The DMZ

@RoryAlsop If I went to my boss and was just like, "Meh, I could do it, but I can't be bothered." I feel like intelligence is not the word he would use to describe me.

Rory Alsop

12:32 PM

@raz Cats think nothing of our human ways. They go, "haha - you work! I get fed just by being cute and fluffy. Now let me go back to my meditation on the nature of string theory"

raz

haha

Where's that "This is not a question" reason when you need it...

-1

Q: Is there any advantage in using LUKS + hardware encryption on SSD?

I think there are none. They would be just slower and useless. They might protect you from basically the same threat model. Am I right or am I overlooking something?

I honestly don't know what to flag that for, but I know it should be flagged.

Rory Alsop

@raz have tried to improve it

marginal improvement

M'vy

nice, seems new android can manage users

Xander

@AviD I do what I can. :-)

raz

@M'vy What do you mean? Linkage?

M'vy

12:43 PM

@raz Android 5 on my new phone has user profile

Meaning I can switch it to guest if I lend it

raz

@M'vy 5.0.2?

Oh damn... there it is

That's awesome

M'vy

yeah

raz

Oh geez... switched to Guest

Took a hot second for it to set up, but that's kinda nifty. Good for kids who share a phone.

M'vy

yap

Damn that new phone is really big... maybe I should have check the specs firsts

raz

@M'vy "That new phone"

M'vy

12:51 PM

motorola nexus 6

160mm high :)

raz

Damn that's a big phone

The OnePlus is pretty big, I know the OnePlus2 is going to be smaller. Likely a Galaxy S4ish size.

M'vy

However it's pretty damn cool for reading or browsing theinternet

raz

@M'vy And games!

M'vy

@raz oooh yeah I should check that

probably could run hearthstone :)

raz

@M'vy It says it's waterproof.... time for science!

M'vy

12:56 PM

@raz well, don't be silly. My last one went in the washing machine

90 degrees, pre-wash program, dirty clothes program

not keen on testing that now :)

raz

@M'vy Nonsense, it's for science! Video it, and tag Motorola. Bet you get a new phone out of it if it fails. Then it's a wash

He's back...

0

Q: Why isn't MSWindows product code kept secure?

Yesterday I have noticed MSWindows product code on KFC's machines is exposed to the public (photo below). It might be a mistake but it made me think of something a friend of mine told me once, how he used to go to Internet cafes and copy the product key either from the back of the machine or use...

physical

M'vy

1:11 PM

@raz Who is?

Oh... He is!

TildalWave

1:44 PM

I don't remember who he/she is, should I?

wasn't ever in DMZ as far as I can see

M'vy

@TildalWave there's been mention in the last week

raz

He's responsible for trolling questions such as:

58

Q: Can I fly with a gold bar?

Can I fly with a Good Delivery gold bar? I'll have the certificate that I have been given with it. I have looked on Google and found nothing that suggests it's a prohibited item on an aircraft. It's below the weight I am allowed to carry in person. I'll be taking it to Moscow, flying from Heathr...

air-travel

And

15

Q: Can I pass through the airport security with a de-activated Bazooka?

My flight is from Washington, D.C. (IAD) to London Heathrow , with British Airways. Important Details The Bazooka will be bought legally from a shop in Maryland British Airways' website explains in details the policy regarding decommissioned firearms. The Bazooka is de-activated. UK Violent C...

air-travel airport-security british-airways firearms

TildalWave

@raz my bazooka is always deactivated during airport security checks

I was never told I can't board with it tho :)

Rory Alsop

@TildalWave depends on who does the frisking

M'vy

Well, never brought one. Does not fit hand luggage.

TildalWave

1:53 PM

@RoryAlsop has to be same gender and that just doesn't do it for me :P

Rory Alsop

@TildalWave me either, but I figured I shouldn't judge :-)

raz

2:19 PM

@TildalWave Need to tell them, "I'll sign a waiver to allow him/her over there to frisk me ;)"

@AviD how does this edit get approved?? security.stackexchange.com/posts/94215/revisions

M'vy

@raz Marian Paździoch reviewed this 15 mins ago: Approve

Author approved

raz

I mean there's even stuff that can be fixed, but they didn't even try

M'vy

@raz Well it's still improvement and author agrees so...

raz

They're just all

Iszi

@raz Wow. First time I've seen that meme. Girl looks downright demonic!

Get it off the screen!

Get it off!

Get it off!

raz

2:26 PM

lol

Iszi

Hm. What's that line limit, there?

'Cause, seriously... it's still on my damn screen.

raz

hahaha, apparently there is one...

M'vy

The sky?

Yeah there is a char limit in messages

not sure how many

raz

This is the song that doesn't end

Iszi

@M'vy Thanks, that's better.

@M'vy Not talking about the character cap. Talking about the vertical height limit, after which the message becomes scrollable.

Rory Alsop

2:28 PM

@Iszi you haven't seen the Ehrmagerd girl before?

Ehrmagerd!

M'vy

@Iszi oh

Funny... gpg --armor option does not work as last parameter

.ssh : drwxr-xr-x !??!?!

Iszi

@RoryAlsop No. I think my first exposure to the term was something on SF&F related to STNG.

raz

`$ gpg --armor
gpgv: invalid option "--armor"`

Iszi

Ah, here it is.

Haven't found the SF&F Q yet though.

And there it is.

22

Q: Is this from an actual episode of ST:TNG?

Is this an actual, unaltered (aside from the text!) screenshot from a ST:TNG episode (or movie)? What is the explanation for Troi's face?

star-trek star-trek-tng

ManishEarth

@Xander I'm back to being a regular pleb :'(

(internship over. got the option of coming back for a job next year)

M'vy

2:37 PM

@raz well it does work, probably not standalone

gpg --armor --output mvy_arm_pub.gpg --export yves.stadler@gmail.com works

raz

@ManishEarth Nice, where at?

ManishEarth

@raz MS India

raz

Not a bad gig

ManishEarth

@M'vy is there any time when you don't want to use armor?

armor should be the default, gpg --binarycrap should exist instead

M'vy

@ManishEarth not sure. Bulk transmission of keys accross server using scp?

ManishEarth

2:40 PM

@M'vy how often does that happen :)

most regular gpg use is with text

M'vy

yeah sure

ManishEarth

bulk stuff is not something you do every day

Terry Chia

@M'vy Honestly, how much does that save you?

Transmitting text is cheap. :P

M'vy

@TerryChia Hey hey hey don't ask me, I've just been trying to guess a use case:)

ManishEarth

I'm actually surprised that text is not the default for something this old

Madara Uchiha

3:04 PM

Boop

Amelia

Beep

Madara Uchiha

@Amelia "hello sir, i have moneyz for you, i need a transaction fee of 400 u s dollarz" is an attack that (sadly) works regardless of an authentication scheme.

The user willingly sends the money to an attacker

Rory Alsop

Everyone, please welcome @MadaraUchiha and @Amelia - we were having a grand conversation in TL on security when @JeffFerland pointed out we should move it here

Madara Uchiha

The trigger for said conversation is this meta post: meta.security.stackexchange.com/questions/1874/…

M'vy

damn too many blues here

Amelia

3:07 PM

I was only pointing out that my bank's password requirements were disgusting, then got roped in ಠ_ಠ

M'vy

@RoryAlsop Oh great

Rory Alsop

And before anyone tries any knee jerk reactions to @MadaraUchiha's post, he is really interested in the objections to SQRL and wants to know why it is a bad idea

AviD

@raz I dont know, why you asking me?

Madara Uchiha

If a social attacker wants to get me to do an action, they'll do it regardless of the authentication scheme

If a social attacker wants to get information out of it, I literally have no information to give out.

AviD

somebody approved it. its not wrong, just not that much better.

M'vy

3:08 PM

Hello @Amelia @MadaraUchiha

Madara Uchiha

I don't know the contents of my private key, and giving away the private key is an action I never have to do (as opposed to giving out my password), so requesting it from me will sound weird.

So again, I fail to see what kind of social attack works here

Amelia

@MadaraUchiha At the same time, malware is just as horrifying

AviD

@Amelia all banks' are

Amelia

Now instead of finding your key out as you authenticate, I just authenticate when you go to sleep, utterly ruin everything you love, burn it to the ground and then take a dump on it. For science.

raz

@AviD Because you're the one who hoots and hollars at people when stupid things happen around here

AviD

3:11 PM

yesterday, by AviD

@Xander no no, I dont yell, I hoot. I'm a hooter.

Madara Uchiha

@Amelia Malware is a different topic

And if you keep your private encrypted with a passphrase, I'm not aware of a malware that can get it.

raz

@AviD :D

AviD

@raz heh okay yeah

Madara Uchiha

Of course, social engineering vectors would work on the passphrase

AviD

although often its @Simon making the noise while the stupid things are happening

Madara Uchiha

3:12 PM

But now you have to fool the user twice! Once to install a malware, and once to get them to type their passphrase in a context you like.

M'vy

raz

@AviD This is true, @Simon would agree with me.

M'vy

^ as a reference :)

Jeff Ferland

I think if you have something installed, typing in any context is sufficient to scrape from.

Madara Uchiha

And if the user has been fooled twice, well. No social engineering prevention methods can stop a user's stupidity.

Rory Alsop

3:13 PM

@MadaraUchiha recently saw a wonderful piece of malware that successfully got victims to carry out 5 separate activities, all of which are stupid!!!

Madara Uchiha

That's why social engineering attacks still work despite all prevention methods.

Rory Alsop

@MadaraUchiha not all...

get rid of all your customers = much safer :-)

Madara Uchiha

@RoryAlsop Again, I'm still waiting to hear what kind of social engineering attack could get me to give you any sort of usable information

AviD

@MadaraUchiha to be perfectly honest, I dont remember the details of SQRL right now, and dont have time right now to review it. I just remember how cluelessly broken it was...

But moreover, the instigator of the idea is well known to be a security idiot and cause damage often.

Rory Alsop

@MadaraUchiha you seem to think a social engineering attack has to get you to give me something

Amelia

3:14 PM

@MadaraUchiha you are not the target for that; you have more than half a brain.

Rory Alsop

It doesn't. If I can get you to do something, that can also be a win

Madara Uchiha

@RoryAlsop There are two kinds of social engineering attacks

AviD

Listening to any ideas Gibson has on security is akin to asking Donald Trump for suggestions on unemployment.

6

Madara Uchiha

One to get me to give you info, and one to get me to perform an action

Rory Alsop

@Amelia and that is mostly true - but some very smart people get fooled by clever soc eng attacks

Amelia

3:15 PM

I forgot how pure gold this room was

3

I've not been here in over a year

Madara Uchiha

@AviD I really don't know who Gibson is, and I really don't know what he said before

But I guess that makes me unbiased against him, so that's good.

Rory Alsop

@MadaraUchiha ahhhh - quite famous

we did have to make sure there was no bias

Madara Uchiha

@Amelia And assuming I did

Rory Alsop

@Terry - I can't remember, did we have to tone down some of the comments?

Madara Uchiha

I have a private key on my phone (one I'm not really aware of, because I have half a brain)

Attack me, like one of your french girls.

3

AviD

3:16 PM

@RoryAlsop "infamous"

Rоry McCune

@MadaraUchiha I'm surprised you say that as in the top answer to the original question right at the top of it is a link about Mr gibson...

M'vy

hum, I fail to see how the authentication is done. At each login, the app generates a key-pair??

Madara Uchiha

@M'vy Yes

Rory Alsop

Well, now I have thrown the grenade into the room, I must apologise - I must run. Luckily this room is full of people much smarter than me

Madara Uchiha

And the site-specific public is deterministic

Rory Alsop

3:17 PM

And @Simon

:-)

Madara Uchiha

So when I authenticate the first time, it also serves as registeration

Rory Alsop

catch you all later

Amelia

@RoryAlsop slander and lies, I will not be called smart

Madara Uchiha

The second time, the server already has the site-specific public stored, so it knows to associate me with a known account

AviD

@Amelia oh cool! didnt know there was a Freelancing.

M'vy

3:19 PM

hum, what happens if you lose the key then?

Rory Alsop

@Amelia I said smarter than me :-)

M'vy

e.g. losing the phone?

Simon

@raz I wouldn't dare to.

AviD

@RoryAlsop @Amelia he was obviously talking about @Simon.

Amelia

@RoryAlsop I thought that wasn't very hard? :p

3

AviD

3:20 PM

@Amelia BOOM

raz

@RoryAlsop Well no one can be older...

AviD

@Amelia I recommend you watch your Phrasing

Amelia

Well, @RoryAlsop is ~~getting old~~ older than sin.

Simon

@AviD pls

M'vy

s/getting//

Madara Uchiha

3:20 PM

You keep saying that one can social engineer with SQRL, but you still haven't given me a workable example here :P

ManishEarth

@Amelia @RoryAlsop can't get old. getting old means that the concept of time and aging applies to you. @RoryAlsop predates time, and thus it doesn't. He just is old

Madara Uchiha

Hellooo, Madara Uchiha in the house?

Simon

What's going on? Does it take that many mods to handle me now?

Amelia

Lol

Also your moderator elections are uhh... interesting. And terrifying. Mostly terrifying.

8

M'vy

Well, as of my fast understanding of it, I see a potential failure in account recovery

raz

3:22 PM

@Simon Yes

Rory Alsop

Hang on - I haven't left yet. Being old, it takes me a long time to get into my going home boots :-)

@Amelia llamas are mostly nice. Mostly

raz

@RoryAlsop Mostly harmless

Amelia

I'm voting for the Llamas with Hats guy

Rory Alsop

@raz oooh - good crossover

M'vy

There is just no way to correctly authenticate a lost account, since: you don't have the public key anymore, or don't have the master password

Rory Alsop

3:23 PM

@Amelia heh

Amelia

CAAAAAAAAARL

Simon

@Amelia NO, NO, NO. They've spent 2 weeks doing this here in the past.

M'vy

And in the case the user know the master password, then revealing it allows anyone to generate the key-pair

Amelia

Rory Alsop

right - I'm really going now. You can get back to slagging off my age. Just remember, I invented this universe....

Simon

3:24 PM

@Amelia NOOOOOO

You're retrigger their craziness.

Amelia

@Simon YESSSSS

Simon

@AviD Look away, look away.

AviD

TOO LATE

Simon

We're doomed.

Rоry McCune

@Simon quick throw some doughnuts at the tigger

Amelia

3:25 PM

Or some baby hands.

Simon

@RоryMcCune It might indeed be time for the emergency dozen of donuts box.

Rоry McCune

@Amelia another person who has memorised/been scarred for live by CAARRRRL I see :op

AviD

anyway @MadaraUchiha, to the point of your meta post:

> 1. is misleading
2. ranks high on Google searches for SQRL
3. reduces the site's reputation with actual experts.

Terry Chia

@MadaraUchiha I don't really recall the technical details of the protocol and I don't really care about it but I'll point out one obvious problem. You are entirely reliant on the "app" to do the right thing. Passwords have no such issues.

Madara Uchiha

@TerryChia Passwords have all those issues

If you don't have a password manager, you have a lot of other problems

And if you do, you're reliant on it doing things right

AviD

3:28 PM

1. no, the original spec is what is misleading. it was reviewed several times over, by various experts - including a bona fide leading cryptographer. All shown that using SQRL is ridiculously incompetent.

2. Good - that is the point. Hopefully nobody will be negligent enough to actually use it.

3. No, the other way around.

Terry Chia

Also, even if the protocol has no obvious flaws it has absolutely zero chance of catching on because it is designed by a single person with obvious reputation issues in the security community. It is therefore a waste of time to spend any effort on the topic.

Rоry McCune

@MadaraUchiha can't say that I agree with that. I can easily see what my password manager does as it's just copy/pasting text...

Madara Uchiha

@RоryMcCune Hardly. If that's all it does, your password manager is doing it wrong.

M'vy

ooh so the master key is backed up somewhere

AviD

@TerryChia agree about the waste of time, but it DOES have obvious flaws.

dont remember the details though.

Madara Uchiha

3:30 PM

You're saying it as though the password manager is a glorified excel file with site -> password mapping

@AviD Link please?

Terry Chia

If you want something with a good design and a hope of succeeding, look at fidoalliance.org.

Amelia

@RоryMcCune A password manager does quite a bit more than that. Mine verifies code signatures of processes it pastes a password into.

Rоry McCune

@MadaraUchiha I disagree. I use a password manager that is a flat encrypted file and I copy/paste things into/out of it

AviD

ooh I'd have to digging. not the time for it now... though I'm sure (without rereading) the answers on the original question cover most of it.

Rоry McCune

@Amelia some password managers do, it's not a valid blanket statement

Amelia

3:31 PM

@RоryMcCune no verification? :<

Madara Uchiha

@RоryMcCune Great! So you know it's encrypted and that it does things right

Rоry McCune

@MadaraUchiha I know it's encrypted 'cause the file format it uses is a open and has been verified yep

Madara Uchiha

But how is it different from looking into the SQRL client and seeing it does things right

Rоry McCune

@MadaraUchiha I don't have to do it, there's multiple implementations of the spec. which are cross-compatible

Madara Uchiha

@RоryMcCune Waiting for your point here. How does that statement fail with open source SQRL clients?

Terry Chia

3:32 PM

@MadaraUchiha No, with passwords you are absolutely not reliant on password managers for remembering secure passwords. It helps but it's not necessary.

@MadaraUchiha How are you planning to get your open source SQRL client on iOS again?

Rоry McCune

@MadaraUchiha I didn't make any point relating to that at all, I said I don't have to rely on My password manager to do any "magic" it's an encrypted repository of text

Madara Uchiha

@TerryChia By putting it in the app store and releasing its source?

Amelia

@TerryChia My password for my password manager itself is a diceware password with around 12-16 words in it that I had to memorise over the course of 2 months

Terry Chia

@MadaraUchiha How does "releasing its source" help me to verify that it's indeed the same thing that you release on the app store?

Madara Uchiha

@TerryChia How does anything help you do that?

I can say the same with binaries you download and install on your computer

Terry Chia

3:34 PM

@MadaraUchiha It doesn't. Hence why relying on a "secure client" is a broken assumption from the start.

@MadaraUchiha Yes, but with PASSWORDS I don't have to rely on anything I install on my computer.

Madara Uchiha

@TerryChia Until you have to remember 40 different passwords for 40 different services

Terry Chia

You keep forgetting that the main reason why nothing has replaced passwords so far is because it's versatile.

Madara Uchiha

Then your choices are a password manager, a predictable passowrd generation scheme (the site + my phone number), using the same password for everything, or a password manager.

M'vy

well anyway, SQRT is > target the master key

Amelia

@TerryChia There's nothing better that's as easy to implement. And even password implementation gets screwed up.

Madara Uchiha

3:37 PM

@TerryChia No, the reason is that it's conceptually easy to understand and implement

Amelia

If you want something to get adopted, make it so simple that your grandmother could implement it in software.

(Bonus points if your grandmother can code)

Madara Uchiha

@Amelia It's simpler than OAuth

Simpler to implement that is

AviD

@MadaraUchiha well, of course it is, OAuth has all that pesky security mixed in.

M'vy

And for social engineering, well you make a www.paypa1.com site, and present the real paypal QR code to the victim. Then it logs you in. Or am I missing something ?

Oh for the social part, you send a fake email asking the person to check his history

Terry Chia

@MadaraUchiha You clearly do not want to accept my points so I'm done. Like I said I have no interest in debating a protocol that has a less than zero chance of seeing widespread adoption.

I object to removing my blog post. If you disagree, feel free to write up something of your own.

AviD

3:39 PM

@TerryChia the fact that it has zero chance of adoption is of much less interest than the reasons why it should not have a chance of adoption.

Xander

@Amelia Not just implement, but use as well. Single factor authentication using a password imposes fewer demands on application users than any other system.

Terry Chia

@AviD Yeah, but the fact that it has zero chance of adoption means I can't be damned to go read the spec again to put together a coherent argument.

AviD

@TerryChia don't make it personal. Your blog post should remain for 2 reasons: It is correct, and the fact that it appears high in google results makes it more unlikely that somebody might make the mistake of using it.

Amelia

The first person to make a proven-secure system that is hilariously easy to implement, and hilariously easy to use will get a yacht.

Any yacht. Even a 4 billion dollar one.

Xander

@M'vy Then it logs the www.paypa1.com application in to your www.paypal.com account.

AviD

3:41 PM

@TerryChia that claim would stand even if somebody came up with a genuinely wonderful solution.

M'vy

@Xander yeah, my point exactly

Xander

@M'vy Ok, wasn't sure if you were stating or asking.

M'vy

@Xander asking for confirmation I guess

I've just read the site for a small amount of time

Xander

@M'vy Then yes, confirmed. :-)

AviD

@Xander yeah that part of SQRL reminds me of those apps for picture authentication like Oracle was offering - "you dont even need SSL!"

Terry Chia

3:43 PM

If we want to debate an actually good authentication alternative, look at fidoalliance.org.

Xander

@AviD Ha ha ha.

M'vy

Maybe the QR code thing could be a "shortcut" authentification

Xander

@TerryChia Speaking of, that reminds me, I need to set up my Yubikey.

Simon

Scanning QRs is deadly annoying to me.

M'vy

like you set up a real account, with fully fledged sec measures (login/pass/2FA/whatever)

AviD

3:44 PM

@M'vy not at all, how could QR be authentication?

M'vy

and you generate a master key that you can later revoke

AviD

just cuz it doesnt "look" like a password?

@M'vy when people say key I assume we're talking some form of cryptography key.

In that, I find SQRL to be very disingenuous.

M'vy

@AviD Well, at this point, it could generate the keypair instead of a so called "master key"

AviD

@M'vy how would that work in a browser, exactly?

M'vy

@AviD You create your account. Request a new keypair. Put it on the phone.

Then for log in you use their actual system

AviD

3:47 PM

@M'vy wait, are you talking something like the [Google|MS] Authenticator app?

because yeah, that is a very good system.

but I thought we're talking about something else.

M'vy

@AviD Well not exactly, because you still perfome signatures

AviD

yeah okay I think I may have gotten lost in this conversation.

anyways, I gots to log off for the weekend...

M'vy

Basically, you associate a keypair to your account :)

and use that to sign the login challenge

Xander

You know what's also deadly annoying? Using a password manager, and then having to enter account creds on devices that don't support password managers or keyboards. Like entering my Netflix password onto a DVD player. Such a hassle.

The burdens I must bear, all in the name of security. I tell you what.

Amelia

M'vy

3:50 PM

@Xander well, you know:security - bears...

:)

AviD

but one last word to @MadaraUchiha and @Amelia - there really are a ton of incredibly smart people here, who are very focused on precisely this type of thing. There are a lot of aspects to consider, a lot of threats and risks from different directions. Modeling all of these, in addition to usability aspects, is what they do best. It is tricky to avoid cargo culting it, when basing on so called "best practices" - thats why it is so much work to model each context specifically.

Amelia

@AviD Oh, I'm aware. I was never in the SQRL debate, for the record :p

AviD

@Amelia I noticed, but you got dragged into this room for it, figured I'd give you a lice of pie.

Xander

@Amelia Yes you were. You know you were. STOP DENYING IT, I SAY!!!

AviD

security pie.

Xander

3:53 PM

@AviD Mmm...Lice pie.

M'vy