openvas is a festering pustule

lol practically married

We got lighty who buys his favourite girl stickers

We got Simon who goes on a date and starts thinking of marriage

And then we have me, definitely biohazard material for men

I'm actually living with my donut, can you say the same?

@kalina i like stickers

I have a donut in my house, yes

if they were cool stickers I would be appreciative

hell, my valentine's day gift is a coloring book

@Ohnana You're an easy one.

@Simon more nonmaterialistic

also someone else knows my openvas pain

there is a kindred spirit!

I'd rather not have anything and just have the guy be attentive

@Ohnana Hard to find these days.

Stickers does not demonstrate that

@RоryMcCune if Simon wanted me to be nice, he wouldn't have spent all day trying to wind me up

I'll wind you up like a damn windmill.

You can't jump into shark infested waters and then complain when the first dive costs you an arm

@paj28 ok - sounds like enough folks are up for it reopening, so I just did :-)

Noooo don't reopen it

@kalina It's the first breach that costs you an arm, donut,

Delete it and then pretend you don't know

@kalina just need to find a man with a biohazard suit :-)

No such man exists

wrong

oh, carry on, I didn't read the context :)

@kalina Gordon Freeman

Walter White and Jesse Pinkman

@RoryAlsop dat hev suit voice

@kalina wind you up.... simon.... that doesn't sound like him..

#me

I almost just choked on hot chocolate next to 2 bosses. #me

@Simon you should have just played it off like "<cough> <cough> ooh think I put a bit too much booze in that one"

@RоryMcCune oh lawd

@RоryMcCune My boss would probably start laughing like crazy if I did that.

@RоryMcCune I didn't even cough, I somehow managed to bring the liquid back in my mouth.

Sometimes, I think I'm a superhero.

Hey @kalina I popped pills at work, are you proud of me?

Ibuprofen gets you high like crazy.

@Simon Sudafed + Ibuprofen today for me - wheeeeeeeeeeee

Is it fine to mix both?

Or that's why you're wheeeeeeing?

@Simon nah that's 'cause he's been drinking a lot of water to keep hydrated when he'sill

Water as in Whiskey, right?

@Simon well that doesn't tend to hydrate you ....

@Ohnana Ahahahaha

@RоryMcCune Hence why he has to drink more, more, always more!

@Ohnana Kickstart not with money, but with lines of code.

@raz never speak those words again

@Ohnana hackstarter

Dayum you got told son.

@raz no

@Ohnana OH come on it would be awesome

lets kickstart hackstart.com

@raz NO

we've done "hackstarter" before. it's called github

@RoryAlsop - thank-you!

@Ohnana But we can do it better!

I'll start a git repo.

@raz /rage

lolwat

is that like Anti-matter?

I dunno but he makes me want to QQ.

@Simon why would I be proud of you?

like, ever

actually that's not fair

I'm sorry

@Simon what was it? I think I missed it.

@Simon gets that a lot

SICK BURN

Do we already have a question about how to draw the line between the three common identification factors? Something about the fact that all authenticators ultimately have to be checked against some data (i.e.: knowledge), which must be stored on some media (i.e.: can be physically possessed), therefore all authenticators effectively fall under one or both of "something you have" and/or "something you know"?

Feels likely to be closed as S&A, but it's something I've been itching to ask if it hasn't been done already.

@Iszi it doesnt work like that.

but about the question, dunno, likely been a few that touched on aspects of it though.

@Iszi Not sure what you mean by "How to draw the line between three common identification factors?"

You mean like when websites store an image or phrase to be verified by the user?

@AviD She said she wants a dad just like you.

@raz The factors: Something you have, something you know, something you are.

@Iszi I dont think its of such importance to draw a line.

each of those factors have certain attributes, and there are tradeoffs for each.

the whole point of "multi factor" is to have one factor's strength cover for the other's weakness. to tradeoff the tradeoffs, if you will.

i.e. aka "defense in depth".

@AviD I figured an answer might end up somewhere along those lines. Like, there doesn't have to be an ultimately insurmountable distinction but there do need to be technical measures in place to make the distinctions "hard enough" to get around as to be practically insurmountable.

@Iszi And something you were, right ex-dad?

infosec69

problem is that many of the common forms of authn dont align cleanly with the traditional tradeoffs of the expected factor.

so the line is moot.

@AviD Too many areas of grey overall

Likely to end up an opinionated question.

and then there are those that dont fit in any of the factors (e.g. SMS, "secret" questions, etc) but can still be useful

huh. Now that I think about it, that traditional defintion of the 3 factors is about due for retirement.

@AviD What's the traditional definition?

Like, every "something you are" must be digitally stored somehow to be verified for authentication. So, possession (or knowledge) of that data along with the means to impersonate a given value to the authenticating device renders "something you are" into one of the other two categories.

Or, like you said, that SMS thing. "Something you have" (being your phone) instantly gets boiled down to "something you know" (being the code that was sent to it).

@Iszi "along with the means to impersonate a given value " <- except this, so not so much.

@Iszi Yeah I think there's a lot of crossover with the different methods that can be chosen.

@Iszi no, my problem with SMS is that its not really tied to the hardware.

or even the SIM.

e.g. iPhone 6 + MacOS, e.g. Skype messaging, e.g. etc.

@AviD I'm talking about stuff like using Gummi Bears to bypass fingerprint readers, given a lifted print - "something you are" just became "something you [can] have".

@Iszi "finger"

@AviD ...your mom.

but yeah, I guess Demolition Man proved that

@Iszi heh, nicely done

you bastard

@AviD No, that would be @Simon.

@Iszi Gummy Bears to bypass fingerprint readers?

Is that really a thing?

@raz oh yes, classic biometric hack.

for some of the better readers out there, for many others you dont even need that.

Essentially, "something you know" is generally accepted as easy to duplicate due to the limitations of (most) human minds. So, the other factors are put in place as measures to raise the barrier. However, those other factors are ultimately handled as ones and zeroes somewhere - so, duplicating the data is (relatively) easy and impersonating the origin with that data is also generally quite within reach.

@Iszi well, no, not necessarily.

one of the original forms of "something you have" was e.g. a smart card. yaknow, with like crypto and stuff.

@AviD Classic? In 2010 at least they couldn't get it to work.

whatis.techtarget.com/definition/gummy-bear-hack

so its not being treated as 1s and 0s, its being treated as a key or whatnot.

@raz classic, as in a few years before that... :-)

@AviD Ultimately, that boils down to the 1s and 0s of the private key.

I guess by 2010 the great security companies succeeded in defeating candy.

@Iszi which is stored on the cryptocard...

@AviD In 2002 Matsumoto used gelatin, but not gummy bears themselves

@AviD And of course backed up/escrowed somewhere, more than likely.

ah, but you mean you can pull that out and encrypt or whatever yourself...

@Iszi for authentication?? shouldnt be.

but moot anyway

Get the private key, know the algorithms and interfaces (generally considered non-sensitive, because Kerckhoffs), and you're done.

anyway, a PK is not something anyone can keep in mind, not even Rain Man.

Yeah, dem primary keys can't be kept in mind.

@AviD No, but it greatly reduces the protection of "something you have" when what is assumed to be unique can (relatively) easily become not.

@Iszi very true.

and that is why most of the "something you have" are broken - it shouldnt BE easy.

(ideally impossible, but whatever)

which is also why I dont consider SMS at all - too trivial

And so the next step is to throw in a third factor - something you are. And we're back to Gummi Bears.

or just use a proper 2nd factor

Age test: When someone says "Gummi Bears", do you think of the candy or the TV show first?

heh, candy of course, but my kids recently started watching the show.

actually I think of the energy drink, but thats thanks to you.

@AviD Oh, right. Almost forgot about that!

Man, been awhile since I've had one too. These days, my thing is the Starbucks Doubleshot Energy cans.

So, 2FA to candy to TV to energy shots to Starbucks. Nope, no ADD in this channel here.

oo! we should ADD some numbers now!

numbers are fun!

you know what else is fun?

jumping on trampolines!

fun fact: Trampolines used to be called "jumpolines". Until 1974 when yo momma jumped on one.

@AviD You didn't hurt yourself with that stretch now, did you?

:-)

@Iszi Your momma did though.

too easy.

Tramampolines!

Edinburgh's new trampoline centre just opened. So that's 3 within 45 minutes of me

so @Simon, I hear you Canadians got tired of all the 'murkans making fun, so y'all decided to just move south and take your weather with you?

@Iszi It's not defined by how the authentication systems stores it, but by the form you are expected to present for authentication.

We are actually doing serious security discussions now? How weird.

@Iszi And I think the key is "expected form." You could argue that a fake fingerprint is "something you have" for instance, but the model intends for you to present an actual fingerprint attached to your body.

All authentication methods assume the application in question isn't compromised.

@Iszi What is this Gummi Bears TV show of which you speak?

@paj28 No worries - the consensus in here from the regulars was what did it - I just sped things up

@Xander oh the horror.

@AviD Ha ha. I guess it's good I haven't heard of it then.

@Xander But the whole point of putting distinction between the forms is to make it less likely that multiple individuals could concurrently possess all of the valid authentication types of one individual. When multiple different types of presentation equate to the single type of storage, the model arguably fails.

if you have little kids, you should download a couple of seasons. Give you some quiet.

@Iszi s/posses/compromise/

@AviD Move south? wat?

@Iszi the threat model for each factor is complementary to the others.

@AviD Except when you consider each factor as stored data, which it inevitably is.

@Iszi no, because if your assumption is that the database has been stolen, all authN is gameover anyway (arguable except for digital signatures)

Anyhoo, gotta jet.

@AviD Oh, yeah... and that's where "something you are" is just plain, and uniquely, screwed.

@Iszi even if we assume that all the authN data is stored together in a similar fashion (this is not a forgone conclusion), so what? thats beside the point.

has anyone ever used ubertooth before?

the open source bluetooth sniffer - penturalabs.wordpress.com/2013/09/01/…

@Iszi Not necessarily. It still makes faking authentication more expensive and difficult, if not impossible. For instance, a door that requires a smart card, a fingerprint, and a PIN to unlock, still requires me to create two physical fakes (as well as knowing the PIN) in order to fool it into thinking I am a particular user authenticating through the interface provided.

And, now off to dinner.

@essefbx OHMYGOD THISISTHECOOLESTTHINGEVAR IMUSTTOHAVEITNOW

LOL im considering buying one

@essefbx oh, now that sounds so much less cool and hipster

ahaha I have to do a security assessment on an app that uses bluetooth. But I have never sniffed a bluetooth before

this thing looks cool though

Also I imagine you could pick up some interesting stuff if you were in a popular firechat zone or something

oh dear lord, and I know I probably shouldnt ask this, but what in the name of all that is good is a "firechat"?

bluetooth chat

itunes.apple.com/en/app/firechat/id719829352?mt=8

it's a cesspool - all I can pick up are rooms full of youtube-style comments

but i hear it's really popular in china

I dont even... So basically the current way you young kids hook up with each other without having to actually, you know, talk to each other.

so go to a pub, or a party, and just continue texting each other.

@essefbx so yeah, this makes sense.

LOL yup.

I am disgusted by your version of humanity.

We have no hope.

Not even General Kenobi.

ahaha you're probably right

but it's more entertaining this way

I mean what did you do before, intercept carrier pigeons?

oh for sure.

This is how freedom dies - not with a bang, not even with applause, just with giddy laughter and cries of "Bro do you even lift?"

i dono. nerd is becoming fashionable. I predict a polarization of those with muscles and those without

What a damn donut:

lol the quit upvoting

I'm referring to the German one, not the donut.

It's is common knowledge that the donut one is pure awesomeness.

yeah I was just laughing at that. I admire your effort

I didn't make it!

suuuuuure

the german one is random though

Yeah, big time.

although mein deutsch is sehr schlecht

ICH SPRECHE KEIN DEUTSCH

dann vielliecht deis ein bisschen benutzen haben

i can't remember how to spell anything

THIS IS WHY I TOOK CS NOT GERMAN

you never forget how to spell if

*dann vielleicht ein bisschen benutzen haben that makes almost sense when popped into google translate

Yay! meta.sec.SE finally works for me again. I had to disable HTTPS Everywhere for SE, since as I expected, that was the problem.

how does that work?

@Xander yeah, they havent sorted out the certs for meta sites yet?

also couldnt you have just allowed the invalid cert?

@AviD It doesn't throw a visible error, it just fails to log me in. Actually, it momentarily looks like it's logged me in, then I'm unauthenticated again.

@AviD And I didn't feel like bothering to get a trace and try and figure out exactly where there error was...Easier just to turn off HTTPS Everywhere for the site.

SE is only the second site that I've had problems I could trace to HTTPS Everywhere. Zillow is the other.

SE's excuse is the meta.*.SE.com cert issue. What's Zillow's?

@AviD Dunno. I looked far enough into that one to see that it was an API issue. The pages load fine but all of the callbacks fail so there are no overlays on the map.