The DMZ

nealmcb

01:37

0

Q: Good password hashing algorithm compatible with PHP and Linux apps

I'm looking for a password hash method for a new server system. The hashes must be generated from PHP code and verified from PHP as well as by a number of applications on a Linux system. I know that plain or salted MD5 and SHA-1 are not a good solution. I hear that sha256crypt and sha512crypt sh...

This is clearly not a dup. I tried to make that clear by changing the title. Did the last two people people that closed this even read the comments, to say nothing of the title? The OP disputes that bcrypt is an option, due to differences in the names used for the hashes. Still looking for an answer...

tylerl

05:46

@nealmcb User is throwing out options not because they're unworkable, but because the user either simply doesn't want to use them or doesn't know how.

Either the question is "how do I pick a good hashing algorithm" and it's a dupe, or it's "tell me which algorithm I think I'll want" and it's off-topic.

I see no other interpretations

Rоry McCune

09:28

Morning All

Arperum

@RоryMcCune Morning.

Stephane

09:53

'morning folks

sunny and slow morning, as a matter of fact

Rоry McCune

morning morning

Stephane

Wish I could go and fly... Alas: I'm on support suty

duty

Rоry McCune

@Stephane not so much up here, it's warm for the time of year, but pretty rainy

@Stephane heh, I'm report writing today :o/

Stephane

@RоryMcCune Sorry to hear that.

Good luck

Rоry McCune

@Stephane it's Scotland we kind of expect wet :)

Stephane

09:55

I'm daydreaming seeing people fly on the nearby montain... Wish I were there

lol

At least, you have good beer to compensate

Rоry McCune

@Stephane and whisky !

Stephane

@RоryMcCune Can't stand the stuff myself but, if that's your thing, I guess you're in the right place

Rоry McCune

@Stephane weirdly I didn't used to like it at all, then moved to the highlands and tried some for the first time in ages, now I really quite like it..

Stephane

@RоryMcCune True that: some things can only be appreciated in their native land... I feel the same about Pastis

Can't drink it except in south of France

Rоry McCune

@Stephane good point, I'm not a fan of guinness apart from in Dublin

Stephane

10:00

That's my favorite brew anywhere :) Ah well, life is more interesting when people have different tastes :)

AviD

@Stephane pasties?

like, what Miley Cyrus wears?

Stephane

Pastis

Pastis (French pronunciation: [pa.stis] ; UK /ˈpæstɪs/ or US /pæˈstiːs/) is an anise-flavored spirit and apéritif from France, typically containing up to 100 g/l sugar and 40–45% ABV (alcohol by volume), although alcohol-free varieties exist. == Origins == Pastis was first commercialized by Paul Ricard in 1932 and enjoys substantial popularity in France, especially in the southern regions of the country. Pastis emerged some 17 years after the ban on absinthe, during a time when the French nation was still apprehensive of high-proof anise drinks in the wake of the absinthe debacle. The popularity...

AviD

@RоryMcCune you prefer IPA, dont you? ofc you wont like guinness

@Stephane interesting

never heard of it. sounds not too different from arak

just (hopefully) better tasting

Stephane

@AviD It's not that different

Try it if you ever go to south of France. It's worth trying it at least once.

AviD

@Stephane dunno... I really dislike arak...

Stephane

10:04

At least, it's more interesting than Vodka or Akvavit...

Rоry McCune

@AviD well beer-wise it depends, lagers sometimes (Moretti, peroni) but belgian beers like leffe or duval for preference

AviD

@Stephane dont disagree, I never get drinking vodka straight. its for mixing.

@RоryMcCune I prefer a thick, dark stout. so guiness is in the right category, just not great.

Stephane

Well, I think I have to live with the fact that I'm not into spirits...

my sin is beers...

Well, alcool-wise anyway...

Tinned_Tuna

@Stephane my sin is avarice

Stephane

@Tinned_Tuna Luckily, I overgrew that one :)

AviD

10:07

I would say that my sin is pride, but I dont think it counts if I'm really that much better than the rest of you.

Rоry McCune

@Tinned_Tuna don't you work in academia?

or is my memory failing me again

Tinned_Tuna

@RоryMcCune currently, yes

Rоry McCune

this wouldn't be a huge surprise

@Tinned_Tuna just saying you may be in the wrong arena for avarice :op

@AviD apart from the bear

AviD

@RоryMcCune well, obviously

Tinned_Tuna

@RоryMcCune hah :-)

Kisunminttu

10:11

@AviD I've never heard anyone say they like it except Finnish tourists visiting Turkey. Reminds them of salmiakki.

AviD

@Kisunminttu afraid to ask what salmiakki is... sounds like some kind of fermented fish.

but lots of mideasterners love it.

as I'm sure @Adnan can tell you...

the more "eastern" part of the mideasterners.

Kisunminttu

@AviD It's basically liquorice with anise flavoring or ammonium chloride (sometimes both). We leave the fermented fish for the Swedes (surströmming), but we do love pickled herring!

Mmm... pickled herring with pickled onions and carrots...

Tinned_Tuna

@Kisunminttu Oh god, someone had me try that stuff at a party recently

AviD

@Kisunminttu eww. herring should be smoked. ;-)

Tinned_Tuna

@Kisunminttu I <3 ansie and that lot... but whatthebabbybejebuswhereyoulotthinking

AviD

10:22

@RоryMcCune BOOM, it is ON

Kisunminttu

@Tinned_Tuna Nom nom nom.

AviD

@tylerl sure, and CodingHorror blog's captcha used to be "orange" for years. but any non-dumb spam can bypass that easily.

though from the little I've looked, reCAPTCHA's new No-CAPTCHA actually looks good.

and btw @tylerl, from that perspective, there is nothing wrong with the Troy's implementation there, either. it will have at least as much effect.

Kisunminttu

@AviD I prefer smoked fish to any other sort. We also have a tradition of rolling gutted vendaces in egg + flour and then frying them on the pan

Rоry McCune

@AviD hey it wasn't me saying that CAPTCHA are useful, I just said you missed his point :op

@Kisunminttu what's a vendace?

Kisunminttu

Coregonus albula

Coregonus albula, known as the vendace or as the European cisco, is a species of freshwater whitefish in the family Salmonidae. It is found in lakes in northern Europe, especially Finland, Sweden, Russia and Estonia, and in some lakes of the United Kingdom, northern Germany and Poland. It is also found in diluted brackish water in the Gulfs of Finland and Bothnia, both of which are in the Baltic Sea. The length of an adult is normally about 25 cm (10 in). The maximum age reached by this fish is about ten years. The vendace is traditionally the most important target of freshwater fisheries in parts...

AviD

10:27

@RоryMcCune no, I didnt miss his point, my point was that HE was missing it.

hey, its not often I get to school Troy Hunt, right?

@Kisunminttu oh whew. it sounded like something gross, I was afraid to google it.

Rоry McCune

@AviD yarr, but he asked question A you then answered question B I just pointed out you didn't answer the right question :op

Kisunminttu

@AviD Well, the kinds of fish we've been discussing here are kinda gross...

Rоry McCune

@Kisunminttu who knew, we even have them in the UK

AviD

hey everybody, whats wrong with my butter?
Everybody: it's not spread thickly enough!
Me: uhh, you put the butter on a live eel.

2

Kisunminttu

@RоryMcCune I was surprised by that fact!

Rоry McCune

10:30

@AviD indeed you didn't answer the question but wanted to talk about a larger issue :op didn't say you were wrong just that that wasn't the question

AviD

@RоryMcCune sometimes its okay to answer the not right question.

again, my point is that if you want CATCHA at all - that captcha is almost as good as any.

8 mins ago, by AviD

@tylerl sure, and CodingHorror blog's captcha used to be "orange" for years. but any non-dumb spam can bypass that easily.

YES YES I HATE CAPTCHAS PLEASE JUST LET THEM ALL DIE

Rоry McCune

@AviD well yeah but a CAPTCHA with selectable text isn't actually a CAPTCHA, (or at least not the intended test)

AviD

@RоryMcCune every captcha is not really a captcha.

Rоry McCune

@AviD sorry I'm a bit unclear, are you not a total convert to the usage of CAPTCHAs then?

AviD

nor is captcha what captcha is intended for

@RоryMcCune hehe

@RоryMcCune only to protect against SQL injection.

yes, I have seen that suggested. True story.

Tinned_Tuna

10:33

Hah, someone I know has just come up with "Theresa 'Complete Disarray' May."

Adnan

@AviD Arak?

I used to like it back in the day. Not a big fan anymore

AviD

and I'm sure you know/knew plenty of people who do

Adnan

My grandpa used to make it from figs

@AviD Yup. I'd say at least 40% of my friends

It's a the drink to have while eating BBQ

Some people call it "The milk of the mood"

Because it becomes white when you mix it with water

One of the very few times in my life that I got drunk was because of arak.

Well, it was because I was stupid

but arak was involved

Kisunminttu

@Adnan I'd have loved to be a fly on the ceiling then

Unless something unpleasant happened. In that case no.

Adnan

@Kisunminttu Whoa! That's @Lighty-grade creepiness

2

Kisunminttu

10:44

@Adnan I got the creepies, man. That time of the month.

@Adnan "I'll see you this evening, but you might not see me"

Journeyman Geek

0_0

kalina

I am so cold

Adnan

@Kisunminttu No no, you don't get it. Netanyahu drew a silly cartoonish picture about how creepy that was and asked the US to bomb it

Journeyman Geek

I thought arak was made from aniseed.

Kisunminttu

@Adnan That's brilliant

Adnan

10:46

@JourneymanGeek It's one of the components. It's an aniseed-flavoured drink

Journeyman Geek

Yeah, its the aniseed that makes it opaque

(I don't drink. Oddly I find the process of making booze fascinating ;p)

Kisunminttu

@JourneymanGeek And it gives it its signature taste

Adnan

@JourneymanGeek Well.. that's 70% true

@Kisunminttu Reference:

Kisunminttu

@Adnan :D

Stephane

What ?!? No XKCD ?

3

Adnan

10:48

@JourneymanGeek Well, then you've come to the right place. Making alcoholic beverages is my thing. Mainly wine, though.

Journeyman Geek

As long as it ain't pruno.

Adnan

@JourneymanGeek When my wine tastes like a 10-EUR bottle, I throw it down the toilet

Journeyman Geek

;p

Adnan

High standards and stuff

Kisunminttu

@Adnan How many times have you had to do that?

Adnan

10:50

@Kisunminttu More than I care to admit

@JourneymanGeek My speciality is making wine with high percentage (above 15%) that tastes like it's below 7%

Kisunminttu

@Adnan I had no idea!

Journeyman Geek

This explains a lot.

Adnan

Oh, enlighten me

@Kisunminttu Yeah, love. It used to happen a lot more often than now

It took me a while to get used to grapes and fruits you get in Finland

Kisunminttu

@Adnan Aww :(

Adnan

If I had my chem test kit, I'd have probably done much better. But you know, coming from Syria with a bunch of chemicals and chemistry equipments.. Not a Good Thing

Kisunminttu

10:55

@Adnan "It's for making wine, I swear!"

2

kalina

11:38

good boredomday

Rоry McCune

@kalina it's Christmas week, how can you be bored!

Terry Chia

Got a surprising bunch of rep from my hat whoring question.

Rоry McCune

12:06

@TerryChia smeg, does this mean I have to start answering questions again to avoid sliding down the charts?

Terry Chia

@RоryMcCune Nah, I won't gain 2k rep before hats are gone.

It's only because of hats I started answering again.

Rоry McCune

@TerryChia yeah even I answered some stuff, haven't in a while... I'd say they should do hats more often, but it'd lose the novelty value after a bit...

Terry Chia

@RоryMcCune They don't have to call them hats. ;)

Rоry McCune

@TerryChia I tell you if they offered a bit of schwag for specific goals or competitions I bet it would increase activity quite a bit

Terry Chia

@RоryMcCune I'm still sad I don't have a t shirt.

Rоry McCune

12:10

@TerryChia yeah I got lucky when the elder rory acquired a con. swag pack

raz

12:57

0

Q: Negotiate n-bits key with Diffie-Hellman protocol (or other key exchange protocol)

I've got ASCII message. I convert it to binary - then I've got 8*(ASCII message length) bits - let us assume this value will be called n. I have to negotiate key, which length (after conversion to binary) will be equal to n. Is there any possibilty to do that? Do I have to choose specific random ...

key-exchange one-time-password diffie-hellman bitmessage

"Do I have to choose a specific random number?" You keep using this word random. I don't think it means what you think it means.

Lighty

F*ck

really?!

I was online that day -.-

there goes my useless badge );

Thomas Pornin

@Lighty What constitutes "online activity" for StackExchange is not public knowledge. We know that browsing the main page is not sufficient.

raz

@ThomasPornin I generally at least upvote a question.

Lighty

@ThomasPornin Or reviewing, or being online in chat, or reading questions

raz

That seems to be enough

Chat definitely doesn't count.

I missed the 13th this month because I was distracted by my new TV.

Lighty

13:08

yeah, you have to be on the Site, I was as far as that, but seriously, I had almost 100 days, and I browse questions, and review every day, trying to learn something too

;~;

raz

@Lighty I was at 92. I'm sure I'll get that useless badge eventually. I'm not that broken up over it.

Lighty

@raz I'm an Achievement hunter, it's one of those things that kepe me busy, pretty cool

nto for fame, but for completion and discovery xD

raz

I do it for the chicks

Just like Jesus

Simon

Good morning sunshines.

Rory Alsop

@Simon afternoon doughnut

Simon

13:20

@RoryAlsop See how hard it is to spell it that way?

^_^

Rory Alsop

@Lighty talking of that...anyone want to give me a downvote for this:

3

A: What benefits are there for security architecture being a separate discipline to enterprise architecture?

To post a contrary view to AJ's excellent answer: At a large corporation, architecture may end up being the responsibility of multiple teams in different departments, countries, regions etc. in order to be performant for each region, whereas enterprise security is likely to be managed from a glo...

Not all at once, obviously

As then if someone else gives me an upvote I'll be back level with Terry

:-)

Lighty

upvotes both

>:D

raz

I should downvote out of spite.

Rory Alsop

@raz I think I need a down vote to get the hat

Simon

I voted yesterday and didn't get the Solstice hat.

Therefore, I am out of this glitchy race.

Rory Alsop

13:23

@Simon ahh -when? I got mine on Saturday

Simon

I even voted the day before when some people claimed they got the hat anyway.

Yeah I voted on Saturday too.

Rory Alsop

@Simon solstice was not for voting - it was for posting or commenting

Simon

NOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO

GOD DAMN IT LEARN TO READ FRENCHY

Rory Alsop

@Simon lol

@raz please do :-)

Adnan

h30499.www3.hp.com/t5/Fortify-Application-Security/…

I hate him/her

Simon

13:34

Is it because of his shitty choice of subdomains?

raz

@RoryAlsop I will do neither. I will do nothing to encourage the use of hats.

Adnan

Now let's call every fucking successful injection an XSS attack

Simon

@RoryAlsop What do you need, an upvote or downvote?

Adnan

XSS has nothing to do with SSI

They might seem similar

Uggghhhh..

I need to be less angry. Help me, @Simon

Share your wisdom

Simon

@Adnan My wisdom? Hang on.

►

Watch it all and you will be fine after.

Terry Chia

13:36

@Adnan @Simon? Wisdom? hahahahahaha!

Simon

There's Mr. Negativity, everyone! Hide your happiness.

Adnan

@TerryChia Ahh.. I see your point

Ohnana

@adnan that article gave me many lols.

at least they linked to OWASP so their readers can actually have something useful

Adnan

@Ohnana I know, right?!

Ohnana

@adnan they also didn't drop a netcat executable on the server to set up a listener. 0/10 system shell, would not ls

Rоry McCune

13:45

@Adnan they're writing about SSI in 2014......

Adnan

@RоryMcCune But but but.. you see... it's through XSS :|

Rоry McCune

@Adnan 'cause < > == XSS right?

Terry Chia

@RоryMcCune What? Aren't we all writing webapps in C using CGI?

Adnan

@RоryMcCune Oh my god YES!

I already emailed the dickface

Telling him that his app can be vulnerable to XSS and SSI injection at the same time

Terry Chia

What do you want me to do? LEAVE? Then they'll keep being wrong!

Ohnana

13:47

Adnan

@TerryChia :D

Simon

@TerryChia Something you never said, eh?

Rоry McCune

@Simon that's a burn

Terry Chia

Holy shit, I need to do the "How does X vulnerability" affect me type of post more often.

+20/-1 on the question, +24 on the answer.

Rоry McCune

@TerryChia hey I thought you weren't going to turn back into a rep ho..

Terry Chia

13:58

@RоryMcCune Kicking you from the third row is tempting though. :)

Rоry McCune

@TerryChia thank you soo much, don't you have a tank to polish or something

Terry Chia

@RоryMcCune Psssh.

3

Q: Why shouldn't I use ECB encryption?

I'm using Java to generate encrypted strings, and I get this warning at build time: ECB encryption mode should not be used So I'm wondering why I shouldn't use ECB and what I can use instead?

ecb

Rory Alsop

@Simon a down please :-)

Terry Chia

Very interesting information in that question.

Adnan

@TerryChia I like that Java is giving him this warning

Rory Alsop

14:03

Tank Polisher :-)

Terry Chia

@Adnan Looks like it's the IDE.

Adnan

Oh yeah, Android Studio

Well, let's email the developer and agree to send him a beer

Oh, looks like it's by Google

Terry Chia

@Adnan Android Studio is from Google IIRC.

Adnan

Hey, @tylerl. Want some beer?

Terry Chia

They based it on JetBrain's IntelliJ.

Thomas Pornin

14:05

@Adnan I hope it stays a warning though.

nealmcb

@tylerl I agree that it is messy question, but there seems to be something indeed confusing and poorly documented there about the bcrypt algorithm naming, so I want someone who understands that to give an answer. Evidently someone is trying hard to do the right thing, and the fact that they're confused means we can offer clarity. I see three votes now to reopen. security.stackexchange.com/questions/76538/…

Thomas Pornin

Last week I had to reimplement DES (and 3DES) because .NET's implementation refuses to use an all-zero key.

Adnan

According to a Google search

Thomas Pornin

(This was to run a challenge-response protocol with a smartcard. The all-zero key is the default factory key, so I must be able to compute 3DES with that key.)

Adnan

> Warning: ECB encryption mode should not be used

@ThomasPornin How did you get around it?

Tinned_Tuna

14:06

@ThomasPornin um... why.. what... all-zero key? What? I am so confused, why do you want that?

ahh

Rory Alsop

@nealmcb I think I'll reopen (I know cheating using my 2 votes)

Terry Chia

@RoryAlsop HAT ME!

Thomas Pornin

@Adnan Opened FIPS 46-3. Reimplemented DES in C#. Took me 90 minutes.

Adnan

@ThomasPornin Yeah, I totally know what you mean.

(the 90 minutes part)

nealmcb

@RoryAlsop Thanks :)

Simon

14:07

@RoryAlsop Done, I will also be leaving a comment explaining how you can improve your answer.

Adnan

and the other parts as well :D

Rory Alsop

@nealmcb - it had 4 votes already so didn't need to use mod powers

@Simon lol thanks

Terry Chia

@RoryAlsop Woot, thanks for Breaking Bad hat.

Rory Alsop

Does that mean you are still ahead? :-)

Terry Chia

@RoryAlsop Yup. :)

raz

14:45

Anyone have Win8.1 dual booted with Linux?

Simon

@raz I spent a night trying to set it up with UEFI and gave up.

raz

@Simon Right!? I can't effing get it to boot from the USB drive.

Simon

@raz Yeah it's a damn nightmare.

I had the exact same issue.

David Freitag

@raz Are you starting with windows first or linux first?

Ohnana

I dooooo

raz

14:47

@DavidFreitag Windows

Simon

@DavidFreitag I'll bet Windows.

I WIN MY BET

Ohnana

@raz that's good because that's how I did it

David Freitag

Good, because otherwise bad things happen.

Ohnana

1. turn off secure boot. 2. install ubuntu. You'll be locked out of windows

raz

Yeah I've done it before with Win7

David Freitag

14:49

@Ohnana Grub should detect windows and setup a chainload for you. Or at least ask.

raz

@RoryMcCune This is why Win8.1 is terrible and NOT just an "improved" Win7

Ohnana

you actually need a package called secure-boot to make it work

install that, grub-update, and then presto grub should be able to boot it

raz

@Ohnana So I've turned off secure boot, but my problem is getting the system to boot to the USB.

Simon

Then mess up everything and cry.

David Freitag

@raz What utility did you use to make your bootable usb drive?

raz

14:50

@DavidFreitag I think it depends on if you installed Linux to the EFI partition or not.

Ohnana

@raz eh? try keeping in the usb between reboots. it takes a bit to get it to recognize

@simon that's typically the last step

raz

@DavidFreitag I tried RUFUS and Universal USB Installer

Simon

@raz I tried multiple too.

And multiple keys.

raz

@Simon I only have the one, but I know the USB key is good because Win8.1 recognizes it when I plug it in.

Ohnana

@raz do you have a cd drive? at this point i'd white flag and make a cd

Rоry McCune

14:52

@raz hmm I've never seen windows as being happy being dual-booted, back in the day you always had to do windows first then linux, or windows would blow away the boot loader, 'cause it assumed it would be the only OS :)

Simon

The laptop I had didn't have a drive.

raz

@RоryMcCune Well yeah but at least I could boot from USB, and you know... manage my system reasonably.

Simon

@RоryMcCune On Windows 7 it's a joke to dual-boot.

On 8, it's a joke to try to dual-boot.

Rоry McCune

@raz is that not an EFI thing rather than an OS thing?

raz

@Ohnana Yeah I might have to throw up the flag. It's stupid, but maybe I have to.

@RоryMcCune Windows mechanisms for rebooting using an EFI device is insane. Ctrl + I to bring up the settings menu. Change PC Settings > General > Recovery > Advanced Startup > EFI Devices.

Ohnana

14:54

@raz silly you, thinking you have complete control over your computer

4

David Freitag

@raz Just curious, how have you tried booting from the flash drive? I assume you have tried everything eg. boot from uefi, from the F10 menu and by setting it higher than the primary disk drive?

raz

Because that's straightforward, and instuitive.

@DavidFreitag Well... with UEFI that doesn't really exist. I've tried going to Legacy Support. And from there I can choose which device to boot from. But then the whole laptop hangs when I choose USB.

So maybe that's more my USB image is wrong, but I've also read that turning on Legacy Support will break everything depending on how the manufacturer supports UEFI.

David Freitag

@raz That might indicate an issue with the disk

Simon

@raz IIRC, if you choose Legacy Support it'll work but you will have a hard time booting back on Windows.

@DavidFreitag No, I had the exact same issue on my laptop.

David Freitag

@raz Who is that manufacturer for the mobo?

raz

14:58

@DavidFreitag It's a Lenovo laptop... friggin' Chinese.

Ohnana

huh, mine's a lenovo too. the Carbon x1

raz

Never again, I hate this damn thing.

David Freitag

@raz I haven't encountered the Lenovo uefi, mostly just ASRock, ASUS, and Biostar.

raz

Mines the Y512P

Ohnana

@simon I have legacy support. It doesn't bork things. it just makes the boot splash kindaa ugly

Simon

14:59

@Ohnana Then that might be the way to go.

raz

@Ohnana Maybe I just need to go in fresh. Reformat the pendrive separately

Transcript for