon

@ton.yeung Yes of course.

AJ Henderson

15:24

@FEichinger the beer clouded my judgement

Simon

AJ, don't say more stuff like that please.

kalina

@RoryAlsop asbos are bullshit anyway

Simon

@ton.yeung Amazing scene.

Haha.

AJ Henderson

seriously though, Simon is due north of me. He practically lives down the street...

thankfully a very, VERY long way down the street

Simon

Is there a specific time I should go to? 12 mins implies a lot of yoloing.

@ton.yeung Nein. Ok I'll go there.

FEichinger

15:26

@ton.yeung ?t=2m39s

Xander

@FEichinger That may well be true, but it's more fun to abuse them for anything I don't like instead.

Simon

His accent is awful, actually.

AviD

@Simon of course it's awful, it's a French accent.

Simon

You donuts.

AviD

oo donuts.

FEichinger

15:27

@Simon It's an American pretending to be an Italian pretending to be French.

Simon

@FEichinger Oh boy.

AviD

it was probably secretly outsourced to the Indians.

Rory Alsop

@kalina you say that like someone who has had one?

Kisunminttu

@Adnan I hope they are helping... If not, you should try Mobilat ;D

Rоry McCune

15:43

"x is a genderqueer gray-asexual panromantic polyamorous person" that's not one I've seen before

AviD

@RоryMcCune I think I know her/him/it!

Rоry McCune

@AviD takingsenseaway.wordpress.com/2014/04/27/… is where I saw the ref.

AviD

@RоryMcCune I dont know what is more notable about that blogger, that she/he/it is Israeli, or that the blog is on LiveJournal.

Rоry McCune

@AviD who knew livejournal was still a thing!

AviD

@RоryMcCune inorite?

nealmcb

15:49

Hey gang!

You're still at it!

AviD

Whoa.

@nealmcb welcome back!!

nealmcb

My latest discovery prompted a question:

AviD

how was your sabbatical?

nealmcb

0

Q: How to help users manage password portfolios based on risks of compromise?

A framework for modeling password management risks and costs, and the beginnings of a good strategy for users to help them manage passwords for their often large portfolios of accounts is outlined in the paper Password Portfolios and the Finite-Effort User: Sustainably Managing Large Numbers of A...

@AviD It continues.... But when I find a fun topic for this place, I love to dig back in....

AviD

:-)

kalina

15:52

@RoryAlsop no but I have had a section 59

wheelspinning in the rain

AviD

@nealmcb very interesting. It seems intuitively correct, but nice to see some research on that - will be digging in to it later.

not sure how easy it is to explain though, as we all know "users" are horrible at making good risk decisions.

Simon

@AviD I do it well.

AviD

doesnt seem so.

hehe, how many mods kicked you all at once??

Simon

Am I supposed to know the answer?

Terry Chia

We should get SE to publish statistics on "most kicked from a chatroom".

AviD

15:57

> “There is an anomaly in my pants”

LOL

Rоry McCune

@AviD indeed

Ya know IT development has to be the only place you can google "vagrant sprinkle" and have it be entirely non-dodgy

AviD

"They were totally respectful and non-creepy" thats a first for the TSA

Rory Alsop

@kalina that's not like a rule 34 is it :-)

@nealmcb hello stranger. I keep seeing your name elsewhere, but not here :-)

nealmcb

@AviD Yeah - I don't claim it's easy. But I'm glad to finally see research and articles on passwords that recognize human limitations in this world of so many accounts. Take-away for site developers: don't force yet another account and password on your poor users - you'll both be screwed. Use single-sign on via a choice of g+, facebook, etc.

AviD

@nealmcb oh, definitely. and definitely. And definitely :-)

nealmcb

16:00

@RoryAlsop Where else?

AviD

and, if you do need your own set of accounts for whatever reason, support your users' choice of usability.

Rоry McCune

@nealmcb the challenge I've seen with companies using 3rd party services in that way is that most of their customers will have signed up for several of them and won't be able to remember which one they used on a specific occasion. I know that's the problem I've had.

AviD

again, that correcthorse xkcd question focused mainly on the usability, even more than the entropy issues.

Rory Alsop

@nealmcb there was somewhere looking at voting and vote fraud

FEichinger

@RоryMcCune It's also the source of a lot of duplicate SE accounts.

nealmcb

16:03

@RоryMcCune Yeah - been there done that. I guess they will want some way to push a notice out for a given account to clarify which sso option was used. Hmm - is that easy for some ssos?

Rоry McCune

@nealmcb @FEichinger so one usuability enhancement here (although it comes with a security tradeoff) would be to allow a user to enter an identifier and then tell them if an account exists under any of the systems with that identifier. .. Not perfect as there isn't a unified identifier and obv. allows for username enumeration..

FEichinger

Then the user has to remember something again.

nealmcb

@RоryMcCune I guess many of the sso systems allow the user to go the other way - enumerate the relying-party sites that rely on the sso for the current user. I don't recall any help pages about that on relying-party sites though.

FEichinger

As much as I hate to say it, KeePass or similar is the way to go. We will never, and should never, have a centralized way of authentication. Be that by something the user carries over between multiple SSO providers, or be that by having only one SSO provider (which is still the biggest criticism against openID: Everyone is a fucking openID provider) ... It just won't work in the long run.

Rоry McCune

@FEichinger well if so I guess that facebook and gmail use email address as an identifier and twitter stores it , so theoretically the site could store the e-mail address against the account and then tell the user the user to input their e-mail address at which point it could tell them what they'd registered with...

FEichinger

16:11

@RоryMcCune Google also provides the user with an email address. Which may not necessarily be the one the user wants or primarily uses.

Rоry McCune

@nealmcb indeed tricky to make it run in reverse and asking users to check the options would be painful.

FEichinger

I thought about using email for identification, too. But, again, gmail.

Terry Chia

@FEichinger Gmail. It's my default option whenever it is available.

I'm screwed if my Gmail account got hacked anyway.

Rоry McCune

@FEichinger yeah edge case peeps with multiple e-mail addresses (I have 10+) are tricky for this kind of thing, but I'd guess that 90+% of people only have one...

FEichinger

@TerryChia Heck, I also use Gmail across everything. My point is, though, that we can't expect every single user to use Gmail. And we shouldn't.

Rоry McCune

16:12

@TerryChia 2FA on gmail FTW

nealmcb

@FEichinger Well, one point of the article is that even keepass is overkill for the vast majority of passwords I have. Users have to learn to tune out the many sites that really only want the user to have a password so that the site's content is harder to copy.

Terry Chia

@FEichinger Oh yeah, there should definitely be a local fallback.

FEichinger

@RоryMcCune Considering that I've seen people still using hotmail ...

Simon

hotmail 4 lyf3

AviD

@RоryMcCune only have one.... that they know of.

Rоry McCune

16:13

@FEichinger well outlook.com is actually pretty good these days :)

Terry Chia

@RоryMcCune Indeed. Plus Google is really the last party in the world I'd expect to be compromised.

FEichinger

@Simon Fine, you did it. You're back on my ignore list. I'm tired of this crap.

Simon

LOL

nealmcb

and keepass is a single point of vulnerability that can't be used as easily from multiple devices

Terry Chia

@nealmcb Why not? I'm using it across 3 devices.

AviD

16:13

@FEichinger still? or already again?

Rоry McCune

@nealmcb yep password managers as point of attack are nasty, so I go for a less used offline one :) less usuability but likely safer...

FEichinger

@AviD I don't think Microsoft issues new hotmail addresses anymore.

Rоry McCune

@TerryChia compromise at their end would likely be for much higher value targets than me :)

FEichinger

They use @live.* now, I believe.

AviD

@FEichinger hmm, oh right they're all outlook.com now.

still the same thing.

@FEichinger or that.

Terry Chia

16:14

@RоryMcCune Exactly.

Rоry McCune

@FEichinger it's @outlook.com now, live as a brand is deprecated

Terry Chia

If I have to trust anyone to secure their systems, it would be Google.

FEichinger

@AviD Yes, the same thing. But I've actually seen a living @hotmail.com address the other week.

@RоryMcCune See, I'm not even keeping up with that anymore!

Terry Chia

@FEichinger I still have a @hotmail.com in active use.

I use it for all the social media crap.

AviD

@FEichinger oooo reeeeelllyyyyy

Rоry McCune

16:15

@TerryChia or Microsoft. Think what would happen if Microsoft update got compromised....

Simon

@TerryChia Just like a shiton of people.

AviD

I'm looking at one right now.

newb.

Terry Chia

@RоryMcCune Yep.

Actually a Google compromise is just as bad for Chrome users.

AviD

@TerryChia its actually my main account.

Simon

@RоryMcCune Oh, it didn't? So, these constant reboot requests are for real? God damn.

Terry Chia

16:16

They are using its auto update mechanism for a lot of cool stuff.

FEichinger

@AviD ... How's your AOL coming along?

Rоry McCune

@Simon 'fraid so

AviD

@FEichinger thats backwards.

hotmail/outlook.com is like gmail 10 years ago.

FEichinger

Either way, what I was going for is that I'd say a lot of people have at least two email addresses nowadays.

AviD

I mean, in popularity.

FEichinger

16:17

Which would mean identifying based on email address is not going to suffice.

Rоry McCune

@AviD a decent e-mail service?

Terry Chia

I'm most definitely not a MS fan but I have to admit the new outlook.com is actually pretty damn good.

AviD

@RоryMcCune something to be sought after.

for hipsters.

Rоry McCune

@AviD outlook.com is for hipsters... damn I'd best tell @marionmccune

AviD

@TerryChia p.s. the account management is just as good as google's, likely better.

Terry Chia

16:18

If only they can get the 365 and normal thing sorted out properly.

AviD

(with the exception of the stupid paswsords restriction.)

Terry Chia

@AviD Oh, no arguments there.

Now, if anyone is actually still using a @yahoo.com that's a sin.

AviD

@TerryChia oh those just suck.

but then they sucked even back when it was considered mildly popular.

Terry Chia

@AviD Yup.

Simon

ITT: People thinking their opinion is the ultimate one.

nealmcb

16:21

@TerryChia Setting up keepass sync is another part of the "effort" that users have to factor in. And presumably that implies vulnerability to a server attack, in addition to the local client attack.

Terry Chia

@nealmcb Presumably any user that cares enough to use a password manager won't find that to be a problem.

The DB should be encrypted with your password anyway.

nealmcb

@TerryChia Sophisticated users are a different use case. What do we recommend to the masses?

AviD

@TerryChia passphrase

@nealmcb give up.

Terry Chia

^

Seriously, the masses just do not care.

That's the main problem.

AviD

or better yet, marry one of the sophisticated users, and s/he will help set you up.

FEichinger

16:24

Ahyup.

Simon

Personally, I don't give a crap.

FEichinger

They won't care until it hits them.

And when it does, they'll forget in a week.

AviD

@TerryChia well, tbf part oif the reason they dont care is cuz its just too damn much bother.

Terry Chia

@AviD Even passwords are too much trouble for them. As evidenced by how popular FB login is.

FEichinger

Well, tough break.

AviD

16:25

@TerryChia Passwords suck.

FEichinger

If you make security easy, you also make attacks easy.

AviD

@FEichinger No, you have that backwards.

nealmcb

We typically all suffer when the masses get compromised. Part of the reason the masses don't care is they've been fed so much incomprehensible and overly cumbersome bullshit about security

AviD

If you make security difficult, it won't be used, and that will make the attacks even easier.

2

Terry Chia

Jul 14 at 12:25, by Terry Chia

@M'vy Yeah, I agree. Passwords are broken but it's the best we got.

AviD

16:26

> AviD's Rule of Usability: "Security at the expense of usability, comes at the expense of security".

or iow: "Unusable security won't be."

Simon

@AviD So, it is true, you can say clever stuff from times to times.

AviD

@nealmcb agreed. and again dat xkcd... passwords NEED to be easy to remember AND type.

@Simon o_O

nealmcb

@AviD and a few of them deserve to be reused a lot

AviD

@nealmcb well, depending on context, but I would more go with "could be reused" because of the risk model.

then again, in most of those cases there shouldnt even BE a password to begin with.

FEichinger

@AviD Yes, but you won't find a sufficiently (for the masses) usable solution that is also sufficiently secure.

AviD

16:29

don't make me work harder just so you have an easier job protecting your stuff.

@FEichinger oh I agree. and that's what really sucks.

3 mins ago, by Terry Chia

Jul 14 at 12:25, by Terry Chia

@M'vy Yeah, I agree. Passwords are broken but it's the best we got.

Simon

14 secs ago, by AviD

3 mins ago, by Terry Chia

Jul 14 at 12:25, by Terry Chia

@M'vy Yeah, I agree. Passwords are broken but it's the best we got.

Terry Chia

@FEichinger Crack that problem and you have a billion dollar company in your hands.

Simon

Give me 10 minutes.

I just got an idea, actually: authentication by farting.

Terry Chia

@Simon That's vulnerable to replay attacks.

Simon

Ok, I'm actually even annoying the fuck out of myself today, I might be back later.

AviD

16:34

@TerryChia meh. I could name right now a dozen companies trying to do just that. Snake oil at best.

Terry Chia

@AviD I did say "Crack that problem" didn't I? I didn't say anything about fooling idiots into believing you have.

AviD

@Simon thats actually a valid form of biometrics.

►

FEichinger

@TerryChia Yeeaah ... Or we just accept the part where it ain't happenin', yo.

kalina

@RoryAlsop ...no

Thomas Pornin

@nealmcb Oh, hello ! It's been a while.

nealmcb

16:46

@ThomasPornin Hello indeed! Glad to see you still active!

Thomas Pornin

I just got an email from some Chinese student (identified as "Miss CHEN Yongsi") who conducts a survey on "online knowledge sharing motivations and behavior" -- because I am a "top stack exchange user". Anybody else here got it ?

Tom Leek did not get the email, but this just tells me that the emails were not gathered from StackExchange themselves.

Terry Chia

@ThomasPornin @RоryMcCune and I got it as well.

Hmm, mine is actually from "Vincy Chan".

Thomas Pornin

@TerryChia The email address is "vincychan928" (at Gmail) but this appears to be some nickname. The "participant information sheet" lists the alleged real name.

Terry Chia

@ThomasPornin Ah. Yes that's the one.

Thomas Pornin

It looks legit: it does not promise me anything except work.

nealmcb

16:59

@ThomasPornin Me too. But I see no promise that the results will be published openly, or shared with participants.

AJ Henderson

-1

A: How can my .exe become infected?

Exe's are, by nature, difficult to modify. Someone could replace it with their own program, but it would be neigh impossible to change an existing one so that people downloaded malware. The only way of "changing" an exe that I know of is DLL injection, and even that doesn't precisely CHANGE the p...

:(

Scott Pack

Not washing one's hands could do that.

Nick

@AJHenderson how in the world did that user get 700 rep -.-

AJ Henderson

@Nick mostly asking questions it appears

Terry Chia

17:39

Hmm, a patch just got sent to LKML to add a getrandom syscall to Linux. That's good news.

Nick

@TerryChia wat

Terry Chia

@Nick ?

AJ Henderson

@ThomasPornin I just did too

well, actually at 11:12AM whatever Eastern time currently is

Terry Chia

> The other feature provided by this new system call is the ability to
request randomness from the /dev/urandom entropy pool, but to block
until at least 128 bits of entropy has been accumulated in the
/dev/urandom entropy pool.

That's awesome!

AJ Henderson

were you actually brave enough to try opening it in a VM? It might actually be someone legitimately trying to contact users that have e-mails listed in their profiles

it looks like they used my website's contact me form

so they appear to be doing manual effort to contact people

Transcript for