The DMZ

Stefan

11:00

@M Zeinstra i dont know

kalina

@MZeinstra it's an anonymous account

M Zeinstra

..

Pls, be more precise

kalina

I'm not sure how I can further clarify this

Stefan

@kalina What is anonymous?

Gerwin

@MZeinstra it can't be further clarified, it's quite clear in and of itself...

kalina

11:01

@Stefan name withheld

somebody who is anonymous is unknown

Stefan

Are you sure?

Journeyman Geek

@Arperum: so its like trying to stack up flaming chainsaws while being juggled?

Adnan

Was there a flag party here?

Stefan

yes

party 24/7 here

M Zeinstra

Ahh it means: Anoniem

kalina

11:02

@Adnan no

M Zeinstra

thanks!

Adnan

@kalina Why do we have new faces here, then?

Stefan

Whats wrong with us??

Adnan

I mean, we got you here in an unfortunate flag party

Rory Alsop

No idea

kalina

11:03

@Adnan one of them wanted Stack Overflow, tripped over, and landed in InfoSec

the other one possibly came with him, since they were speaking dutch to each other

Stefan

thats not dutch

Rory Alsop

@Stefan nothing in principle, however the questions you are asking are more SO than Sec

Adnan

Yiddish, whatever.

@kalina I see

Rory Alsop

Heh - sorry:

in The Practice Room, 7 mins ago, by hinafu

I've got a question, what would be a proper fingering for this piece? http://i.imgur.com/uXK085S.png

Stefan

donuts?

Arperum

11:06

@JourneymanGeek Yup, but I think you forgot the part where people are trying to steal the chainsaws, other people are trying to just see you fuck up and throw rocks at you, and then you have that one guy who just wants to test your reaction speed. Also: the chainsaws multiply at random times.

Rоry McCune

@Stefan let me guess, you're associates of @Lighty ?

Adnan

@RоryMcCune or @Simon

Stefan

Who is @Lighty???

Rory Alsop

@Arperum And you're balancing on an inflatable ball in a shark tank

Rоry McCune

@Adnan too early for team canada

Rory Alsop

11:07

@RоryMcCune 'Blame Canada'

Rоry McCune

@Stefan a dutch person who frequents this room, given you appeared to be speaking Dutch it seemed like a logical conclusion..

Arperum

@RoryAlsop Lazer sharks.

Stefan

nope im sorry i dont know your friend :(

Noordung

Rory Alsop

@Stefan and then you mentioned donuts - hence Simon, although I'm guessing you just read topic #1

M Zeinstra

11:08

Stefan.. You don't know anything..

Rоry McCune

@Stefan friend... that's one way of describing it...

Arperum

@RоryMcCune I decided to not post what I typed up, because it was too mean.

Stefan

@MZeinstra You dont know anything!

Someone got any idea how to get the "selfie" hat?

Rоry McCune

@RoryAlsop my new theory is @Lighty sockpuppets :) this seems most probable

Rory Alsop

@Noordung nice one

That headstock is identical to my Charvel Predator

Arperum

11:10

@RоryMcCune Spelling is too good. Although the weird is accounted for.

Rоry McCune

@Arperum true.. he could just be trying to throw us off the scent there tho'

Arperum

@RоryMcCune But they are also posting exactly the same random questions in the Bridge. That is even less like @Lighty

@Stefan GAH. NO gifs like that please. Gifs are bad.

Rory Alsop

Okay - @Stefan and @MZeinstra - be aware that while your behaviour isn't offensive, it is very odd, and doesn't fit here. I include in this the duplicate posting of questions across multiple chat rooms, and pushing questions that are entirely unrelated to this site. Suspensions and time-outs could happen...

kalina

what's going on

there are animated gifs in here

when did the embargo on animated gifs get lifted?

additionally, does this mean I can now post ponies?

Rory Alsop

@kalina dunno - but gif removed now

Stefan

11:17

idk when i uploaded it i didnt have a chance to cancel it and it didnt give any warning/error.

Noordung

@RoryAlsop innuendos galore :)

Rory Alsop

ponies...erm... what size?

Arperum

@Stefan Why did you even upload it in the first place?

Stefan

@RoryAlsop where can i find the chat rules then? I never used this before

@arperum cause its funny

Rory Alsop

so, @Stefan - why did you take @kalina's answer to your question here and post it over on the Bridge to exactly the same question?

M Zeinstra

11:18

@arperum Stefan is true

Rory Alsop

what is it you are trying to achieve

Stefan

Nothing its kinda chanceless

But can you post the rules here? or isnt that possible

kalina

No, we don't write rules down

Rory Alsop

@Stefan click on info and then faq

kalina

they're formed over time and committed to memory

we can't tell you the rules

Arperum

11:20

@MZeinstra He's not a boolean. SO he's not "true"

kalina

you have to work them out for yourself

Rory Alsop

the 'be nice' section is useful, but as @kalina says, the key to joining any chat on the Internet is 'learn the local behaviour'

Stefan

Iam a boolean and iam true!

Rоry McCune

@Stefan also rule[0] is "don't annoy the mods"

Rory Alsop

don't just jump in, post nonsense, etc

Arperum

11:22

It also helps to at the very least say hello. Or just look for a while before actually joining in.

M Zeinstra

@Arperum yes he is

Gerwin

May I ask who '@Lighty' is?

Arperum

@Gerwin A regular user of this chat.

Rory Alsop

@Gerwin you just did

:-)

Gerwin

haha :P

kalina

11:22

@RоryMcCune annoying the mods is literally the thing I exist to do on chat

Gerwin

alright thanks ^^ I kept seeing people talk about him so I was curious ^^

M Zeinstra

if( @Stefan ){
return "STEFAN IS A BOOLEAN";

Rоry McCune

@kalina I know

Rory Alsop

@kalina s/the mods/some of the mods

Stefan

Another question: Is it possible to create your own chat room?!

Rory Alsop

11:23

@Stefan seriously read the faq before doing that

M Zeinstra

if( @Stefan ){
return "STEFAN IS A BOOLEAN";
} else{
return "STEFAN IS STILL A BOOLEAN";
}

kalina

@RoryAlsop strangely, I treat you all the same, but half of you have this preconception that I'm the offspring of $devil and $annoyingThing

Rory Alsop

first off -why do you want to? SE is not a chat network. Chat exists to support our site communities

@kalina I leave preconception to Jesus

kalina

I see what you did there

Rory Alsop

@kalina :-)

M Zeinstra

11:25

How do I create my own chat?

Arperum

@MZeinstra The joke is old, dead and buried by now.

kalina

@MZeinstra first of all, you start by choosing your programming language

Rory Alsop

@kalina best answer :-)

kalina

@MZeinstra then you decide how it's going to work, whether it will be peer to peer to client/server

@MZeinstra then you implement your new chat from the ground up, in $language

Rory Alsop

@MZeinstra read my note just up there ^

kalina

11:26

once you have created your own chat, you can make your own rules

M Zeinstra

@kalina do not by the hand

Arperum

@MZeinstra This doesn't even make sense, not even as a literal translation from Dutch.

Rоry McCune

@MZeinstra in that case try discourse.org download install sorted

M Zeinstra

I'm upset...

And now I'm happy :D

Noordung

@kalina neah you're lovely :)

Arperum

11:28

@kalina I was going to post a link for him to follow, but your answer is the better option.

kalina

@MZeinstra English $€&#!@%$#?!~, do you speak it?

M Zeinstra

I'm fine

How are you?

kalina

@Noordung you're so kind, your reputation with kalina has increased by +100

Noordung

@kalina hehehe that's the "association bonus"? :D

Arperum

@kalina - infinity +100 is still -infinity.

Gerwin

11:29

"You've reached Exalted reputation with 'Kalina' Congratulations!" ^^

kalina

@Noordung no, but it's enough of a reputation gain to put you above half of the people in here

@Gerwin impossible

Gerwin

impossible!?

kalina

there's nobody above honoured

Gerwin

aww :(

@Noordung time to go SSJ2... get that reputation up! ^^

Arperum

@kalina And I don't expect said honoured people to be in here to be fair.

kalina

11:30

@Arperum indeed

Gerwin

not even me? ;(

kalina

I don't think I have an internet friend that's above friendly

Gerwin

but... but....

Rоry McCune

@kalina well apart from @Adnan (if it goes low enough it loops back to the top right?)

kalina

@RоryMcCune no I had to implement something specific for @adnan

Arperum

11:32

@Gerwin There is no reason anyone here would have you above "random person who randomly joined our chat after some other random person pushed a question of him down our throat".

kalina

just returns a static value of -1

AviD

ick I hate drinking tea

it feels so pompous

kalina

@AviD what's wrong with tea?

AviD

its not coffee

kalina

lol pompous

AviD

11:33

I'm drinking a tonne of tea for my throat

Gerwin

xD, well my apologies for that @Arperum I asked those guys to look at my question, when he suddenly said he asked it here, so I joined to see how it went

AviD

it helps the hell out of it, but bleh

kalina

hot chocolate is good for sore throats

I always get those two mixed up

AviD

we ran out of the good flavors. now I'm stuck with PLAIN tea, because I dont like all the fruity flowery teas.

Gerwin

Well... that escalated quickly...

AviD

11:34

@kalina haha! was about to respond to that. something that would make @Simon very uncomfortable.

Arperum

@Gerwin Oh, so he was actually trying to get us to answer it here, and then post our answer as his on SE? that's serious negative points.

AviD

@Gerwin welcome to the DMZ.

Gerwin

I don't know what he tried to do, I guess he tried to help me

kalina

@AviD is @Simon ever comfortable in the DMZ?

AviD

@Arperum yeah. almost as bad as asking security guys about frikkin CSS.

Tinned_Tuna

11:34

how much entropy do you lot think people typically get in their passwords?

AviD

@Tinned_Tuna 20-30 bits, at best

excluding intelligent security folk

Stefan

Can i get a welcome too? :O

Gerwin

@AviD thank you ^^

Arperum

@AviD That too. CSS is very secure didn't you know?

AviD

and paranoid people

and your mom

kalina

11:35

guys

AviD

@Stefan sure. you're welcome.

kalina

It's time for me to ask a silly question

Stefan

Thanks! :-)

kalina

something I should probably know but don't

Tinned_Tuna

@AviD hm. I've been doing a bit of calculation assuming 20b of entropy. you need to do some pretty harsh things to usability to push the chance of an attacker winning at an online brute force vs. a single password...

kalina

11:36

but probably do

just not with the words you're going to use

AviD

@Arperum there are actual security issues with CSS, but thats not the point

kalina

Can you explain what you mean by "entropy" in relation to passwords?

Arperum

@AviD I know.

AviD

@kalina no silly questions. Only silly people asking ridiculous questions.

@Tinned_Tuna NO.

Arperum

@AviD Your hat is ridiculous.

Tinned_Tuna

11:37

@AviD ?

AviD

@Tinned_Tuna WRONG.

@Tinned_Tuna INCORRECT.

Tinned_Tuna

@AviD Care to expand?

AviD

@Tinned_Tuna xkcd 936.

kalina

To anyone who understands information theory and security and is in an infuriating argument with someone who does not (possibly involving mixed case), I sincerely apologize.

Tinned_Tuna

@AviD I said nothing on asking users to generate passwords

AviD

11:38

and of course

568

Q: XKCD #936: Short complex password, or long dictionary passphrase?

How accurate is this XKCD comic from August 10, 2011? I've always been an advocate of long rather than complex passwords, but most security people (at least the ones that I've talked to) are against me on that one. However, XKCD's analysis seems spot on to me. Am I missing something or is th...

@Tinned_Tuna uhh? so we may have misunderstood?

Noordung

@AviD he asked you to expand you donut!

Tinned_Tuna

getting users to generate high-entropy passwords is like getting blood from a stone. Further, we're largely not in control of the institutions' policy

Rоry McCune

@Tinned_Tuna against a single account I'd agree that online bruteforce should be impractical and with no prior knowledge. If the attacker has a large number of usernames he could try 1-2 v. common passwords across the base which would have a better chance of success

AviD

@Noordung I DID (by reference)

@Tinned_Tuna yeah, that last part is always a big lose.

Noordung

@AviD I N C O R R E C T <- this is expansion

AviD

11:39

I have those fights every other week.

Tinned_Tuna

@Avid, @RоryMcCune I'm looking specifically at "vertical" attacks -- defending against horizontal attacks is my next ticket on the list :-p

AviD

@Noordung heh

kalina

@Tinned_Tuna are vertical attacks those attacks you do while standing?

AviD

@Tinned_Tuna so what did you mean?

paj28

@RоryMcCune - thanks for the suggestion yesterday, Veil worked very well for encoding an exe payload!

i wasn't able to encode the swf attack

Rоry McCune

11:39

@Tinned_Tuna also leads to either passwords written down and/or sequence passwords.. every.. single...time

@paj28 coolio :)

Tinned_Tuna

@AviD so, we've got a set of users, and assuming the attacker picks one out for some reason and starts guessing for that one user

AviD

@RоryMcCune or birthdays, or telephone number....

@Tinned_Tuna okay?

Tinned_Tuna

@AviD the password policy is set by different institutions (our customers) and the user's passwords meet those varied policies

Stefan

Who got loads of hats allready?

Gerwin

Guys, a quick question about PHP: How secure against SQLInjections, is the filtering of Special Characters in PHP

Rоry McCune

11:40

@paj28 yeah that one I've not seen much for, I guess it's possible but might require manual stuff... one idea would be commercial SWF packers...

AviD

@Tinned_Tuna ah, so you want to protect against BF attacks, without any consideration for the password itself?

Noordung

@Stefan winterbash2014.stackexchange.com/leaderboard

AviD

@Gerwin mediocre

Tinned_Tuna

so, given that situation, and a bound of how likely that attacker is to succeed at that particular attack in one day, we need to estimate the entropy in the average user's password

Stefan

I know but i want to know about people in here

Gerwin

11:41

@AviD Alright, thank you ^^

kalina

@Stefan winterbash2014.stackexchange.com/leaderboard/…

Tinned_Tuna

I'm tempted to just grab rockYou, etc. and run Shannon's estimator of entropy over the whole thing, but it's quite old now, and probably not representative

Stefan

@kalina winterbash2014.stackexchange.com/leaderboard/…

AviD

@Tinned_Tuna again, that depends on the policies. also, then what?

kalina

@Stefan that's the exact thing I just linked you

AviD

11:42

implement lockouts that are long enough to stretch the entropy to cover a whole day?

Stefan

I know i didnt ask for a link either

Tinned_Tuna

Basically, given a (supported) estimate of the entropy of the passwords in the system, and a desired bound of P(attacker wins), we can devise an appropriate policy which tackles that particular attack.

kalina

yes you did

Stefan

I didn't

AviD

@Tinned_Tuna you said you have no control over the policies.

what do you control, just the lockouts?

Tinned_Tuna

11:44

@AviD indeed

AviD

ahh I see. Sucky indeed.

and far from a decent situation to be solving.

Rоry McCune

@Tinned_Tuna I'd just take a pragmatic approach, set lockout at 10. after that many attempts the user has forgotten their password and that's low enough that unless they have a really dumb password or the attacker has knowledge of likely values, they won't get in :)

Arperum

@Stefan You did, and why on earth would you post the same link in reply to you getting the link?

AviD

however... I would suggest perhaps starting with "regular", short timeouts. iteratively increasing in length, until you can be assured that this is an attack (to some degree of certainty), and then trip into active defense mode.

Tinned_Tuna

@RоryMcCune Lockout for how long? Until admin intervenes? Until email reset?

kalina

11:45

dear moderators

AviD

i.e. human intervention, etc

kalina

I believe we're being trolled

you should ban @Stefan @Simon @Tinned_Tuna and @RоryMcCune

Arperum

@kalina That or someone is genuinely beyond help.

kalina

will resolve all trolling

Rоry McCune

@Tinned_Tuna well as they've forgotten it, it'll be admin intervention anyway :) One add-on is that this does leave a DoS risk, so you'd need some detection/anti-automation to address that.

AviD

11:46

@RоryMcCune yeah. though 10 will still give you passwords for a great deal of users, depending on the scenario and policies.

Stefan

If i ask how many hats you guys got Im not asking for a link.

kalina

...not a single person bit

paj28

if I had my way no websites would have any brute force protection at all

kalina

I'm such a failure

paj28

it's just on users to pick a strong password

Rоry McCune

11:47

@AviD sure but if people are in the top 10 your likely stuffed anyway

AviD

@RоryMcCune oh, agreeably.

Tinned_Tuna

@AviD so you'd just take a punt at what a decent policy would look like and call it a day?

Stefan

The best password is qwerty

AviD

@RоryMcCune if you say CAPTCHA I'll kill you.

Rоry McCune

@paj28 what about attackers with e-mail address lists locking your entire userbase out of their accounts?

AviD

11:47

oops, I meant "kick".

Arperum

1 min ago, by kalina

I believe we're being trolled

kalina

@AviD CAPTCHA

Rоry McCune

@AviD have you seen googles new not really CAPTCHA CAPTCHA?

paj28

with no brute force lockouts, they won't lock anyone out

Tinned_Tuna

@AviD I am trying to come up with some sort of basis for the policy, do most people just take a punt and put something that looks sensible in place?

AviD

11:48

@RоryMcCune which is why I suggested having a multi-step lockout, eventually escalating into a human.

Rоry McCune

@paj28 hmm DoS risk (assuming you're using b/scrypt)?

AviD

@Tinned_Tuna no, actually most people put something that does NOT look at all sensible in place.

Tinned_Tuna

@AviD lol

paj28

oh, and also just use a single fast hash with no salt

AviD

@RоryMcCune seen it, not looked at it. curious how it works.

paj28

11:49

all this is fine - if people use strong passwords

AviD

@paj28 still the most common

paj28

why should web sites jump through hoops for stupid users?

Rоry McCune

@paj28 which has never in the history of the universe actually happened :)

kalina

@paj28 this is a silly question

AviD

@paj28 what kills me are the sites that prevent you from using a strong password. far too common.

Tinned_Tuna

11:49

@AviD my current guess is given 20b of password entropy, a vertical attack, and 25 guesses, lockout for 30mins, gives the attacker ~1.1x10^-3 chance of getting in

paj28

i use strong passwords

and a password manager

Rоry McCune

@paj28 'cause bad publicity from users getting Pwned hurts the websites

kalina

Websites should jump through hoops for their users for the same reason any company should jump through hoops for their users: The companies want the users, not the other way around

paj28

Stack Exchange Security Blog: Is our entire password strategy flawed?

roryalsop on June 19, 2014

paj28 posed a question that really fits better here as a blog post:

Security Stack Exchange gets a lot of questions about password strength, password best practices, attacks on passwords, and there’s quite a lot for both users and sites to do, to stay in line with “best practice”.

Web sites need a password strength policy, account lockout policy, and secure password storage with a slow, salted hash. Some of these requirements have usability impacts, denial of service risks, and other drawbacks. And it’s generally not possible for users to tell whether a site actually does all this (hence plaintextoffenders.com). …

Rоry McCune

@paj28 sure me too, but our behaviour will not be copied across any decent sized userbase

AviD

11:50

@Tinned_Tuna I dont like probablity for this calculation. I prefer Time-To-Break.

Stefan

What is the worse password you can use?

AviD

@RоryMcCune apparently, not too much.

@RоryMcCune Sony seems to disagree.

paj28

@kalina - that is a very good point, and true, but I HATE THE WORLD

kalina

@Stefan god, love, sex, password

Tinned_Tuna

@AviD how do you manage that? Do you consider it to be broken in when the cumulative probability over the time of the attack >0.5 ?

Rоry McCune

11:51

@AviD well breach fatigue is a thing sure

@paj28 hey hey hey you're meant to be chilled out these days :op

AviD

@Tinned_Tuna not at all, I avoid probability.

Stefan

@kalina nope the worse password is your username or 1234567890

kalina

now look what's happened

this information security conversation has attracted a bear

paj28

:-)

Rоry McCune

@Tinned_Tuna but after 25 guesses they've absolutely definitively forgotten, why not perma-lockout until they go through the reset procedure?

kalina

11:52

@Stefan that's ten characters long, god and sex are three

AviD

the basic calcluation is: total amount of possible passwords (assuming equal probability each) / 2 (for the average case, which works due to equal probability) / rate of password guessing.

kalina

and popular

Stefan

that is a bear

AviD

@RоryMcCune because of lockout

@Tinned_Tuna consider your lockout mechanism a rate throttling control. nothing more, nothing less.

(unless its a permanent lockout).

Rоry McCune

@AviD oh for DoS risk... I'd prefer other anti-Dos stuff like looking for failed login patterns and block the attacker

AviD

11:53

@RоryMcCune tru dat

Tinned_Tuna

so, in the example above, ((2^19)/1200) days ~= 437days?

AviD

6

A: What is the difference between login throttling and temporary account lockout?

"Throttling" and "temporary lockout" are exactly the same thing. It is likely, however, that your dev team misunderstood the concepts, and assumed you meant "throttling" like most of the other answers here did (with the exception of @R15, though that is less an answer and more of important con...

Tinned_Tuna

1200 guesses per day, etc...

anyways, time for lunch for the moment.

AviD

@Tinned_Tuna with those base assumptions, yes.

Stefan

lunch?!

Tinned_Tuna

11:54

@AviD thanks for the chat, I'll be back in a little while

Stefan

are you gonna eat tinned tuna?

Tinned_Tuna

@Stefan I'm a vegetarian

Stefan

explain

your name xD

AviD

@Tinned_Tuna but that assumption means that on average you are allowing one passsword every 72 seconds.

kalina

explain your name

AviD

11:55

explain your face

@Tinned_Tuna is that right?

Arperum

explain the barrage of random questions.

Stefan

smileyball with a t-shirt

explained my face

AviD

explain "eggsplain"

kalina

@AviD I can't, there's no way I can describe how awesome my face is to a bunch of geeks on the internet - it's just an impossible conversation to have

MY GOD I KILLED CHAT

quick, somebody call a waaaaaaaaaaahmbulance

AviD

you killed a cat??

Arperum

11:58

@kalina I think people are mostly trying to evade a random and rather rude "explain" demand from a certain smiley

Rоry McCune

@kalina ya know loads of people don't get that line, I've used it and got blank responses before..

kalina

@RоryMcCune :p

@Arperum explain

Adnan

Whooohooo!! Black Mirror Christmas Special is out!

Transcript for