The DMZ

2:41 AM

@ScottPack RE: tweet. looking for a log management system that is better than grep.

Splunk = expensive. logstash = overhead. graylog = unknown to me. papertrail = somewhere in the middle between all of them.

tylerl

4:19 AM

@jrg perl

(duh)

WAAY better than grep

tylerl

5:20 AM

How long ago did the @Simon and donuts thing start? What was the origin of that meme?

Rоry McCune

6:14 AM

@tylerl according to search @Simon first used it in this room in November 2013

before his arrival there were only ~15 mentions of incorrectly spelled doughnuts, now there's 7 pages of the stuff!

Terry Chia

6:34 AM

Hey @jrg are you around?

Terry Chia

6:44 AM

Anyone happen to know a Ubuntu package maintainer?

Iszi

7:04 AM

It must be way too late. "Package maintainer" sounds like a euphemism for something, and I have the sudden urge to fit it into a "your mom" joke.

Tinned_Tuna

7:16 AM

@Iszi "Your mom manages my package just fine"

2

Rоry McCune

9:26 AM

@avid if you're still looking to get a oneplusone phone you could look at this dailytech.com/OnePlus+to+Open+Preorders+on+October+27/…

myself I've decided that iPhone 6 will do me :)

Terry Chia

@RоryMcCune Coming over to hipster-land are we? ;)

Adnan

My friend today started lurking around SE chat rooms. He asked my about the purpose of the stars. After several seconds of laughing, I told him that, in theory, the star wall is for people who don't lurk for a long time to find relevant important news, discussion points, and other interesting things regarding the site to which the room is related.

I felt bad for lying to the poor guy.

Rоry McCune

@TerryChia currently running a 4S.. I like iPhones, they work and do what I want them to without a lot of faff, and they get patched :)

Terry Chia

@RоryMcCune Ah, I always assumed you were using a WP8 device for some reason.

Rоry McCune

@Adnan well our top pinned result is actually vaguely infosec related...

Terry Chia

9:30 AM

@RоryMcCune Hmm, you are right. We need to get rid of it...

Rоry McCune

@TerryChia tried one out for a while. It was ok but TBH I prefer iOS. I have had an iPad since the one, so always using it anyway

also have my new iPad Air 2 on order :)

Terry Chia

@RоryMcCune Nice. :)

I'm sorely tempted by the new iMac but I hate all-in-ones.

Rоry McCune

@TerryChia delete the record of the Bears achievement.... not me !

@TerryChia yeah that's not one I'd be too interested in, although would be interested to hear how well that 5K screen works and what Graphics card they're using to drive it...

Terry Chia

@RоryMcCune It's an AMD card.

It's cheap as hell for a 5k screen though, that's why it's tempting.

Rоry McCune

@TerryChia sure, though to drive that panel at 60+fps it'll need to be quite beefy..

Terry Chia

9:33 AM

@RоryMcCune Nah, current gen GPUs can drive a 5k screen pretty well. It's the DP/HDMI cable that's the bandwidth bottleneck.

I presume Apple has non-standard hacks around that for the iMac since it's an all-in-one.

HamZa

9:45 AM

^ wooot, when I tried opening security.stackexchange.com/questions/71143/…

ManishEarth

@Lighty Don't the inbuilt FF devtools have that too?

Adnan

@HamZa Are you sure? virustotal.com/en/url/…

HamZa

@Adnan yes as it happened just now on my own computer. Note the method that was used "heuristic analysis"

Adnan

@HamZa Does it block access to other URLs from security.stackexchange.com?

HamZa

@Adnan nope, it's the first time. I guess it triggered an "alarm" because of the keyword "paypal", "email", "phone" in some way

Adnan

9:55 AM

Very interesting

Have you reported that it's a mistake?

HamZa

yes

Terry Chia

@HamZa Or maybe we are all scammers actually trying to phish you. ;)

HamZa

@TerryChia haha, I'm waiting

3

Q: Is it possible to clone an RFID/NFC card using a simple RFID reader, for future reuse and impersonation?

RFID/NFC technology is used in credit cards and many other personal identification applications. Is it possible/how easy is it to clone a card using a simple RFID reader? In other words, can the retrieved information be reused in the future by the attacker?

^ my guess is yes but I don't have any source to back it up

Adnan

10:14 AM

@HamZa 0b4af6cdc2f0c5998459-c0245c5c937c5dedcca3f1764ecc9b2f.r43.cf2.r…

TL;DR In some cases of poor implementations, it's possible. However, new crypto NFC cards cannot be cloned

HamZa

10:55 AM

@Adnan thanks

Rory Alsop

11:46 AM

@RоryMcCune the oneplus gets patched frequently. Think I have had 3 updates that looked interesting

raz

@RoryAlsop I want a 1+ :(

Rory Alsop

@raz I'm very impressed with it

battery life is awesome

It also appears to cope very well with heavy rain

raz

@RoryAlsop Was that a feature you were looking at when buying?

Rоry McCune

@RoryAlsop cool! it's good to see an Android manufacturer take that seriously, the key however is, how long will they provide patches for. With the rumoured 2+ out next year, you'd hope they'll commit to updates for the 1+ for at least 3+ years...

Rory Alsop

@raz sure. It wasn't just because it was a shiny and cheap :-)

oh, maybe

To be honest, it was battery, screen and processor that won

Rоry McCune

11:55 AM

@RoryAlsop androidvulnerabilities.org doesn't make great reading for android in general...

raz

@RоryMcCune Because iPhone has no vulnerabilities >.>

Rory Alsop

@RоryMcCune I know. I have all the android phones (Two Galaxy S4s, one S3 and two HTCs) in our house on cyanogen, and updated very frequently.

@raz different vulnerabilities

different environment

different threat model

raz

@RoryAlsop Kinda my point

Rоry McCune

@raz oh not at all, all software has vulns, it's how the vendors react that's important

the problem with Android is that fixing vulns is Google + handset manu + carrier

and their incentives to fix are not all the same

Rory Alsop

@RоryMcCune and carrier is usually the weakest link

raz

11:58 AM

Vendors generally react pretty quickly. Samsung was quite good at sending out patches.

Rоry McCune

@raz really, can you find Samsung Galaxy phone support lifecycles publicly now?

raz

@RoryAlsop Yeah the carrier's are the weakest link

Rоry McCune

last time I looked hardly any android manufacturers provided that

actually none that I found bar google but hey I might've missed one

also handet manufacturers have an incentive to push you to the new shiney and stop supporting the old less shiney as that's how they make money

raz

true

Rory Alsop

@RоryMcCune Cyanogen has sorted things pretty well now, in that you don't even need to be a techie to use it. Grab cyanogen from play store, and it updates automagically

raz

12:01 PM

But if someone is targeting my phone, then I've done something wrong in life.

Rоry McCune

@RoryAlsop ooh so they sorted the cyanogen in the play store thing cool!

@raz more worryingly as people move more of financial life to mobile devices is targeted malware that compromises phones as it provides access to browser info. plus common 2nd factor channels (e.g. SMS)

raz

@RоryMcCune I've pretty much just given up on security. If something happens, it happens. I do my best, but I'm gonna buy the phone I like.

HamZa

That's why I don't do any banking on my mobile phone. I didn't even install the banking app of my bank.

I did install Avast. Not sure if it's effective though. Just trying to make it difficult for malware authors

jrg

12:18 PM

@terry package maintainer for what?

@TerryChia any particular package?

Adnan

If any of you is into CSS stuff css-tricks.com/examples/ShapesOfCSS

Arperum

@Adnan It started slightly meh, but there are a couple pretty nice tricks.

Adnan

Yup. I especially liked the infinity and Facebook

Terry Chia

12:56 PM

@jrg Was wondering if you know anyone I can bug to get this fixed: bugs.launchpad.net/ubuntu/+source/libscrypt/+bug/1313311

Debian already has a patch out.

@RоryMcCune Are we doing the monthly rage against how Android security fixes are completely retarded?

jrg

@TerryChia I can tell you where I would start looking.

#ubuntu-hardened on freenode

I would start by raising a fuss there.

Actually...

that's in the universe repo.

let me check something

Terry Chia

@jrg Hehe. Was wondering if you know anyone on Ask Ubuntu that's a package maintainer before I do that.

The IRC rage is definitely the last resort. :)

jrg

#ubuntu-motu < ask nicely.

I will ask someone if they are still a master of the universe or not.

Terry Chia

@jrg Will do, cheers! :)

jrg

but I doubt they are.

@TerryChia and i'm idling there, so feel free to poke me if you want me to read whatever they say or chime in.

The other thing to do would be to check and see if Unicorn has that bug or not.

Terry Chia

1:05 PM

@jrg Aye, I joined the channel. I'll go take a shower before I start asking.

jrg

Because if unicorn doesn't have it, then it's a "Can you backport this fix?" type of issue, not a "can you fix this?"

and they will probably be slightly more open to backporting than fixing.

Terry Chia

@jrg Doesn't look like it from the changelog. changelogs.ubuntu.com/changelogs/pool/universe/libs/libscrypt/…

jrg

@TerryChia fun!

Simon

1:20 PM

@tylerl I'd say it blew up during the summer and the origin would be some British guy on YT calling his teammates "you donuts" when he's pissed off.

TildalWave

afternoon gents

Simon

0

Q: Does Google catches and keeps users typing patterns

Does Google catches and keeps users typing patterns for identifying purposes? for example when I'm logged in my Google account and Searching for things Google records my "Typing Pattern" like typing speed and ... and makes an unique signature for me and then Identify me when I'm using Google fro...

privacy google

God damn man...

Arperum

@Simon Conspiracy theory FTW!

Simon

Seriously, sigh.

raz

@Simon Yeah I flagged that one

Terry Chia

1:24 PM

@jrg I hate software. :(

Arperum

@TerryChia Don't worry! Software hates you too!

Terry Chia

@Arperum No arguments there.

raz

In Soviet Russia, software program you!

Adnan

There is absolutely no way this would work accurately. — Simon 11 mins ago

There are absolutely many ways to make this work.

What was that thing somebody posted here (maybe @Xander) about identifying writing pattern to de-anonymize data?

Couple that with some JavaScript in the browser (to detect mouse movement, and typing speed), and you get something neat

or was it @Scott who posted it?

I don't remember

Terry Chia

@Adnan @TildalWave and I were discussing typing patterns for authentication the other day; the consensus was that it wasn't very practical.

TildalWave

1:39 PM

@TerryChia not practical at all but I'm still having great fun with it :P

Adnan

@TerryChia As the only factor for authentication, I completely agree.

But I can see it being used adjacent to some other forms of authentication

TildalWave

Nobody picked up on TWSS alert?

Adnan

@TildalWave We're mature adults now

Heheheheahaha

TildalWave

well I'm playing with implementing sense of rhythm as an authentication factor so definitely not mature

Simon

@Adnan How on earth would you accurately identify someone by his typing habits?

Unless you believe that each individual has its own way of typing which can be identified (you'd have to show me some proof), this would never work.

Xander

1:55 PM

@Adnan That was me.

bits.blogs.nytimes.com/2012/01/03/…

Also this paper: randomwalker.info/publications/author-identification-draft.pdf

It's called stylometry.

Simon

Let's develop an authentication system based off our typing.

Xander

@Simon It's been done. schneier.com/blog/archives/2005/11/authenticating.html

Simon

Well then, I stand corrected.

Adnan

2:13 PM

@Xander Perfect! Thanks a lot!

Rоry McCune

fun times here today, plenty of powercuts to go around

still UPS is working ok so servers get to go down gracefully

Adnan

@RоryMcCune Any reason?

TildalWave

@Simon you mean like with usernames and passwords? :)

Simon

@TildalWave lulz you donut.

TildalWave

2:34 PM

If a moon-synchronous orbit is impossible, the moon is a lie? — oerkelens 1 hour ago

like I said, they're always C# devs

Arperum

@TildalWave Shouldn't that be "There are always C# devs"? Or am I misunderstanding?

TildalWave

@Arperum I meant that each time I'd check who's trolling on space.se I'd see c# as the top tag on the user's SO profile

Arperum

@TildalWave In that case you did the correct thing and I did the misunderstanding.

Rоry McCune

@Adnan well it's v. stormy which is the most likely reason. Apparently there was a big problem with the network which is now <fingers crossed> resolved

Tinned_Tuna

2:52 PM

@RoryAlsop could be worse, a digger could go through your backhaul, and then the redundant links could fail due to some form of cascade, and an entire county could be without connectivity for a very big ISP.

Uh @RоryMcCune... ^

Rоry McCune

3:23 PM

@Tinned_Tuna yeah sorry I have anti-amiguous Rory pinging protection on... last year I did have a tree take my Phone line into a river. ADSL kept working surprisingly well untill it moved and snapped the line

only too BT 6 months to do the permanent repair (luckily their jury-rigged, "throw the line over a tree" method worked well in the interim)

Tinned_Tuna

haha

sounds like you called for a BT Engineer and got MacGuyver.

Rоry McCune

@Tinned_Tuna weirdly all the engineers seemed to know about the "hammer trick" which is how they get lines across rivers when they're sent out on their own...

Terry Chia

3:44 PM

@RоryMcCune "hammer trick" hehe.

tylerl

This is a very big deal: Google 2-factor supports challenge-response security tokens

I've been using this for a while. It's solid.

The idea is that it's 100% phishing-impossible.

Terry Chia

@tylerl Yeah, FIDO is pretty awesome. I hope more sites adopt it soon.

Rоry McCune

@tylerl ooh cool, good idea to add something not reliant on mobile phones methinks..

Terry Chia

@RоryMcCune FIDO is a protocol, you can implement it on phones, hardware tokens, in software etc.

Rоry McCune

@TerryChia ahh, I did not know that (keeping up to date everywhere is tricky these days!) d'ya have a link for the spec?

Terry Chia

3:51 PM

Wait no, FIDO is the organization behind it. The spec is called U2F.

Simon

QOTW!!!!!!!!!!!!!!!!!!!!!!!!!!!!

Terry Chia

@RоryMcCune fidoalliance.org/specifications

Rоry McCune

@TerryChia ta :)

Simon

Fido Solutions

Fido Solutions is a Canadian cellular telephone service provider owned by Rogers Communications. It used to be owned by Microcell Telecommunications. Although Fido's parent company, Rogers Communications, also operates another wireless brand named Rogers Wireless, customer service call centres, network servers and CEO. Fido pioneered the concept of providing unlimited service in select Canadian cities. Fido was the first carrier in Canada to launch a GSM-based network and the first wireless service provider in North America to offer General Packet Radio Service (GPRS) on its network. == History... ==

Rоry McCune

ahh I was wondering if it was like yubikey and I see they have a device which supports the protocol

Tinned_Tuna

3:53 PM

Yea, I saw that! I was kinda excited to go read the FIDO specs and see how they hold up. The web presence is banding a lot of terms about in a very marketing-heavy style, but they have links to the actual spec.

Terry Chia

@RоryMcCune Many big names behind it so I have decent hopes for it.

Simon

Google are copycats, tsk tsk.

@Ter

@ry

@dough

3:54 PM

@Tinned_Tuna It's pretty solid from my rather minimal knowledge of crypto.

Rоry McCune

@nut

6

Simon

@RоryMcCune 10/10 would read again.

Terry Chia

@RоryMcCune Star-worthy.

Tinned_Tuna

derp, sorry. @TerryChia I don't think that's going to save it. It could be design-by-committee madness

Terry Chia

@Tinned_Tuna The crypto behind it is solid, it doesn't look difficult to implement and they have an actual spec plus products out. Pretty well done job so far imo.

It's a damn solid improvement over TOTP.

Tinned_Tuna

3:57 PM

perhaps I should read the specs and blog about it

Terry Chia

@Tinned_Tuna How hipster of you.

Tinned_Tuna

@TerryChia indeed, I am so hipster it's not even funny. Nothing like having so much hip I can't see my feet.

I'll probably have to read the spec at some point to integrate it into our product anyways...

Adnan

4:14 PM

Has anybody heard of the new embargoed key-recovery attack (2^64) against AES-256?