The DMZ

David Freitag

14:00

@Simon Exactly. And I don't want my first manual to be a "YOLO it's $30k, but it has a warranty!" sort of run

Simon

@DavidFreitag You'd have to be an absolute donut to mess it up even if you don't know how to drive stick.

You won't ruin the clutch/tranny during 1 month of bad shifting/clutching.

Thomas Pornin

@DavidFreitag In France everybody learns to drive with a manual transmission. You can learn on an automatic transmission, but then this will be mentioned on your driving license and you won't be allowed to drive a car which does not have an automatic transmission.

David Freitag

@Simon There exists the possibility, and I'm not willing to take the risk.

Simon

@ThomasPornin Yes I've heard about that and that's pretty funny!

David Freitag

So, I will buy a car for $1000, and if I junk it, I don't really care.

Thomas Pornin

14:01

@Simon Unless you shift to reverse while driving at 120 km/h on the highway.

Some modern cars have a failsafe in that case.

Simon

@ThomasPornin I'm scared about that whenever I drive my car immediately after I've driven my friends'/gf's.

Rоry McCune

@Simon @ThomasPornin it's the same in the UK

Simon

@RоryMcCune Good boys, force all the donuts to learn stick!

David Freitag

Plus, what exactly do I gain? Gas mileage? It's 18-25 base, how much better can it get? Shift time? It's a 3.7L V6, compared to the 5.0L V8 in the GT ($33k base) it won't matter anyway. Coolness factor? It's my car, I will love it, and I don't really care what you think.

Simon

You don't want to be the kind of guy who says, after your friend tells you that he bought a super car: "I don't drive stick".

David Freitag

14:03

None of my friends have even the remotest capability to buy a manual.

Simon

Capability to buy? Why not?

David Freitag

Even my best friend who is the biggest car nut I know has an automatic.

Simon

@DavidFreitag Then I can assure you that he's not a car nut.

David Freitag

@Simon That weird green papery stuff - I think it's called money, or something.

Simon

lulz

David Freitag

14:04

@Simon I can assure you you're very wrong.

Simon

He sucks at life then.

David Freitag

If his car was offered in a manual I'd be he'd have had it.

Simon

I hope so.

But yes, when I bought my first car which was stick, I believe that I had driven manual in the past less than 5 times.

David Freitag

Both cars tick my major boxes. Pretty? As fuck. Fast? Good enough. Bluetooth stereo? Check. Gas mileage? Well... it's not 7. Reverse camera? kcehC.

@Simon I bet your first car wasn't ~$30k though.

Simon

@DavidFreitag Sure but if I had the budget to buy a car worth 30k, it would have been manual.

You're not gonna wreck it unless you forget how to use the brake pedal.

David Freitag

14:08

@Simon And presumably you learned to drive stick on a car that wasn't your first car

Simon

You're just gonna look like a donut at the red light when you're gonna stall.

@DavidFreitag Driving in a parking less than 5 times is not enough to learn.

David Freitag

@Simon I learned to drive in the span of 20 minutes in the parking lot outside the DMV just prior to getting my license.

In a $2000 1997 Ford Explorer that was purchased for me.

raz

@DavidFreitag What state do you live in? I want to avoid it.

CodesInChaos

I took 30 ish lessons and still barely passed my test.

David Freitag

@raz I have been driving for five years. No accidents, no tickets.

raz

14:12

@DavidFreitag 5 years?

David Freitag

@raz 5.

raz

I went 10 with no accidents

And it wasn't my fault, these things happen.

David Freitag

I'm just saying there's no need to presume that I'm a terrible driver...

Simon

I went 7 with no accidents :(

raz

Just because you haven't had an accident or a ticket doesn't make you a good driver.

Simon

14:13

I popped my accidents cherry this winter.

raz

@DavidFreitag No need to presume you're a good driver :P

CodesInChaos

I think it's an insult to the word automatic to call a care where only the transmission is automatic an "automatic car".

David Freitag

Unless you count the incident that I had this past winter with a snow bank an accident. No damage, and no insurance claim, but I did slide from the road into a 4' deep bank of snow.

CodesInChaos

What google is building, that's an automatic car.

David Freitag

@CodesInChaos s/Autonomous/Automatic

I fucked that up I think..

raz

14:15

@DavidFreitag Eh that happens too. I did a 180 doing 10mph on ice. I wouldn't count that anyway.

Steve DL

And even an automobile car

ah

ah ah....#

David Freitag

@raz Regardless, none of my passengers have erupted from my vehicle after a prolonged exposure to my driving hugging the ground for dear life.

CodesInChaos

Automating 10% of the driving work doesn't deserve such a pompous name.

Simon

@CodesInChaos If you believe that driving is only about following the road and not even controlling your gearbox so be it.

David Freitag

@CodesInChaos If you have a vehicle with automatic transmission, adaptive cruise control, automatic GPS navigation, automatic headlights, and automatic wipers, is that good enough?

CodesInChaos

14:17

That might get you to 20%.

David Freitag

You literally have to punch in a destination, get it to a road, and that's it. It will stop when you get there.

raz

@DavidFreitag is that because they died?

David Freitag

@raz Damn you saw through my clever plan...

Simon

@raz lololol that's funny.

David Freitag

The boot in my car is easily large enough for four bodies.

raz

14:19

@CodesInChaos It's not an "automatic car". It's a car that has an automatic transmission.

CodesInChaos

@raz But most people shorten it that way

raz

@DavidFreitag Nice! You're a mobster aren't you. Plastic in the boot.

Simon

@CodesInChaos And we all know that people are referring to the transmission.

Unless you're a donut, living in Germany.

raz

@CodesInChaos True, but they are incorrect.

David Freitag

@raz Pfft, it's teflon coated with a water-tight sealable drain valve.

raz

14:20

@DavidFreitag Damn you're a pro.

CodesInChaos

@DavidFreitag Perhaps 5 years from now, we'll get such self driving cars. Probably longer due to bureaucracy.

raz

Sound insulated?

David Freitag

@CodesInChaos Then how, praytell, do you get the other 80%?

@CodesInChaos Uuuuuh, no. Any S Class Merc since 2010 has all of those features.

@raz Why does it need to be sound insulated? The dead make no sound.

CodesInChaos

@DavidFreitag So it automatically looks out for children jumping on the road, stops at red lights, etc?

Simon

@CodesInChaos Only grown-ups, they don't care about children.

David Freitag

14:24

@CodesInChaos Yes to the former, but alas no. Not red lights, and not stop signs (unless there is someone in front of you). But then.. that's why you are there.

But all you need do is lift one leg and ever so gently place it on the peddle on the left for a sufficient period, and simply remove it, and the trek continues.

That deserves at the bare minimum an automatic rating of at least 80%.

CodesInChaos

what about automatically changing lanes on an autobahn?

raz

@DavidFreitag Always be prepared for the Zombie Apocalypse.

David Freitag

@CodesInChaos Simply flick the lane changers. Sensors detect an empty lane and change for you.

Adi

I'm having an IPSec crypto issue

David Freitag

@raz That's the undead making noise.

Iszi

14:27

Does anyone (esp. LastPass) actually do this?

Surely it must hash the password client-side before performing authentication, because they cannot send the password itself (that's part of the promise: they don't know your master password). But I see a way out now: client sends a hash, server hashes it with 100,000 rounds and compares that against the stored hash. This makes my entire question redundant. I think I should close it. — romkyns 48 mins ago

Adi

@Iszi LastPass does hash the password client-side

Iszi

@Adi But that's not the hash that's stored, right?

CodesInChaos

It hashes them again with PBKDF2 on the server side, not sure why.

Adi

@Iszi According to what they promise, they run it through their key derivation algo again and then store that

Iszi

@CodesInChaos Because if they store the same hash that is transmitted, then the stored hash effectively becomes the password.

raz

14:29

^^

CodesInChaos

But for that a cheap unsalted hash would be enough.

Adi

@Iszi Well, according to them, they don't

Iszi

@CodesInChaos Arguably.

Rоry McCune

@Adi your first issue is that you're using IPSec (blech)

Adi

Would it be possible for a MiTM who knows the IPSec shared secret (in Cisco VPN stuff it's called "group auth pass) to intercept the connection between the client and server to sniff credentials used in domain auth?

raz

14:34

An interesting question

1

Q: TOR makes multiple connections - why?

When using TOR, I issued this in terminal sudo netstat -punta | grep 443. Output was tcp 0 0 x.x.x.x:y a.a.a.a:443 ESTABLISHED 5769/tor tcp 0 0 x.x.x.x:y b.b.b.b:443 ESTABLISHED 5769/tor tcp 0 0 x.x.x.x:y c.c.c.c:443 ESTABLI...

tor

Iszi

@CodesInChaos Problem is, using a "cheap unsalted hash" server-side still makes it too easy to crack the stored hashes regardless of what you're doing client-side. Since the client-side methods are known to the attacker, all they have to do is duplicate that for the top X most common passwords and then run the "cheap unsalted hash" against those once.

CodesInChaos

@Iszi Why are you assuming the client side hash is unsalted?

Iszi

@CodesInChaos Hard to say what value that would really add, or how feasible it would be without compromising significantly on other fronts.

CodesInChaos

You need the slow client side salt anyways, so the encryption is secure.

Iszi

@CodesInChaos Encryption of the connection is independent of how the password is hashed (or not) prior to transmission.

CodesInChaos

14:39

But you need to encrypt the password-database on the client

so the server doesn't learn your passwords

Thomas Pornin

@Adi If you know the shared secret then you can decrypt the packets, at which point your question becomes: does passive sniffing reveal credentials in domain auth ?

As far as I know, the answer is: it depends...

Steve DL

@raz i suspect OP is relaying traffic too

Thomas Pornin

It depends on what Microsoft did for authentication. My bet is that you will obtain, through sniffing, a hash of the password, not the password itself.

Steve DL

@raz or different connections for different sites

Adi

@ThomasPornin In IKEv2, the shared secret is not a component to generate IPSec SA. The shared secret is mainly used for mutual authentication.

Iszi

14:41

Uh-oh: downforeveryoneorjustme.com/weakdh.org

Steve DL

from the FAQ " Tor will reuse the same circuit for new TCP streams for 10 minutes, as long as the circuit is working fine. (If the circuit fails, Tor will switch to a new circuit immediately.)

But note that a single TCP stream (e.g. a long IRC connection) will stay on the same circuit forever -- we don't rotate individual streams from one circuit to the next. Otherwise an adversary with a partial view of the network would be given many chances over time to link you to your destination, rather than just one chance. "

Iszi

According to Google's cache, it was up just yesterday.

Adi

@Thomas So passive sniffing isn't really possible

@Thomas You'd have to actively intercept a user's attempt to connect to the server, impersonate the server, and then pretend to be the client and authenticate to the server with the shared key

@Thomas Then when the real client is ready to send his actual password, you can just sniff it

At least this is what I'm thinking

Simon

Wait, what is passive sniffing?

Adi

@Thomas In the pre-2003 IKEv1, it used to be possible to decrypt passively sniffed packets.

ernw.de/download/pskattack.pdf

raz

14:44

@SteveDL yeah I'm not really sure I only have 2 connection when I bring up a Tor browser.

Adi

I'm concerned with IKEv2

Which is what is used in modern day IPSec

David Freitag

@Simon swissen.in/sniffing.php

Hahah that link is so bad.

Thomas Pornin

@Adi I used to run an IPsec tunnel with a pre-shared key, but it was not using IKE at all; I had manually configured the actual encryption key on both sides of the tunnel (transferred through SSH, basically).

Simon

"just wait fore someone to..."

Mhm, "fore", yes.

Thomas Pornin

If you use IKEv2, then you have a DH key exchange, and the pre-shared key is used only for authentication.

Adi

14:45

@ThomasPornin Jepp. Pre-shared key. This shared secret is something completely different

Thomas Pornin

@Adi Terminology has changed over the years...

Adi

@Thomas I'm getting my info from this crypto.stackexchange.com/questions/9926/… and from the relevant RFCs

Thomas Pornin

My IPsec tunnel was more than 10 years ago.

Steve DL

@raz i posted a tentative answer

possibly incorrect

Thomas Pornin

Anyway, when the attacker knows an authentication-only secret, then he gains nothing as long as he is passive.

Active attacks are possible, namely a MitM.

Adi

14:48

@ThomasPornin Jepp. That's what I was thinking. An active attacker (on a hostile wifi) can launch a full MitM

Thomas Pornin

@Adi That's unavoidable. If the attacker knows all the secrets of system A, then he can impersonate system A.

raz

@SteveDL it's a start at least

I'm guessing it has to do with other connections needed to determine circuits/hidden services.

Adi

@ThomasPornin Jepp. Thanks. I was just looking for a sanity check

Rоry McCune

@Adi you're using IPSec... you fail the sanity check :op

Adi

@RоryMcCune :D

David Freitag

16:55

Hehe, I really enjoy CodeGolf.

16

Q: Bitstring Physics

Background Yes, bitstring physics is a real thing. The idea is to construct a new theory of physics using only strings of bits that evolve under a probabilistic rule... or something. Despite reading a couple of papers about it, I'm still pretty confused. However, the bitstring universe makes for...

code-golf array-manipulation random

> Yes, bitstring physics is a real thing. The idea is to construct a new theory of physics using only strings of bits that evolve under a probabilistic rule... or something.

raz

17:39

"or something"

Awesome! How about bits that process bits into bytes!

Victor Lopez

18:44

Hi

I believe I reached the adequate chat.

raz

Adequate? We're more than adequate

Victor Lopez

intentional privilege escalation: When it is considered a crime? When attempted or when accomplished?

raz

18:59

Depends on the jurisdiction

I would say any unauthorized attempt to gain privileges that you are not authorized to have would be grounds for prosecution or termination of employment.

In a general sense, but it's unlikely you'll run into lawyers here. You might want to consult one in your country/province/state/island.

Victor Lopez

Pretty serious topic then.

Adi

@VictorLopez I intentionally escalate almost everyday. Never had any legal issues

David Freitag

@raz That's not what she said.

raz

@Adi Are you unauthorized to do so?

Stack Exchange

Blog - Stack Exchange: Stack Exchange Podcast #65: The Word Has Two Meanings, You See

Abby T. Miller on June 16, 2015

Welcome to the Stack Exchange Podcast, episode #65, recorded Tuesday, May 12, 2015 at Stack Exchange Headquarters in New York City. Today’s podcast is brought to you by the Association of Airline Mile Programs and hosted by the usual suspects.

We’ll start off with the extremely important and community-relevant subject of why Joel hates frequent flyer programs. It’s a fascinating story and I can’t do it justice in summary. But I will say, for those of you who find it TOO ENTERTAINING AND DRAMATIC, that this story ends around 7 minutes into the show. 7:16 to be exact. …

Adi

19:02

@raz Nobody ever told me not to do it

raz

@Adi Fair deal then

David Freitag

@Adi Ignorance of the law is no excuse. If you do not know the speed limit and you're caught speeding you still get a ticket.

Adi

I had no idea that "intentionally escalating" was illegal.

The laws in the States are strange

My presentation on Security.StackExchange isn't going very well

Victor Lopez

How far an open sandbox designed for arbitrary code execution would allow you to go?

Example, recently in the SO chat we were talking about undefined behavior, double delete, double free and found out that the coliru interface would allow you to execute some binaries.

Adi

I have no idea what to say. Why is it good?

Victor Lopez

19:07

From the sandbox, the sandbox had you access etc/passwd via vim with no content at all.

I found that a serious topic and decided to come up here to understand if I did commit a crime by reading the content from the filesystem, no privilege escalation done, not vertical, not horizontal but was discussed in the forum by the surface.

Sorry, in the chat. Not the forum.

raz

@Adi I see what you did there.

@VictorLopez I feel like if it wasn't intentional then you're probably fine.

Is this at your work?

Victor Lopez

19:25

From home.

raz

@VictorLopez This was through a VPN? I'm confused as to what you did to gain unwarranted privileges.

Victor Lopez

@raz No privileges were gained, just saw the possibility to exploit the system C++ call from here