The DMZ

@AviD As someone who had spent a fair amount of time with an axe in my youth...wow. That is one hell of a work out. It's an entire core and shoulder exercise.

AviD

12:59 AM

I'm sure

okay, this has just become my own personal tag line

Stack Exchange

4:12 AM

Iszi

5:07 AM

@StackExchange Wow. Never did notice that...

M'vy

7:11 AM

What? The baseball fielder? XD

Rory Alsop

9:53 AM

morning (+/- random offset 0:12)

@AviD I have found it very useful both when I was freelancing, and in big consultancies, both for finding opportunities, and for recruiting (I'm not a recruiter, before you get worried - I just had a large team requirement and it was an easy way to stay in touch with good folks over the years)

@AviD Yeah - it was slashdotted (schneiered?) when I tried last night

AviD

10:23 AM

@RoryAlsop ah, that explains the incredibly slow site.

and merry diurnalphism to you

@Iszi really? I still cant figure it out. pointer?

AviD

10:42 AM

@Iszi ahhhh, see it now! interesting...

funny, I only got it when I accidentally realized the xkcd / guy fawkes / willie mays was a modified logo. yeah, didnt notice it spelled fedex till I glanced in the right way... :$

M'vy

Hey !

Scott Pack

11:33 AM

Wasn't Willie Mays the character that Snipes played in Major League?

Rory Alsop

@ScottPack mayes hayes:-)

Scott Pack

@RoryAlsop Near enough :)

In related news. The speed at which you issued that correction made me properly smile.

Rory Alsop

heh

@ScottPack just happened to be looking at the screen as it popped up

Scott Pack

12:13 PM

So to speak.

AviD

Willie Mays Hayes. I hit like Mays, and I run like Hayes.

@ScottPack funny, that was the reference that popped into my head too.

thats how I know that willie mays is a good hitter....

Scott Pack

12:36 PM

The battery died on my watch while I was trying to sync the time. :-|

Iszi

12:47 PM

And the XKCD tooltip text is absolutely right.

Could someone clarify/correct the second comment here?

7

A: When are HTTP session cookies at risk over Wi-Fi?

If I'm using websites that do not use HTTPS, but I'm on a WEP-protected Wi-Fi network, are my cookies safe from being sniffed by third-parties? No. Outsiders can crack WEP networks almost as if they weren't encrypted at all, these days. Insiders have even more ease of access. Even on WPA/...

Rory Alsop

@Iszi I think it is the piece around "ultimately" - if the session is only negotiated at the start, under http, then an attacker may be able to use it

Iszi

@RoryAlsop I don't follow. You're saying in a case where the site uses HTTP for login but HTTPS for the rest of the session? Talk about senseless.

Rory Alsop

sorry - if the session identifier is negotiated while in http and reused, then there is a risk (I wasn't meaning session cookies - blame me for not really reading the headline but thinking of the general case)

a serverside session token might be a better phrase for what I was meaning

Rory Alsop

1:20 PM

@Iszi does that make sense?

interesting:

isc.sans.edu/diary.html?storyid=11725

security basics in 140 chars or less

Scott Pack

1:41 PM

Oh yeah, this is Information Security Awareness Month. ISC is going to have something every day related to that.

Usually some good stuff comes out of them during October.

Rory Alsop

I'm planning a big blog post after the Scottish Financial Crime Group Conference on the 27th as well - they do a lot of good stuff

I drafted some stuff about the OWASP AppSecEU conf but others did it way better than me, so I gave up

on the blog post side of things, we have one scheduled for the 18th, but nothing else...a good time for people to draft up any topics they like for the fortnightly ones, and it looks like we have 2 possibles for the QOTW - if someone fancies drafting one for this week:

1

Q: Vote for your QOTW #12

For QOTW #12, scheduled for publishing to the Security Stack Exchange Blog on 7 Oct, please post your topics as Answers, and vote for your favorite question from the whole Security Stackexchange site. Please post any question that you feel is worthy and your reasons. Try not to promote your own ...

And I think we need more bears on stackexchange.com/leagues @ThomasPornin

He's go the same on crypto - impressive bear-ness!

Iszi

1:59 PM

@RoryAlsop Makes sense to me, I think. Mind adding a comment on the thread there?

Rory Alsop

@Iszi done - how does that look

Iszi

@RoryAlsop Okay, except I think the "fix" is not applicable to the audience in this question. Question was from an end-user perspective, and the fix looks like it's on the server/development side.

Scott Pack

2:15 PM

I'm really enjoying thinking of @Thomas as a bear. :)

Thomas Pornin

@ScottPack huliq.com/10473/…

I am pleading Not Guilty !

Scott Pack

I'm going to blame my theatre background, but my first thought upon hearing someone called a "bear" is something a bit different.

Iszi

@RoryAlsop Wow. I'm surprised physical security was so low on the list.

Rory Alsop

@Iszi yeah - surprised me a wee bit too. Odd call

@Iszi yes - valid point

Iszi

I liked the "WEP = Unencrypted Wi-Fi" note.

We need to get a picture of Smokey The Bear saying this... or, maybe just @ThomasPornin: "Dear User: Millions of $$ of software won't keep you from clicking that link. Only YOU can prevent link clicking."

Oh, I like this one for a future QoTW...

1

Q: How to deal with tunnel applications such as TeamViewer on the corporate network

Our IT department uses TeamViewer to provide support to users at remote locations. More recently we've noticed that users are using TeamViewer to get support for their lab equipment from vendors. Though I support the idea, it does bug me a little bit that someone could either accidentally or ma...

corporate-policy remote-desktop tunneling

AviD

4:40 PM

@Iszi why? "P" comes after "O" , its more than halfway through the alphabet. You did realize the list is alphebetical, right? ;)

AviD

6:02 PM

hey, any you guys use digsby?

was getting ready to use it, when I read their Commitment to Security:

> When your IM, email, and social network account passwords are sent to our servers they are encrypted using the plain text version of your Digsby password, which is not stored anywhere on our servers.

Iszi

@AviD Never heard of it.

AviD

great, but WTH are they sent to your servers in the first place??

Iszi

@AviD Synchronization between devices?

AviD

@Iszi actually pretty cool multi-client, for IM / email / social networking / etc

Iszi

I think Trillian behaves similarly.

AviD

6:05 PM

@Iszi hmm... okay, maaaaybe.

Ninefingers

> You send the hash of your password and that is compared to what we have stored in order to authenticate you.

AviD

yeah, that reminds me of a certain question here....

Ninefingers

I'm having a horrendously bad day after an epic fight with apt-get, so I think I'm just going to sit here and weep at that.

AviD

OTH, that still doesnt help get at your encrpted IM pwds.

except for bruteforcing those hashes....

Iszi

Is anyone else ever tempted, when you know someone calling you is a "wrong number" caller, to answer the phone as "911, what's your emergency?"?

AviD

6:09 PM

hehe

Ninefingers

@AviD no, but if you send a hash, the hash is the password. If you acquire the hash database, to log in, just send the hash to the server.

AviD

@Ninefingers obviously.

thats the question i was referring to....

Ninefingers

ah ok, sorry, bad day.

AviD

authentication with them doesnt really give you much, other than access to your profile there.

hmm, perhaps also the encrypted IM pwds... but you need the original pwd to decrypt that.

that is, thats what I'm guessing - trying to verify that the client logs into the services, and not proxied via the server.

didnt see any traffic heading there.... but then I was only looking at http.

Thomas Pornin

@AviD You do not want your data to be exposed publicly, if it is "only" password-encrypted.

So it makes sense for a server storing your password-encrypted data to serve it only to authenticated clients.

In the context of password-based encryption, you cannot prevent the storage server from having enough data to "try passwords", but that does not mean that you want to give the same power to, say, the whole population of Russia.

AviD

6:16 PM

@ThomasPornin of course.... ?

think I'm missing your point.

Thomas Pornin

@AviD Possibly I missed yours, too. Deuce.

AviD

hehe

okay, I'll clarify:

I know there are certain insecurities there, just from that page. In general, most of that doesn't bother me, if the rest is solid.

specifically, I dont care about e.g. my digsby profile, but i care about my IM/email/etc pwds and data.

so hypothetically, I'm not too worried about the whole "hash is your password" thing; as long as that doesnt grant access to my other pwds.

Thomas Pornin

@AviD Ok, I understand better now.

Based on your quote, they do not store your Digsby password; but that does not mean they they never get it.

Possibly, they store:
1. your IM/email/etc data, encrypted with a key derived from your Digsby password;

2. a hash of your Digsby password.

this would imply that there is a point during authentication where the server has your encrypted data and the password simultaneously, which is "suboptimal".

Things are better if they use a challenge-response based password verification scheme, in which case they would never have a copy of your Digsby password even transiently

or if, even better, they use PAKE (e.g. SRP)

Now that I have looked at the page, what they do seems clearer.

You have a Digsby password P

and some data D

E_P(D) (encryption of D with a key derived from P) and h(P) are stored on the server

to authenticate you send h(P)

so they never store or even see P itself

they can do an offline dictionary search on P (that's theoretically unavoidable, since they store your secrets in a way which can be unraveled with knowledge of P)

by sending h(P) you actually show that you already know enough to perform an offline dictionary search on P, so there is no harm in giving you E_P(D)

Of course, this is reasonably secure only as long as the key-derivation from P and the password hash h(P) use proper salt/iterations/bcrypt. The documentation does not give enough information on that.

AviD

6:40 PM

@ThomasPornin yeah, thats kind of what I was thinking.

@ThomasPornin reading between the lines, its pretty clear that they're not using bcrypt, and probably not iterations.

furthermore, it looks like the IM pwds are not stored on the client at all, meaning that they are retrieved encrypted from the server on logging in, and decrypted clientside with the remembered digsby password

Thomas Pornin

@AviD That's cloud computing. Very fashionable.

Mind you, it is convenient. I recently switched my main machine, and my StarCraft II saved games followed automatically.

AviD

of course.

and, if thats the case, I think id be okay with it.

flaws and all....

18 hours ago, by AviD

Iszi

@AviD Image not found

AviD

was more worried that the digsby server acts as a proxy to the im, performs a login for me.

pretty sure thats not the case

@Iszi aww.... @rory said they got /. - traffic load pretty heavy

Its hard to maintain a standard when everything you see is nowhere near it.

4

Thomas Pornin

@Iszi It is there, just very slow.

AviD

6:50 PM

You know how medical staff can, over time, lose their sensitivity to unspeakble trauma?

in that context, I can accept that their not using PAKE / bcrypt / other things beyond the bare minimum....

Thomas Pornin

AviD

heh

that onefte actually has a lot of priceless items....

Iszi

@AviD INF again.

AviD

awww maaaan

Iszi

Shopping recommendation &// too localized...

0

Q: pyhisical laptop lock for dell n4030

I brought this really great laptop, but i cannot find something that i can lock the laptop physical to the desk or avoid thief's from grab this laptop There is no "universal" hole there that 99% of the laptops... not that ive noticed at... (I mean thing like that: http://www1.dealextreme.com/pro...

authentication wifi

AviD

7:00 PM

think it should be generalized....

Iszi

@AviD Nah, I think flat-out closed.

Thomas Pornin

@AviD If you edit, do not forget the typo in the title; it makes my eyes bleed.

Iszi

@ThomasPornin Yeah, what is that? "Pie-high-sickle"?

"Puh-high-sickle"?

AviD

hows it look now?

Iszi

Still gonna result in a product recommendation(s), which is not what SE is for.

And FFS... why did he initially tag it as authentication wifi?

AviD

7:05 PM

@Iszi umm.... poor random generator?

I find that non-regulars usually use very random tags, even when there are some obvious ones.

on the other hand, his laptop does HAVE wifi, right...?

@Iszi wanna have a try and be more explicit?

Iszi

@AviD These days, that's generally presumed. Unless N4030 is some twenty-year-old product.

@AviD I don't see any way this question could not result in "product recommendation" answers. Though, now that it's more generalized, it may still be something worthwhile here.

AviD

@Iszi ah, so thats why it has that tag. Can someone please create a tag for keyboard dvd? I'll go ahead and add usb to the q.

@Iszi thats my hope.

Iszi

@AviD You're not serious, are you?

AviD

I meant the 2nd half, duh

Stack Exchange

Stack Overflow Blog: SE Podcast #21

Posted by Alex Miller on October 5th, 2011

This week, Jeff & Joel are joined (in studio, no less) by David Fullerton, head of the NY Dev Department, and Jason Punyon, a developer here in the office. Its a fast moving discussion covering all kinds of topics, like:

Stack Exchange 1.0 (which gave users wanting their own Q&A site the Stack Exchange software, without being official Stack sites) is touched on. Jeff discusses the clones that exist and their reason for existing.

Trello’s launch caused some kerfuffle on Web Apps.SE when general (and off-topic) help questions started being asked. In the larger sense, they discuss the necessity of applications and products to have their own unique help service. …

AviD

7:11 PM

"something worthwhile"

Back!

Front!

:P

7:40 PM

Y'know, it'd be nice if that "Firefox is already running..." dialog would have a "Kill Firefox" option.

M'vy

8:00 PM

sure

Thomas Pornin

@Iszi Would it count as murder or suicide ?

this.josh

@Iszi Disagree here. Laptop theft is a serious problem, and OP is asking for a solution.

Oh it's been edited thats why it looks ok. Sorry, catching up

Thomas Pornin

@thisjosh However, Google says that the Dell n4030 has a Kensington hole, so the OP has not only failed to do some basic research on Google, but also on the laptop that he has under his eyes.

Can a question be closed for OP laziness ?

this.josh

@ThomasPornin Unless he bought a grey market knockoff in which case he may not have a Kensington hole.

boy my editing sucks.

Actually the picture is of insufficient resolution to determine visually and the technical spec don't list Kensington hole.

Yep, it's intended market is Malaysia.

dell.com/my/p/inspiron-14-intel-n4020/pd

Thomas Pornin

8:21 PM

@thisjosh <quote>This product is unavailable. Below we have suggested a like or better computer to satisfy your immediate needs</quote>

Damn, how do you typeset a quoted block in chat ?

this.josh

I think you use single quotes

Thomas Pornin

anyway, when I follow the link I have the spec and photos of an Inspiron 14, not the same computer type.

this.josh

Oh oops, poor fact checking on my part.

Yes its the 4020 instead of the 4030

You know it dings me every time you edit that post :P

Thomas Pornin

@thisjosh Of course I know it. I am perverse that way.

2

Serves you right for giving me faulty syntax advice.

this.josh

Somewhere there is a test chatroom intended to let you experiment, but I forgot where it is.

Found it chat.stackexchange.com/rooms/1/sandbox

Thomas Pornin

8:41 PM

@thisjosh Ah, I got it. You begin the line with a '>'. It is not compatible with linking the message to a previous message

this.josh

Maybe you could request a chat improvement.

Iszi

9:13 PM

@ThomasPornin Y'know, I was trying to find that, and didn't. Linky?

Ninefingers

@ThomasPornin remember you can edit (and therefore view the source) of any chat message as a mod! Yes I can ! Awesome !

Iszi

> This product is unavailable. Below we have suggested a like or better computer to satisfy your immediate needs

@ThomasPornin Like that?

Use a greater-than with a space after it at the start of the line.

Thomas Pornin

@Iszi asianic.com.ph/product/dell-n4030-dos

@Iszi Yes, that's what I found by trying in the sandbox.

this.josh

Anyone read this:

technologyreview.com/business/38714/?p1=BI

Rory Alsop

9:47 PM

ey up +/- etc

Thomas Pornin

@RoryAlsop Hello visitor.

Rory Alsop

:-)

Thomas Pornin

You should get a new bronze badge in a few hours

Rory Alsop

ooh - which one?

and how can you tell?

Thomas Pornin

for the web-application

Rory Alsop

9:49 PM

I tried to monitor that sort of thing ages back and failed so I gave up:-)

I'm assuming that one of the data.se things will tell you?

Thomas Pornin

I saw that you had 21 responses for a total of 99 upvotes

so I upvoted one of your answers for that tag

apparently, such tags are awarded once per day (per night)

Rory Alsop

Yay :-) cheers - (Occam's Razor should have suggested that would be how you knew:-)

this.josh

Anyone feel positive about cloud + security?

Rory Alsop

@thisjosh Hahahahahahahahaahahahahahaaaaa

Thomas Pornin

@thisjosh Yeah, I am positive : I know "job security" when I see it.

this.josh

9:56 PM

@RoryAlsop Thats my general feeling, the article "Being Smart about Cloud Security" in the Technology review (published by MIT) seems too optimistic to me.

So I have to ask "Then what's your worst-case scenario for organizations that shift to the cloud?"

Rory Alsop

@thisjosh I have written an article which may end up in the ISACA journal early 2012 on just a few of the issues which most organisations will come up against -

lack of location control for data

lack of control over copies of data

lack of control over jurisdictions

lack of segregation of duties

lack of control over dynamic/volatile asset registers - leading to licencing issues

resilience

increased attack surface

...

etc

this.josh

Human sacrifice, dogs and cats living together... mass hysteria!

Rory Alsop

LOL

this.josh

And thats just the SysAdmins!

Rory Alsop

likely case: not realising beforehand that what was easy before suddenly becomes impossible, leading to fines or sanctions for data protection or other regulatory failures

this.josh

10:02 PM

Who knows what will go on in marketing?!

Where'd my cloud go? Whose responsible for the cloud, Frank, Jim?

poor visibility into responsible parties

zigackly

fingerpointing

Hey @RoryAlsop!

you saw the news about some company that monitored elderly care patients through 'the cloud' and lost all connectivity for an extended period of time? They had NO backup solution!

@Mvy evenin'

Bon nuit - izzat right?

M'vy

How are you?

Bonne nuit (Good night)

this.josh

10:05 PM

None? Not even some paper?

Rory Alsop

@Mvy not so bad - had a charity day today so got to play Guitar Hero at lunch time:-)

M'vy

But usually not to greet someone, but say goodbye :P

Rory Alsop

@thisjosh nothing accessible within 24 hours, which was longer than their BC/DR plan could cope with

@Mvy ahh

Thomas Pornin

@RoryAlsop I heard a wonderful (thus probably fake) anecdote about an automatic defibrillation system in an hospital

M'vy

I'm may visit your country soon @rory

Thomas Pornin

10:06 PM

According to the story, there are those patients in successive beds,

Rory Alsop

@ThomasPornin at least this incident wasn't quite that bad:-)

this.josh

Their DR plan could not cope with over 24 hours? Who wrote it?

Rory Alsop

@Mvy Yay - whereabouts? and when?

M'vy

Nottingham

Rory Alsop

@thisjosh yup - that bad:-)

M'vy

10:07 PM

probably end of next week

Rory Alsop

@Mvy Nottingham is unfortunately far away in a different country:-)

M'vy

Yeah, I though so too :P

Rory Alsop

if you were coming to Scotland, particularly to Edinburgh - I'd offer you a drink:-P

Ninefingers

@RoryAlsop splutters different country eh??!!

Thomas Pornin

when one has a failing heart, the system automatically sends electric shocks. But one of the programmers was using Fortran and the other assembly, so when patient 11 got a heart issue, that's patient number 10 who got the shocks -> in a few minutes, 11 dead people.

Rory Alsop

10:08 PM

@Ninefingers :-)

@Ninefingers Oh flower of Scotland - oh, sorry - you guys beat us in the rugby:-)

Good match though

this.josh

@ThomasPornin Sounds false, no hospital would buy a machine for each patient, too expensive.

M'vy

@ThomasPornin LOL :P

Sounds indeed false.

Ninefingers

@RoryAlsop I'm not sure we can necessarily say we played all that great tbh - you had us on the ropes for almost the entire game. In some ways after that effort I almost feel sorry for the Scottish team. They played a great match.

M'vy

Kind of a geeky joke. (Hope it's false... cause 11 deads would be bad)

Rory Alsop

@Ninefingers I did think we had it in the bag :-(

this.josh

10:11 PM

And the nurses union would have a fit if they were replacing nurses with machines

M'vy

And that would imply the system are connected to some central monitoring?

Rory Alsop

@thisjosh aye

M'vy

"Oh sorry, we could not have revived you, there was no service. Please accept our apologises for the incovenient"

Thomas Pornin

@thisjosh In France they replace nurses with Spanish nurses and the unions do have a fit.

Ninefingers

@RoryAlsop I didn't actually watch the first half, but I could tell that was the case from the language coming from those actually watching it...!

this.josh

10:13 PM

Wonder who the replacees are in Spain...

Thomas Pornin

@thisjosh All down that path lies Somalia. Where people just die.

this.josh

Thats was my guess, somewhere in Africa.

I call it employment turger pressure. National boundaries and laws act as a semipermeable barrier against a pressure from the difference in wages and conditions in different countries.

Thomas Pornin

@thisjosh Osmosis of Human Capital

this.josh

@ThomasPornin Exactly, but I don't like to refer to people as human capital.

reusable skill containers is however acceptable

3

Ninefingers

10:40 PM

0

Q: Securing data by physical isolation

I was having a conversation recently discussing security approaches. It had to do with the idea that data placed on a networked device can never be completely secure. In the age of the Internet and on-demand data availability, are there situations where data security and integrity is so importa...