« first day (1674 days earlier)      last day (3211 days later) » 
04:00 - 16:0016:00 - 23:00

4:08 PM
@Amelia pls
 
@Simon I'll run away now :p
 
I just found the answer to about five hundred different questions on the site.
This is a real book. http://t.co/H9v2LtVrCg
2
 
@AviD I saw your latest TL message in the sidebar
Please quote that out of context here
 
@ManishEarth go for it
 
best if you do it yourself :)
 
4:10 PM
nah, already closed that window. And now Imma close this one.
 
was it the webscale one?
 
@ManishEarth Don't leave us hanging, here. Drag it on over.
 
@Iszi He just said WEB SCALE in all caps
it was somehow hilarious out of context
well it was hilarious in context too
 
raz
Is there a Language SE?
0
Q: Is it ever acceptable to pluralize the word "encryption" to "encryptions"?

LamonteCristoI am trying to revise the grammar of someone who insists that the following sentence is correct In Cryptology, encryption is the process of encoding messages or information, and there are different methods, levels, and types of encryptions His rationale is that it's a noun, and nouns can b...

 
4:24 PM
@raz Is that supposed to be like "maths" or something?
 
raz
@Iszi shrugs I'm bad at maths and englishes
 
anglish
 
raz
Cananglish
 
ehglish
 
Adi
> moderator positions available 1
 
raz
4:27 PM
Just saw that
 
raz
Did you doubt @Xander?
@Xander Thanks dude
 
There it is
too bad the onebox doesn't load the graphic.
 
@tylerl You mean the cover? Looks fine from here.
 
4:34 PM
 
hm. maybe it's my browser
i get a broken link.
 
@tylerl Stop using Lynx.
 
@tylerl Me too.
 
Actually, looks like the link has an invalid cert. So if your browser doesn't care, it'll show the picture.
 
4:35 PM
Jesus Christ, are you guys trolling or something? It displayed fine to me the 3 times you guys posted it.
 
So apparently your browser is TOTALLY COOL with invalid SSL certs
 
It's HTTP.
 
@Simon It's a schemeless URL.
 
oh. So with that simple test we can see who browses DMZ w/o TLS
 
@tylerl That's actually kind of fun.
 
raz
4:39 PM
@tylerl Dude DMZ doesn't even have public audit records
 
I don't see the point of using SSL here.
 
raz
How am I supposed to trust this connection anyway
 
@Simon Hmm...I have a book in mind for you.
 
@Xander Can you see the cover, son?
 
raz
4:41 PM
@Xander Even if you put https:// in front of that link the connection doesn't go secure.
 
@raz The connection to what? The image?
 
@Iszi It's The DMZ, not Paypal for donuts sake.
 
@Xander Yeah. You can put HTTPS in there all you want, but the OneBox still shows up over HTTP.
 
@Iszi Yeah, because a scheme-less URL tells the browser to determine what protocol to use based on the current context. So, there is no http:// or https:// in the link, regardless of what you paste it. It's based on whether you're viewing the page (the chat room) over HTTP or HTTPS.
 
Oh, chat supports HTTPS? When did this start? Why don't they just enforce it then?
 
raz
4:45 PM
ahahahaha
 
So, yeah. Switching chat to HTTPS breaks the Amazon images. But I also have mixed-content warnings.
 
raz
"Reading this book was like having a religious experience. My life will never be the same. The only thing that would make this book better is if it was bundled with a 55 gallon drum of lubricant to assist physical penetration testing."
 
@Iszi It sort of supports it. It's mixed content and buggy, but it generally works ok. HTTPS Everywhere enforces it for me.
 
@Xander I'll have to double-check my rule set. I seem to recall killing some SE HTTPS rules 'cause they broke stuff.
I need to get on some rep trains or something. Would like to make Trusted User by the end of the year.
 
raz
@Iszi Don't worry I'm sure there will be another OpenSSL bug or 4
 
4:49 PM
@raz That's no help - @ThomasPornin just pwns those.
 
raz
@Iszi Yeah but even if you get 20 votes to his 100, it's worth it in a day.
 
Speaking of 100...
95
A: How to distinguish between a scam and a genuine call?

IsziIf you're worried about the authenticity of a cold-call, don't try over-the-phone authentication in either direction. Simply ask for some basic information you can use to refer to the issue in follow-up: Name of the company/service the account is for. What is the nature of the problem? Is there...

(Shameless plug.) Just need 5 more.
Pretty sure that'd be my first Great Answer network-wide.
 
raz
Solid answer
 
@raz Thanks.
 
(lol j/k)
 
4:54 PM
@tylerl Asshole.
(lol j/k)
 
raz
ahahaha, but seriously he downvoted you
 
@raz Nope. Zero downvotes on the post.
 
 
2 hours later…
6:28 PM
Didn't actually read this (TL;DR for now), but could someone explain why it might have automatically been flagged as possibly low quality for LENGTH & content?
 
@Iszi my guess would be that it's just excerpted sections from anothe SE answer so that's why, but TBF the commenters did ask for that..
 
raz
@Iszi If you look at the original post it was a link-only answer. It was then edited to be a fair answer.
 
@raz Oh. So somehow it was still in the queue after the edit?
 
raz
@Iszi Yeah, that happens a lot
I don't know why the it doesn't get removed, but there are quite a few reviews I've done where I've had to look at the edits. I don't think it should have been deleted. It wasn't the best answer, but not the worst (after edit)
 
@LucasKauffman Heh. Spray it on your OPMs...
 
@Iszi I don't think they get automatically removed. I know several I've flagged in the past have been declined (correctly) for the same reason. The OP came back and edited them into reasonable answers after my flag.
 
7:38 PM
YES!
removeable battery, AND and SD card slot.
 
@DavidFreitag and waterproof.... I wonder what location services chip they'll use
would be nice to see one with Galileo support for future proofing
 
@tylerl In order to keep the login system from being completely idiotic, I disabled TLS for the chat.stackexchange.com domain, but now that they have "fixed" it, perhaps I can instruct https everywhere to start doing its job again.
 
aww that's a wish list I thought it was definite stuff
 
@RоryMcCune It still won't be Verizon compatible (although the transceiver they are using IS compatible, Verizon are just dicks).
 
@DavidFreitag Ah, right. That's why I killed it.
 
7:43 PM
@RоryMcCune Crap - that's right. Check page one for definite specs.
SE login was completely impossible through https, so if for some reason you need to login you need to go via http, and https everywhere doesn't really enjoy that.
Sheesh, 1900 page datasheet, that must be a record.
 
@DavidFreitag Perhaps they don't understand the definition of the term "sheet."
 
@Xander Granted, the sheer amount of peripherals for this device really requires that many pages. Recently Atmel has been splitting datasheets, so you needed three or four for one device. Honestly I prefer the monster 1900 page one.
BREAKING: UCLA Health System is victim of a cyberattack, estimates data of up to 4.5M people may have been involved, no evidence data taken.
I wonder if @LucasKauffman is going. youtube.com/watch?v=8L7LuXlETkw&feature=youtu.be
 
8:12 PM
@DavidFreitag those tickets were sold out instantly
but I have a few colleagues going
 
@LucasKauffman I'm sure they were. I would love to go to one of those shows.
 
@LucasKauffman Yeah I know of them, I'm a fan.
@LucasKauffman They are doing a livestream of tomorrowland this year, FYI
 
last year as well
T
R
I
V
E
G
A
S
sweet party imo
 
Greetings
I have a very quick question that isn't worthy to post on the website
But it is security related
 
Sorry the delay
Well
The question is pretty basic
Imagine you have a password abcd, and you salt it with abc
Then you will hash abcabcd
Now, imagine that you have the password bcd and the salt abca
Together, it also makes abcabcd
Is there anything to stop this kind of thing, besides fixed-length salts and putting the salt also at the end?
 
@IsmaelMiguel good password hashes don't work like that, they don't just concatenate the salt and the password
but, anyway, they usually use fixed-length salt
but, anyway, and it's important to understand this if you want to understand password security: collisions are not important
What matters is how hard it is to find one valid password given the hash
If there are other valid passwords but they're all hard to find, the hash is good
 
But if 2 passwords generate the same hash with different salts, something fishy is going on
 
To give an extreme example, if you don't hash passwords, there's no collision ever, yet that's pretty much the worst “hash” you can make
@IsmaelMiguel No
 
Alright
 
8:27 PM
A hash is associated to a specific salt anyway, so you don't even have a collision
 
But salts aren't meant to be secure
 
It is a subtle point, but what matters is that it's hard to find one valid password
 
Just unique
 
yep
 
That's conflicting
 
8:29 PM
A password hash does not have the same objectives as a general cryptographic hash
With a password hash, the objective is to make it hard, given the hash, to find a valid password
If there are multiple valid passwords, that's not intrinsically a problem. It's only a problem if there's a way to find a valid password easily.
If you have multiple valid passwords, but finding them takes super-astronomical time, that's not a problem
 
Alright, thanks a lot for the help
That really is some cool and important info
 
Read Thomas's answer on password hashes, it's really good
430
A: How to securely hash passwords?

Thomas PorninThe Theory We need to hash passwords as a second line of defence. A server which can authenticate users necessarily contains, somewhere in its entrails, some data which can be used to validate a password. A very simple system would just store the passwords themselves, and validation would be a s...

 
I have read it before, at least 3 times
But I'll read again in a while
 
And do remember that something like SHA2(password+salt) is not a good password hash
a good password hash is slow
 
like whirlpool or blowfish with 2000 rounds?
 
8:33 PM
that's the basic idea, but use functions that cryptographers have analyzed: PBKDF2, bcrypt or scrypt.
 
And php5.6 password_hash?
 
@IsmaelMiguel no idea, I don't do PHP
beware that there are a lot of broken libraries for PHP
and a lot of terrible advice, including on SO
 
anyone want to give me $120,000 so I can have a car with a setting officially called "ludicrous mode?" techcrunch.com/2015/07/17/…
 
Alright.
Thanks a lot for the help
I must go before I lose my dinner
 
8:53 PM
@RоryMcCune These people know their market.
 
@ThomasPornin indeed, given that they're teasing another upcoming car that'll do "maximum plaid" techcrunch.com/2015/07/17/…
 
> Which of following vulnerabilities can be prevented completely with proper input validation?
Select zero or more correct items. Erroneous selections will be penalized.

Bruteforcing
CSRF
DDOS
Command injection
SQL injection
XSS
Some of the questions in this competition are daft
> Which of the following tips could be followed to make a system more secure?
Select zero or more correct items. Erroneous selections will be penalized.

Always use strong passwords
Antivirus software should be disabled when using the TCP protocol
Antivirus software should be disabled when using the UDP protocol
Passwords should be stored using a strong, reversible encryption method
Systems should automatically log the users out after a few idle minutes
The newest version of a system should never be used as it is likely to contain unidentified vulnerabilities
I wonder if they're marking “Passwords should be stored using a strong, reversible encryption method” as correct or incorrect
they seem to be using a learn-by-rote approach to security
> The following code snippets are from a web application written in PHP. Point out and briefly explain what problems you see in them.
It's written in PHP, need I go on? (@AviD)
3
 
@Gilles Hang on, there was a question on the site today from a guy who claimed he got it while applying for the Finnish military cyber-security forces...And the question is on that page.
Oh, wait. That's a Finnish site. This may explain things.
Answer the questions on that page, and apparently you too can have a career hacking things for the Finnish Army.
 
@Xander I don't speak Finnish, but that site does seem to be related to the Finnish army
link?
 
9:10 PM
13
Q: Guessing random bit with 100% accuracy

JV JVI am soon to start my compulsory military service. I applied to the Cyber Warfare Unit of Finnish army. There was a test for applicants. Since the test is done the questions have now been published here: http://erityistehtavat.puolustusvoimat.fi/cyberchallenge.html Here is question 4: Two co...

Ah, it even has the link to that page in the question. I missed that earlier.
 
I see nothing abnormal there.
 
@DavidFreitag all the programs have .exe at the end, what's with that?
 
@DavidFreitag Chrome and IE are launched at the same time. This is fishy.
 
@Gilles They must be using Mono, or something.
 
There is a security product (F-Secure) that is not using 95% of the CPU: this is unrealistic.
 
9:21 PM
It could simply be spyware.
 
@ThomasPornin it must be a bug in the display, 100.01% wrapped around to 0.01%
 
20
Q: Is it good practice to send passwords in separate emails, and why?

ArlixI have heard from different people and in different places that if I send an encrypted file to someone else, I should send them the password in a separate email; but why? If someone is sniffing, they will capture both and if the inbox is compromised, they will capture both. But apparently, it's "...

 
@DavidFreitag Seriously, I suppose that they expect you to notice the process with no name (PID 6388) and possibly (in the left column) the "rundll322.exe".
 
I love how the answers on that question COMPLETELY MISS THE POINT.
@ThomasPornin Nope, that's SynTPHelper.exe which is a synaptics touchpad driver.
 
@ThomasPornin my guess is the cmd process that's a child of IE
 
9:27 PM
@DavidFreitag OR SO THEY SAY.
 
@Gilles Yes, that's my guess. It terrifies me.
But, again, there's nothing abnormal about that.
 
@Gilles It could be an ActiveX control that launches cmd.exe to run scripts. I know people who develop like that.
 
@ThomasPornin True, it could be malware masquerading as a synaptics driver. Your best bet is to unplug it and cleanse the malware with thermite, or something.
 
10:05 PM
We need a mod to protect this question:
15
Q: Guessing random bit with 100% accuracy

JV JVI am soon to start my compulsory military service. I applied to the Cyber Warfare Unit of Finnish army. There was a test for applicants. Since the test is done the questions have now been published here: http://erityistehtavat.puolustusvoimat.fi/cyberchallenge.html Here is question 4: Two co...

cc: @RoryAlsop
Oh, nevermind. It's on hold.
Call off the alarm.
Sorry @RoryAlsop
 
Sheesh, keep pinging @Rory why don't you.
 
that question could use more downvotes
 
You raaaaannnggggg?
 
@Gilles Yup, the answers have just cost me 4 rep.
@RoryAlsop Sorry. False alarm. Question getting crap answers. Thought it needed protecting. Turns out it's on hold. Nothing to see here. Move along.
 
10:24 PM
Lol
In other news, if anyone wants to copy and paste some of the detail from the chat earlier, feel free:
0
A: Debunking "Debunking SQRL" - Blog article is misleading

Rory AlsopAs discussed in chat - the Sec.SE community disagrees with your points 1 and 3, and agrees with point 2. 1 - The article is logical and describes why the proposed solution is flawed. 2 - This article ranks high on Google searches for SQRL 3 - Increases the site's reputation with experts So the ...

 
10:45 PM
@mikeazo “Meat in the middle attack” is a great name for a sandwich! — Gilles 9 secs ago
2
So what's the recipe of a sandwich called “meat in the middle attack”?
 
04:00 - 16:0016:00 - 23:00

« first day (1674 days earlier)      last day (3211 days later) »