The DMZ

Iszi

03:04

Oh, yay! My last message hasn't fallen into the archive. Makes me feel like I haven't been absent that long.

this.josh

07:34

Time is an illusion, lunchtime doubly so.

Stefano Palazzo

maybe this question belongs on Security.SE:

0

Q: Encrypting and obscuring data between site/user without SSL

Im trying to figure out what the best way to encrypt data sent between a webpage and the user(both ways) is, when hosted in an environment that doesn't support SSL. The purpose of encryption would be obscuring content for delivery through filters that aid in internet censorship. What ways would t...

encryption

I'd also appreciate any criticism on my rather long-winded answer (especially my assertion that SRP is pretty good for what the user wants to do)

Stack Exchange

07:50

this.josh

actually obscuring may be exactly what is needed

If the censor mechanism is automated instead of intelligent then only a few words or phrases may need to be altered to prevent censorship

Stefano Palazzo

I didn't think recommending obfuscation was so good. Imagine his activities are illegal, and the obfuscation is uncovered

this.josh

It also depends on where the sender and reciever are.

Obfuscation is generally a bad idea, except where it lessens the threshold of detection.

Stefano Palazzo

right

as an additional measure

this.josh

An encrypted communication is almost guaranteed to be detected and flagged

Stefano Palazzo

07:54

mh. that gives me an idea

this.josh

Yes?

Stefano Palazzo

you could make a tree of words, like you would for compressing data, which churns out english words rather than binary words. turning your encrypted data into harmless looking english language text

this.josh

Depends on the censor mechanism. Any intelligent mechanism would regaurd illogical groupings of words as an indicator.

Stefano Palazzo

yes indeed (:

this.josh

Unfortunatly it is likely difficult to know what censor mechanism is operating.

Stefano Palazzo

07:57

I just suspected this user wants to avoid SSL at any cost, like I did a few months ago

because SSL certs are bleeding expensive

this.josh

Not if you self sign

But I get your point.

The format of the data transfer is also important. Words and pictures need different techniques for beating the censor.

Stefano Palazzo

It would be helpful to know what this system is all about

this.josh

Actually what the question is searching for is a mechanism known as a covert chanel.

A method of passing data using normal channels without the sensative data being noticed.

Stefano Palazzo

like putting secret messages into harmless looking http headers?

this.josh

Yes.

But more like sending one word of the secret message in each HTTP header

Covert channels usuall have a throughput rate which is a very small fraction of normal channel capacity.

Otherwise they get noticed.

The lower the transmission rate the harder the signal is to detect.

Stefano Palazzo

08:06

I don't know. that strikes me as security-through-obscurity. You'd need to encrypt that data as well, in which case you still end up with the PKI problem

this.josh

Encryption is also nice, but in the practical problem once a covert channel is detected it usually leads to at least one of either the sender or receiver and from there getting the key is a solved problem.

Stefano Palazzo

very good point

this is why I ended up mentioning perfect-forward-secrecy and malleable encryption.

this.josh

Yes, good counter measures. Being able to remotely transmit and receive are beneficial as well.

Stefano Palazzo

I'm in the same boat (I have to circumvent government spying, not by my own government of course, it's perfectly legal).

this.josh

haha

Stefano Palazzo

08:10

I use off-the-record messaging for that, because it provides all four essential properties (authentication, encryption, perfect-forward-secrecy and malleability)

this.josh

"possible to acomplish for normal visitors" is the real problem.

Stefano Palazzo

yes indeed

this.josh

Providing covert confidential communication to low sophistication resource poor individuals.

Stefano Palazzo

that's exactly why SSL is so great :)

this.josh

And that is why it is disallowed by the censor.

Stefano Palazzo

08:16

I wonder who the censor is

this.josh

That would be China

in this case.

Stefano Palazzo

how'd you find that out?

this.josh

Jayhal = Jayce Haliwell

M'vy

I made a project on covert chanels

this.josh

Jayce Haliwell + google = China

Timing or storage?

Stefano Palazzo

08:19

got it (:

this.josh

@Mvy Timing or storage?

M'vy

Well goal was to send messages

so I guess this goes in storage?

this.josh

Storage requires retrieval, timing does not

M'vy

oh

Stefano Palazzo

@Mvy how does it work?

this.josh

08:21

Timing is encoded in an existing channel

M'vy

So timing

this.josh

Like adding errors to a bit stream as bits in your message

M'vy

we made some python filters to modified HTTP / IP / or whatever you want to add the data

this.josh

Think you can get through the great firewall?

M'vy

Never tried. And the project could use some work still

But our 1st ideas where: using space in HTML documents

Stefano Palazzo

08:23

it would't surprise me if the TCP packets received looked nothing like the ones you sent, if they use DPI. Same thing for the HTTP headers.

M'vy

And we made an example with HTTP headers too

where the idea was to permute them

this.josh

Yes mutability will assist in evading detection.

M'vy

That's steganography though. Not cryptography.

this.josh

True enough. Stefano wants to add encryption to it.

M'vy

The goal is not to encrypt, it is to be undistinguishable from normal data.

Well, at last , we transmit bits

Stefano Palazzo

08:26

yes that's right, I blindly assumed encryption is the only way to do that. given that your algorithms aren't considered a secret

this.josh

Exactly, if the channel is detected it will be destroyed

M'vy

so the message could be encrypted before sending it in the channel

this.josh

Encryption is viable if it does not add too much overhead to the communication.

M'vy

If you're interesseted, I uploaded those files on github

Planned to make a translation in C++ but no time so far.

Stefano Palazzo

yes I'd like to take a look

M'vy

08:27

(And the images are not showing in the doc... I should solve that)

this.josh

How much data can you transmit per packet?

M'vy

github.com/mvy/Demaratus-Framework

@thisjosh Depends on the size of the page

at least for space thing

The header thing is bound to the number of header

Stefano Palazzo

by the way @Mvy, the website link in your profile is broken. it points to /cv/publish/51039

M'vy

oh

That's my private page I guess

this.josh

actually python may be better than C++ for this purpose.

M'vy

08:30

@StefanoPalazzo updated

this.josh

It needs to be done on a web server, likely a shared web server.

an expendable web hosting account

M'vy

Yep

this.josh

and I don't think the majority of those provide c++ compilers

Stefano Palazzo

I see you've also developed a crypto toolkit. I'm trying to do that as well

M'vy

@StefanoPalazzo really?

I've added LFSR for the moment only

Stefano Palazzo

08:32

@Mvy code.google.com/p/zs-crypto

M'vy

Wondering if I should not have one project per ideas, rather than one with all of it.

Stefano Palazzo

the point of the project is to learn how these algorithms really work. if you look at the AES module, it's full of comments.

M'vy

Nice

I think I did RSA with python during my master

Stefano Palazzo

hey maybe we should team up. I implemented RSA yesterday, but it's only the primitive. I planned to add a padding scheme today

M'vy

I'll try to follow your page But for the moment I'm still writing my Ph.D thesis so I don't have much time

Google code uses git? or svn? or some kind of versionning sstm?

Stefano Palazzo

08:36

you can choose either of git, svn or cvs if I remember correctly

M'vy

Right

Stefano Palazzo

this is pretty cool

I especially like the tcpsteg module

M'vy

@StefanoPalazzo I got the images working in the Main.md of doc

@StefanoPalazzo we had to re-develop our regex module for that

Cause we needed one that could work in a flow mode

Stefano Palazzo

I see what's going on there

GET / HTTP/1.1\r\n
Host: 172.16.1.1\r\n
Content-Length: 12\r\n
\r\n
blablablabla

actually, the "1" encoded in this header is indeed indistinguishable from random noise, and without encryption

and since there is a large number of permutations, you can create all possible n-bit messages from the communication

very impressive stuff

M'vy

@StefanoPalazzo the problem here is that headers have an upper bound

so it's slow

But that was a good idea.

Stefano Palazzo

08:49

the message could be a short reference to pre-shared messages, such as "attack at dawn"

M'vy

And good for our project, since it's working on a different layer than HTML content

@StefanoPalazzo good point

or attack at dawn is not so long

can take 2 pages

or 3

Stefano Palazzo

it would be helpful if there was an encryption primitive that is intrinsically slow, so that you could use a very short key

if you need to solve a hard problem to decrypt data, you could get by with a 16 bit key, say, and then use this key to decrypt your steganogaphically hidden message (in a png for example)

thereby reducing the amount of data you need to send through covert channels

M'vy

Yes. There is a lot of thing that can be done. For sure.

Ninefingers

13:51

@StefanoPalazzo I grabbed the git option. That's what I prefer and what it offered me... don't know if svn etc are available, didn't look!

Thomas Pornin

@StefanoPalazzo That exists. It is called AES, with a key derived from a "master secret" through a very expensive key derivation process.

Bcrypt

bcrypt is an adaptive cryptographic hash function for passwords designed by Niels Provos and David Mazières, based on the Blowfish cipher, and presented at USENIX in 1999. Besides incorporating a salt to protect against rainbow table attacks, bcrypt is an adaptive hash: over time it can be made slower and slower so it remains resistant to specific brute-force search attacks against the hash and the salt. Blowfish is notable among block ciphers for its expensive key setup phase. It starts off with subkeys in a standard state, then uses this state to perform a block encryption using part...

Usually done to tolerate keys of low entropy, commonly known as "passwords"

2

Stefano Palazzo

nicely put :-)

Karrax

17:18

How did this answer get 9 votes in this question? security.stackexchange.com/questions/8761/…

It is clearly not what the OP is asking for. There is a big difference between SQL injections using AND 1=1 and OR 1=1

Karrax

17:45

Bleh.. failed posting the question as a big box

4

Q: SQL injection with AND 1=1

Please explain the meaning of "AND 1 = 1" in a SQL injection attack. It's from an exercise in my university. E.g. select * from user where id = 'smith'' AND 1=1;-- and birthdate = 1970; or select * from user where id = 'smith' and birthdate = 1970 AND 1=1;--;

sql-injection

Thomas Pornin

17:57

@Karrax Apparently, most people understood the question as: there is a bug in the question text, it should be 'OR' and not 'AND', and the OP needs to be explained SQL injection since he did not come to that "obvious" answer himself.

Possibly, the OP was totally aware of SQL injection and was nonplussed by the 'AND', suspecting something more than a simply typographic error in his learning material, in which case the highly upvoted answer is inadequate.

But that's a more intricate scenario where the OP is smart instead of being stupid, so there is no wonder that it is not a popular scenario.

Karrax

@Thomas Pornin Thank you for the explanation! :) I just hope he dont try explain his teacher there is a typo in his learning material if it comes to using OR 1=1 or AND 1=1 .

I however do not think that it is a mistake in the learning material. I think the OP just provided a bad example. The meaning of AND 1 = 1 in SQL injection attacks is to create a true / false result.

Anna Lear

18:21

Hey all. Greetings from Programmers. Is this question on-topic for Security?

-1

Q: Paranoid Encryption

Call me paranoid, but I really like to keep my stuff secret, but readily available on the cloud. So, asking this question. How safe and reliable are encryption softwares [e.g., truecrypt] ? The reason I ask is that, what is I encrypt my data today with this software and after a couple of years,...

api encryption

/ping @roryalsop @avid @hendrikbrummermann

Scott Pack

18:36

I think that would be, theoretically, on-topic for us However, the way the question is phrased I would be tempted to NARQ it.

Jeff Ferland

18:54

@AnnaLear @ScottPack I'd say bring it on over.

Scott Pack

I would be willing to withhold flagging, however it might cost you a beer, @Jeff.

Jeff Ferland

As soon as I get my whiteboard mounted above my new desk (hoem or office, they're both misisng), i'll write that down

Scott Pack

New desk, as in recently purchased or at a new place?

Anna Lear

Alright, I'll ship it over to you guys. Thanks. :)

Jeff Ferland

@AnnaLear @ScottPack actually, let's leave it on PRogrammers.... it's more of a "how do I store my data through a compression algorithM" and make it readable

encryption is ancillary

I think the question just ought to be edited in-place

@ScottPack You can still have the beer

Anna Lear

18:57

It appears that the OP got the answer he deemed acceptable while I was checking on the migration, so it's a moot point.

Ninefingers

Sometimes I wish I didn't bother writing long answers. It's far more trouble than it is actually worth.

2

Scott Pack

The highest voted answers seem to be the short throwaways or the @Iszi length with multiple tl;dr sections.

Jeff Ferland

@ScottPack It's either simple & right, or it's simple & right with a lot of extra explanation that is well-organized

Ninefingers

@ScottPack Mmmm. I might curtail the length, simply because that seems to attract upvote mania, which seems to bring a long a slew of people. Some make good points, but on my last three major answers I've done a lot of defending various niggles, uses of terms etc.

Ninefingers

19:23

Oh well; this is the internet I suppose.

Stack Exchange

20:15

Stack Overflow Blog: SE Podcast #26

Posted by Alex Miller on November 9th, 2011

No guest today. Moot had to postpone his appearance on the show. But David Fullerton is here to hang out with us

Jeff is packing up to go on an international trip. He’s going to Øredev in Malmö via Copenhagen and London on British Airways. He will take the train from Copenhagen to Malmö - good choice! Joel is full of handy travel tips. Among them: The chip-and-PIN credit card system is vastly superior to the one we use, which is why it can be tough to get cash overseas! Joel also has packing tips for the cold Swedish weather. Also, freezing eyeballs …

this.josh

21:01

@Ninefingers Really it's stack exchange, but we posit that it has some projection on the Internet.

Thomas Pornin

@Ninefingers You should write answers for the sake of it, not as an effort to please the anonymous crowd.

Trying to attract votes is like going to the zoo: if you do it too often, you begin to wonder who, between you and the chimpanzee, is on the outside of the fence.

5

this.josh

I get to choose my side of the fence?

Lets see, do I want to be in or do I want to run the asylum? Tough choice.

@ScottPack Remember also, that many more people read than comment on your answer. And commenting is generally more negative than positive.

Scott Pack

@thisjosh Indeed.

It takes effort to comment, which generally involves incitement to riot.

4

this.josh

On rare occasions you get purely inquisitive comments.

Oops I was aiming that post at Ninefingers but I hit Scott Pack...

AviD

21:21

so, yeah, a cracked rib is not much fun.

seriously, what's with the medical profession? It's 2011, and the best you can do is say "take painkillers"??

I have a shelf full of liquid painkillers, I don't need a doctor to prescribe them to me.

besides I figured not a good idea to mix my alcohol with my drugs....

so.... what have I been missing?

btw @Rory nice handle on that myqy issue...

this.josh

@AviD Not much.

Even though my senses decieve me I believe the earth still rotates at constant velocity.

AviD

@thisjosh actually I believe that's only relatively constant velocity.

this.josh

@AviD True, Gravity Probe B has proved it!

M'vy

The earth is moving a 0 velocity.

In it's own referential...

this.josh

@Mvy damn referentialists!

M'vy

21:27

^^

As a vengeance against me, take the 1000+ errors LaTeX beamer just throw me in the face.

AviD

even using the earth as the reference point, it is still moving pretty fast.

M'vy

I'm punished :P

this.josh

You probably prefer a left-handed coordinate frame as well :P

AviD

mostly, east and west moving apart.

this.josh

At the equator it is fast, at the poles it is slow.

Thats why rocket launches take place as close to the equator as possible.

AviD

21:30

@thisjosh yeah, but it would feel faster, while you're spinning around that pole.

this.josh

Than and potential toxic fallout from aborted missions.

AviD

curious, is it like a regular household-type stripper pole, or more like the oldschoold barber spinny thingies?

Thomas Pornin

@thisjosh upload.wikimedia.org/wikipedia/commons/2/28/…

this.josh

it's magnetic!

Thomas Pornin

The rotation speed of the Earth is indeed varying, although if you detect that with your own senses then you are a cyborg, or belong to an asylum, or both.

this.josh

21:33

I already said I belong in an asylum, I just can't decide whether to be patient or administrator.

Thomas Pornin

@thisjosh Does it make a difference ? You will always have to deal with the other nutjob anyway.

AviD

@ThomasPornin well the main difference is if you're given pharmaceuticals.

M'vy

Good point

this.josh

@ThomasPornin Plausable deniability.

AviD

Or if you need to provide your own.

this.josh

21:36

Harder to get if you're sane.

But your access goes way down.

AviD

speaking of which...

hmm. no pic onebox.

M'vy

@avid you used the ! ?

AviD

21:53

?

what is ! , @Mvy?

M'vy

exclamation mark

for the picture

AviD

heh, I know that

this.josh

FRF91 android

AviD

@Mvy whats that do?

M'vy

gravatar.com/avatar/…

this.josh

21:54

Not that I'm working with Android or anything :P

M'vy

see the difference?

AviD

heh, dint know about that!

M'vy

first is url, 2nd !url

AviD

thanks!!

M'vy

no pb

AviD

21:56

so how many of these little pills can I take at a time, anyway?

the first two are not helping.

this.josh

@AviD What is your tollerance for risk?

When you are the asset!

AviD

heh

M'vy

^^

AviD

right now its about solving pain

literally

eh, mebbe i just go to bed early. not like I'm any use like this anyway.

unfortunately, doc says it could be up to another month like this... :S

Thomas Pornin

@AviD If you repeatedly whack your thumb with a hammer, you should temporarily forget the pain in your rib.

There might be side-effects, though.

this.josh

22:00

I suspect dosing recommendations are based on a level just before significant side effects begin to appear and are tollerated.

AviD

@thisjosh minus a whole bunch of safety margin.

@ThomasPornin dunno 'bout that....

Karrax

2

A: Is it possible to easily retrieve Thunderbird's passwords with access to HDD?

The answer is yes. ThunderBird stores all remembered email settings along with password into the SQLite database file 'signons.sqlite' in its profile location. The default profile location for different platforms is as follows, [Windows XP] C:\Documents and Settings\<user_name>\Applicatio...

Does it not have wrong tags? Password-policy and

passphrase*

AviD

though I'm sure that changing a flat tire didnt help. well, that was before I realized about the rib...

this.josh

I speculate about 20% safety margin.

@Karrax You can edit them, or you prefer someone else?

Karrax

I know :) I just wanted a second opinion

I dont hang around too much these days

AviD

22:03

@Karrax removed

this.josh

I think tag edits are at your own discression, but then I edit a lot of tags

I wonder how significant tags are in choosing which posts users read.

AviD

@thisjosh to some users, very.

Thomas Pornin

@thisjosh Probably not much right now, because total traffic is still low.

AviD

also, it is very significant for searches.

Thomas Pornin

On the SO main site, tags are everything, because there are just too many questions to read them all.

AviD

22:12

@Ninefingers are you up-to-date on kernel internals for current versions of windows? had an off-site q for you.

not so much a q, more a request/offer.

this.josh

@ThomasPornin Do I need 10k to see traffic statistics?

Thomas Pornin

@thisjosh I do not see traffic statistics either. I was talking about write traffic (number of new questions per day).

I can read them all and it does not take me too much time.

this.josh

Oh, Yes that is low.

Thomas Pornin

Even factoring in my inherent awesomeness, I still believe that there are not many new questions per day.

this.josh

I speculate that writers either don't know the correct tags or dont care about the correct tags.

How to factor Thomas's awsomeness in linear time...

Quantum maybe

Thomas Pornin's Awesomeness is the hard core predicate of IT Security.

AviD

22:23

@ThomasPornin enough for me not to be able to keep up lately....

@thisjosh you'd think, now with Cryptography around - both to occupy him, and to soak up some of our crypto goodness - that would change, but noooo.

this.josh

Cryptography is slower

Ninefingers

23:26

@AviD hello! Good to see you... erm, possibly

Ask away; (email or wherever) and I'll do my best to answer

@ThomasPornin I do write my answers for the sake of it. The votes honestly don't bother me and some of my better ones (in my opinion) are the ones with fewer votes.

Gilles

@Ninefingers I write for myself. Who knows, maybe I'll need the answer later.

And yes, it has happened that I googled something, found a helpful answer on Stack Exchange, tried to upvote it and was told that I couldn't vote on my own posts

5

It doesn't always work, I think I once tried to downvote my own post

Ninefingers

@Gilles Haha. End of a long day earlier. Went away from keyboard to have a bit of me time.

this.josh

23:41

@Gilles Wow, if I did more googling that could be me

Ninefingers

@Gilles Well you have provided an extraordinary amount of answers on unix.se. I've no idea how guys like you and Thomas do it. It's impressive.

this.josh

Has Google really achieved replacement of the verb search without becoming a monoply?

Gilles

@thisjosh google (v.) = search on the web

@thisjosh It is a monopoly. SEO = Google optimization. No Google presence is pretty much synonymous to no web presence.

this.josh

Xerox (v.) = make a physical paper copy, do amazing research, become inconsequential.

Gilles

Similar example: until recently, the French railway authority had a monopoly on long-distance travel by ground public transport in France. Well, no, you could fly or drive or bike or walk, but that didn't make it less of a monopoly

Or: the Democrats and Republicans have a dipoly on American politics. Not completely in law, but de facto

this.josh

23:48

I just find it interesting that Google is clearly a monoply but not regulated like one.

Gilles

There's even a $topic4 (security is $topic4, right?) concern here

I have a dependency on Google and I don't know how to avoid it

this.josh

Topic three by my current view

Single point of failure?

Gilles

Microsoft's near-monopoly doesn't affect me much directly, I can easily run Linux even if only 1% of the world agrees with me

I use Google daily, and have no alternative

because no one pays attention to making their website findable with Google

and Google's competitors aren't really trying (cribbing Google's results…)

so yes, single point of failure

and (this is related) vendor lock-in

this.josh

They do try, but they don't understand why Google is successful, so they can not be better.

Gilles

Google could start charging, and we'd all have to subscribe, just to search for an alternative

this.josh

23:53

Yes, a possible development, but in my opinion unlikely in the near term (6-18 months).

Gilles

@thisjosh if it was, I wonder what the remedy would be

break Google into Google-A (for words beginning with a), Google-B, …?

There is in fact a major practical advantage to having a de factor standard search engine

remember meta-search-engines?

this.josh

@Gilles No the problem at the moment is that there is no secondary business that is significant to Google and there is no clear dividing line in the search business

I do remember meta search.

Gilles

The classical remedy in such a case is to nationalize the industry. It's a general need, and there's an advantage to a single provider, so it's a state function.

It's going to take a while for this to happen to Google

(when Baidu takes them over)

Thomas Pornin

@Gilles Ah yes, replace a monopoly of a private entreprise by a monopoly of a single State. I am sure USA would love it, but right now they cannot afford it.

this.josh

No good, Google would go to the Americans and every other country would feel shafted.

Thomas Pornin

23:59

Maybe a UN fund ?

Transcript for