Me and a few more users on CodeReview are making a "chat translator"
We called it Memer
The idea is that when someone says a meme, instead of asking endlessly what it means, the user runs a Javascript and it interprets the messages with a title and a link to the meta post
There are memes common to whole Stack Exchange. But after spending some time in The DMZ it becomes evident that Information Security has it's own memes (e.g. rory).
I therefore propose that this space be used to document the memes endemic to Information Security's culture.
One meme per answer p...
@IsmaelMiguel you can't carry in an egg into the US, then you'll be arrested, similar to not being allowed taking in certain animal derived foods or raw vegetables
And it is unfit because kids would try to swallow the entire egg, without checking what is inside
@RоryMcCune I would love to! As long as he doesn't stab me 37 times in the chest and takes off my hands, cook and eat them. Or swallows me when trying to pour a drink for him.
@LucasKauffman What does it say about a country where they have to ban an egg because kids would choke on it?
@IsmaelMiguel eeehm, Ketchup is banned in france for use in schools, marmite is banned in Denmark, Absinthe is banned in several countries still, certain jelly sweets in the EU
@LucasKauffman Ketchup may be a health-related thing, no idea what marmite is, Absinthe is a really strong drink and most can't handle and certain jelly stuff may have chemicals that may not be healthy
@AviD it's because when you go over the first 20 minutes to 30 minutes your brain produces a natural sleeping hormone, so if you wake up after an hour you just feel sleepy because you've still have all of it in your system
@LucasKauffman Honestly I would not choose any algorithm which has not yet been at least "stabilized". From what I see, the really important thing is not the algorithm you choose, but how you configure it (CPU usage, memory usage...).
The rumour seems to be that Argon and Catena are somewhat in the lead.
@LucasKauffman I have not looked at them in details.
In fact I am not overly fond of the whole "memory hard" theme.
The idea of memory hardness is to make life hard for an attacker who builds his own ASIC, but most discussions on ASIC begin by assuming that the attacker can get the same technology as Intel for the same per-chip price, which is unrealistic.
What I tend to prefer are designs that use a moderate amount of RAM, enough to prevent GPU-based optimizations, but not too much to avoid making servers DoS themselves.
@LucasKauffman It is not bad for what it was designed for, which is disk encryption; but for an authentication server, it tends to suck up resources for no actual benefit.
The main problems with bcrypt are the limitation on password length, and the limitation on output length. Both can be solved easily (a hash on input, a KDF on output) but this would need some standardization.
@ThomasPornin I have recently arrived at the opinion that for organizations with their own networks (not cloud based stuff), it's much simpler, faster and just as secure to have a dedicated server in an isolated part of the network perform HMAC with a key that doesn't leave the server. Do you agree?
@TerryChia This makes sense -- however, big organizations are usually completely unable, administratively, to actually install and run a server with the required isolation.
@LucasKauffman You can process way more requests (HMAC is much faster than an appropriately configured KDF), it's impossible to bruteforce without the key.
@LucasKauffman If you do all the password verification in a dedicated server (or some HMAC as @Terry suggests, which means that the server does not need a database), then that server can limit throughput arbitrarily.
The idea is to have a server that is not hijacked while the rest of your network is plundered.
@AviD We've already established you're doing @Simon's mom. And now you say you're supposed to be subject to some "Bro code" in relation to @Simon, therefore you're also @Simon's brother - hence, a literal "mooger fooger".
@LucasKauffman PBKDF2, as a whole, takes as inputs a password (secret) and a salt (non secret), and expands it into an arbitrary-length output (usually to be used as a key).
HMAC takes as input some data (secret or not) and a key (secret) and outputs a fixed-length MAC value.
Say I'm a normal Internet user [...] what are the chances that I will get hacked or malware find a way into my PC?
100%
