The DMZ

AviD

17:00

I SWEAR IF SIMON SAYS "HIS WEEN" I WILL PUNISH HIM

000

pony ween

AviD

dammit

Ohnana

sometimes i find a ween during testing

it's very confusing

AviD

The Bet - SMBC Theater

►

Rоry McCune

@AviD #fogey

000

17:03

#smbc

Rоry McCune

Pandemic - SMBC Theater

►

000

#smbc

AviD

heh Im already watching that right now

Mark Hulkalo

@Ohnana I usually don't test my code all that much. 99% of the time, it works right the first time. :p

Usually there's just a few things to change

Ohnana

hahaha

Mark Hulkalo

17:11

I run through everything in my head before moving to the next

testing begins once I've been writing code for 4 hours or something

000

@MarkHulkalo pls.

Rоry McCune

@MarkHulkalo ahh I see you're a proponent of YDD

#Yolo Driven Development...

2

Mark Hulkalo

Rofl

Kidding, of course I test it.

Iszi

@AviD Vaguely reminiscent of...

Mark Hulkalo

I believe in polish

Iszi

17:13

meow (cat game)

►

Amelia

@MarkHulkalo lies!

Mark Hulkalo

Especially polish sausage

Amelia

Also, I'm an avid practitioner of WTF-Driven Development

AviD

@Iszi very vague

@Amelia hey now, I am the only AviD practitioner here.

Mark Hulkalo

Praise agile development

Amelia

17:16

@MarkHulkalo or, in actuality: kanban with a backlog that ends up sinking after a month

Mark Hulkalo

Explain

Amelia

@MarkHulkalo the inevitable result when you want to do something agile-like and management has no idea what the shit they are doing

Mark Hulkalo

lol

Fortunately, all our managers are pretty good here

Amelia

I've seen it happen 4 times in a row

Alizter

What is preventing a website from knowing my password if they can tell if it insecure?

Mark Hulkalo

17:18

I'm surprised. I thought they'd suck. They

They are pretty good*

@Alizter They are probably checking it by regex.

AviD

@Alizter uh, nothing? You just told them?

Amelia

@Alizter is this on the page where you create it?

Or is it an existing password

Alizter

Yes

Mark Hulkalo

While there's nothing stopping them from stealing your passwords if they really wanted to, most websites don't do that. They're usually checking your password lengths + regex to make sure they're valid.

Amelia

If existing - it's in plaintext

AviD

17:19

@MarkHulkalo "most"

Amelia

If it's on the page, they're checking it via regex in your browser

Alizter

Because they claim that only I will know the password

AviD

@Amelia unlikely

Alizter

but I don't see anything stoping them

Mark Hulkalo

There's nothing stopping them

At all.

You should just use separate passwords for each website. A password manager, perhaps?

Alizter

17:21

But why do we trust websites at all if this is the case?

AviD

@Alizter we don't

000

..?

Alizter

Is there some sort of check that they get to make sure they are not doing anything shady

000

No?

Alizter

Similar to certificates?

000

17:21

You can't control a website.

Mark Hulkalo

There's a lot of ways to check it

AviD

@Alizter the only point of giving your password to a website, is so THAT website can verify you know the password.

you should never EVER reuse passwords.

000

^

^^

Mark Hulkalo

You can sign up on a website with a fake username and email that you registered somewhere, and a fake password... then see if anything funny happens with the account.

AviD

and then you hope they properly protect the password you gave them

Mark Hulkalo

17:22

hope being the key word

000

They can do what the hell they want with your password; it is your responsibility to do the good practice and use a unique password on every site.

AviD

there should be no key, it should be hashed ;-)

Mark Hulkalo

For example, the NSA steals your passwords enroute if communicated over http :D

Alizter

But is it not the case that ~90% of people reuse passwords?

Mark Hulkalo

@Alizter It's probably higher than that

000

17:23

@Alizter So what? How do you force people to not reuse passwords?

AviD

@Alizter I think its less than 90%, but still way too high, yes.

000

You'll never know.

Mark Hulkalo

Trust me, it's higher...

I used to fix computers for people

Young, old, and in-between, they all re-used their passwords for everything.

000

You were fixing computers for people who are clueless about Computer Science.

Mark Hulkalo

Yep... 99% of people

Alizter

17:25

Exactly

Anyway thank you guys for clearing that up for me

I have reason to justify my paranoia with passwords now :)

AviD

@Alizter really no reason for paranoia. With passwords, all you need is a healthy does of fatalism.

Alizter

It's like you guys are experts on Information Security or something. Who knew. :)

AviD

quick advice, if you want to be secure with your own passwords:
1. use a password manager for ALL passwords. Make 'em long.
2. Use passphrases (4+ random words, e.g. Diceware style) for anything you absolutely MUST remember (e.g. password manager password, OS password...)
3. NEVER reuse passwords.
4. Turn on 2FA / 2SA on any site that supports it. Prefer TOTP instead of SMS.
5. Sign up for https://haveibeenpwned.com/

Mark Hulkalo

4 random words is bad advice

most people are gonna use the top 1000 most common words for that

AviD

@MarkHulkalo okay, go for 5

@MarkHulkalo you dont understand

Iszi

17:31

@AviD TOTP over SMS? Really? Why not an app?

Mark Hulkalo

I'm bashing correct horse battery staple

AviD

and its 2000 top common words.

@Iszi yes an app

oh okay I see

Mark Hulkalo

@AviD even if it's the top 4k, that's like 6 minutes :D

AviD

@MarkHulkalo I dont think you understand how entropy works

@MarkHulkalo 4 RANDOM words from that dictionary

Iszi

@AviD +1 for HIBP

Mark Hulkalo

17:32

@AviD if people are using 4 common words without capitalizing, etc., then it's pretty useless

AviD

@Iszi I didnt mean to get the code over sms, I meant prefer A over B

Iszi

@AviD Yeah, good fix.

AviD

@MarkHulkalo if you know correct horse battery staple, I dont understand how you could still say that.

Amelia

@MarkHulkalo my passwords are all lowercase and 50+ characters long

AviD

@MarkHulkalo this is completely wrong.

Mark Hulkalo

17:33

Wrong

One second

AviD

gtg, I will finish correcting you later.

Iszi

@AviD May/may not be worth saying prefer 2FA over 2SA. I'm not sure if anyone offers both.

AviD

better yet, I'll let @ThomasPornin do that:

283

A: XKCD #936: Short complex password, or long dictionary passphrase?

Edit: there seems to lack a thorough explanation of the mathematics in this comic (at least not as detailed as it could be), so here it is. The little boxes in the comic represent entropy in a logarithmic scale, i.e. "bits". Each box means one extra bit of entropy. Entropy is a measure of the av...

@Iszi true, but so few even understand the difference.

Rоry McCune

@MarkHulkalo wrong wrong wrong wrong, wrong wrong wrong wrong, your wrong , your wrong , your wrong </DrCox>

2

Mark Hulkalo

THEN TEACH ME

Rоry McCune

17:38

@MarkHulkalo hokay you have lets say 10k possible words

Rory Alsop

@RоryMcCune s/your/you're :-)

Rоry McCune

you put two together, how many combinations do you need to try?

10k x 10k

Mark Hulkalo

yeah, but I'm thinking common words

4k * 4k * 4k * 4k

What is this? 256 trillion?

GPU cracking @ 300 billion hashes per second

Rоry McCune

a reasonble number to try

Mark Hulkalo

14.2 minutes?

Rоry McCune

17:39

@MarkHulkalo if you're storing MD5 maybe

Mark Hulkalo

Yea

000

@MarkHulkalo That'd be a shitty algorithm.

Rоry McCune

but if you're doing that you're already pwned

Mark Hulkalo

agreed

Rоry McCune

try that with scrypt

see how you get on

or bcrypt

or PBKDF2

Mark Hulkalo

17:40

scrypt = 348 billion hashes per second with 25 gpus

Rоry McCune

also to get that far the attacker has already Pwned your databse, most likely, to get the passwords

Mark Hulkalo

That's the only thing I'm worried about, rory

the attacker pwning the database

Rоry McCune

@MarkHulkalo and remember and this is critical, you're assuming the attacker knows all the passwords to put them in a list

ie the user had to be constrained

on their password choise

not to use a single upper case character or number

Mark Hulkalo

yep

Rоry McCune

if they did that the attackers 25GPU attack fails miserably

Mark Hulkalo

17:41

but nobody's gonna choose the top 4k. they're gonna do 1-2k max. especially old people

old people are gonna do: cake muffins tuesday grandson

Rоry McCune

also that's 25GPUs per password

Mark Hulkalo

yea

Rоry McCune

no one does that for one old grannys single credential

Mark Hulkalo

7.1 minutes per password

Rоry McCune

you can buy credit cards with real money on them for less than that

Mark Hulkalo

17:42

using top 2k, IF that model is followed

True, but I'd probably do it just because I could ;)

Rоry McCune

and in the real world if they're just getting creds they ran them through a dictionary got most of them and then walked away

Mark Hulkalo

You have a lot of good points, but I still think it's somewhat feasible. A nation-state could do it much easier

Rоry McCune

any system where a feasible attack involves attackers who can pwn your database then use clustered dedicated password cracking systems, should not be using single factor auth

@MarkHulkalo if you're worried about nation states you don't use passwords

2

end of story

Mark Hulkalo

I'm not worried about them :p

Rоry McCune

it's all about threat models

all security is a trade-off

Mark Hulkalo

17:45

But a lot of attackers just copy your database and sent it over the network

Let me show you a common method I've seen a lot

Rоry McCune

correct horse battery staple style passwords are absolutely fine for systems where passwords are ok

@MarkHulkalo if they've got your whole database from the threat model of your system you're probably fecked already

Mark Hulkalo

They literally .rar up your entire database somewhere, and split it into hundreds of files, and place them in random positions, then send them

and I've never seen an IDS pick that up

Granted, might be using shit IDS

Iszi

@RоryMcCune I miss that show.

Rоry McCune

I hardly ever see IDS decently configured anyway :)

and I'm a security tester

@Iszi me too :/

Mark Hulkalo

And you're right, fecked already... but there's a lot of information that a re-used password might get you. Apparently even John Brennan was reusing passwords

s/command/function

Rоry McCune

17:48

@MarkHulkalo sure, for the user it's a problem, but as they have no control over the security of the systems they use, for their threat model the only sane answer is a password safe

Mark Hulkalo

But isn't that a single point of failure?

Rоry McCune

@MarkHulkalo sure, but what are the alternatives?

Mark Hulkalo

good point

000

@RоryMcCune SQRL BRAH

Rоry McCune

any hardware tokens are rarely cross-platform, so no dice with todays multi-device world

Mark Hulkalo

17:50

Personally I would just silently modify the login command to send passwords over the network, encrypted somehow

Rоry McCune

@MarkHulkalo sure client-side JavaScript encryption, keybase use it

Iszi

@RоryMcCune Unless you go for a dedicated device, e.g.: RSA token.

Rоry McCune

@000 I've just eaten!!

000

lololol

Mark Hulkalo

Yep, you'd have to install a program to get the key from the hardware, but even that could be intercepted/changed

Rоry McCune

17:51

@Iszi yeah those are good but rely (apart from perhaps yubikey) on server-support

Iszi

@RоryMcCune Doesn't all 2FA?

Rоry McCune

@Iszi IIRC yubikey can pretend to be a keyboard and "type" a randomly generated password in

so it works with ordinary browsers

but provides hardware storage

but I may have mis-remembered that

Iszi

@RоryMcCune But how does the server know that's supposed to be your password?

Rоry McCune

@Iszi you use the yubikey during registration

to set the password

again IIRC, it's been a while since I read the docs

Iszi

@RоryMcCune And it never changes? Aren't we just talking about a different form of password manager now?

Mark Hulkalo

17:53

@RоryMcCune I agree wholeheartedly

Rоry McCune

@Iszi yar hardware backed one :)

Mark Hulkalo

That's another way of looking at it

Rоry McCune

@Iszi yubico.com/products/services-software/personalization-tools/… so it's only one part of the keys operation and they don't recommend it if proper 2FA is available

Iszi

@RоryMcCune Of course.

But when we start talking about proper 2FA, then we're back to requiring server-side support.

Rоry McCune

@Iszi aye, more people are getting there, but still some notable absences...

Iszi

18:00

@RоryMcCune I'd call the latter part of that sentence a gross understatement.

Rоry McCune

@Iszi well yeah

jrg

@RоryMcCune @Iszi So you can abuse a Yubikey as a poor mans 2FA - password you type, plus the static stored password on the key.

I do that for a few different places (Root passwords, mostly)

Iszi

@jrg But that's not 2FA. Both factors are still "something you know".

Rоry McCune

@Iszi well you could argue you don't know what the yubikey "types" if it's starred out :op

jrg

@Iszi hence "poor mans". One is a hardware token... makes the password database useless if stolen, and vice versa.

It's hardly ideal.

Iszi

18:02

@RоryMcCune Then we start to approach the question of "When is 'something you are/something you have' equivalent to 'something you know'?".

Here, I think it comes damn close.

jrg

So the new FIDO stuff that Yubico is supporting is pretty interesting... it actually does a handshake.

Rоry McCune

@Iszi true true, he did say "poor mans" :op

Mark Hulkalo

@RоryMcCune If you don't mind me asking, what kind of security testing do you do?

Iszi

Bummer that YubiKey's top-end device has neither NFC nor FIPS certification.

Rоry McCune

@MarkHulkalo mainly web app. , some inf. I work remotely so internals/database stuff etc comes up for me less often

jrg

18:04

@Iszi yubico.com/products/yubikey-hardware - NFC is on some.

Just the NEO full-size, I guess.

Iszi

@jrg Yeah, but not on the "YubiKey 4" series, which is supposed to be their latest and greatest.

jrg

@Iszi Yeah, I think they are trying to move towards the consumer market with that.

Iszi

And the only one that's FIPS certified is the "Standard" (or its Nano variant), which can only be bought in bulk.

jrg

Well, now it can only be bought in bulk. Wasn't always.

A few months ago I picked up one from Amazon.

amazon.com/Yubico-Y-002-YubiKey-Standard/dp/B00LM8U5X6/… stock up!

Mark Hulkalo

@RоryMcCune Inf?

Rоry McCune

18:07

@MarkHulkalo infrastructure, so traditional network testing where you start with port scanning /Vulnerability assessment and move on from there

Mark Hulkalo

Ah

I mainly try things like hacking myself

Setting up systems and trying to secure/break them

I rarely get the opportunity to test it on someone else.

Rоry McCune

you should look at CTFs

if you don't already

Mark Hulkalo

I live by the creed, "do unto others as you would unto yourself."

jrg

@RоryMcCune +1 to the CTF recommendation.

Mark Hulkalo

Capture the Flag?

Rоry McCune

18:10

@MarkHulkalo yep there's loads of competitions which are essentially hacking and puzzles

Mark Hulkalo

Ah, nice

Rоry McCune

you can compete either against the computer or in teams against other teams

Iszi

@MarkHulkalo Ok. Remind me to stay far away from you.

Mark Hulkalo

@Iszi rofl

No, not like that. Not at all... I mean, hacking myself is learning stuff... hacking others is wrong, generally. Unless they're haxoring you first, then it's fair game.

000

You won't learn much from "hacking" yourself.

Mark Hulkalo

18:12

Not necessarily true

000

You're not necessarily true.

Iszi

@MarkHulkalo Very obtusely reminded me of a bash.org quote that I can't seem to find right now.

Mark Hulkalo

Something to do with baiting the master?

David Freitag

@TildalWave Awwwwwh yuh, ATHF all the way.

Mark Hulkalo

@DavidFreitag I don't know if I want to use UE4

David Freitag

18:15

@MarkHulkalo Why?

Mark Hulkalo

Greedy, I guess.

000

OVID

@AviD

OVID AVID OVID I CAN'T ACTUALLY CHANGE MY DISPLAY NAME HULP

Iszi

No. Something on the lines of:

1 - What would you do if the world was going to end in 5 minutes.
2 - I'd screw anything that moves! What would you do?
1 - I'd stand very, very still.

David Freitag

@MarkHulkalo Really?

Mark Hulkalo

Splitting the project cash 50/50 for example. It would be 50/50 of what we have left after giving to Epic.

Alizter

18:16

@AviD Wait, haveibeenpwned.com sounds a bit suspicious? Does that not just give them free usernames to try out?

Mark Hulkalo

No, mainly I don't know if we would need it for a 2D game

David Freitag

@MarkHulkalo Epic only takes 5% bro

Iszi

@Alizter Nothing they don't already have. Data is pulled from public sources.

David Freitag

And that's only after we hit the $3k/4mo mark

Mark Hulkalo

Yeah, good point

David Freitag

18:17

That's only $600/yr

Mark Hulkalo

I'd love to do an open world game like skyrim, but that isn't too feasible

Would need a team for it

I only program, can't really make models/textures, can you?

David Freitag

Not really, lol

Mark Hulkalo

The marketplace doesn't have the kind of assets I'd want for that kind of game :<

AviD

@Alizter also the guy that runs it is Troy Hunt, a very well known security guy.

David Freitag

@AviD A very awesome security guy.

AviD

18:22

indeed.

000

OVID MY DISPLAY NAME

AviD

is anybody else keep getting logged out of the site periodically? like, all day long....

000

n

Mark Hulkalo

No, but the chat keeps acting weird

David Freitag

@AviD Did you accidently ban yourself? Again?

jrg

18:24

Looks like level3 is having some issues...

Thomas Pornin

@AviD I hear @Simon has some problem with his display name, but it may be unrelated.

AviD

@MarkHulkalo thats not the chat, thats just simon.

Mark Hulkalo

Lol

AviD

@ThomasPornin lol

000

It may be.

AviD

18:31

still not sure at what point you started thinking this was my problem.

000

To be fair, whose problem could it be then?

Mine? pls

Mark Hulkalo

heraldscotland.com/news/14040634.display

David Freitag

@MarkHulkalo Graphene is fucking cool.

Mark Hulkalo

Yeah man

I can't wait to see things built out of this

David Freitag

Formula 1 cars made out of carbon nano tubes

TildalWave

18:48

@MarkHulkalo Is that really a breakthrough tho? They've basically discovered that you can get a square meter sheet of copper foil that does the job for $1 instead of $115. That's just the substrate, chemical vapor deposition has other costs and it's hardly a clean method for large scale production. Exfoliation with basically sellotape is still cheaper and much cleaner.

Mark Hulkalo

I honestly don't know enough about it to give you an informed response

I just see some sciency stuff progressing and go, "yeah!"

000

You probably do the same when you drive past a McDonald's too, right?

Silly Americans.

TildalWave

They also give a pretty bad example what graphene is good for. Molybdenum disulfide is much better for desalinization, and now there's even cheaper and faster method employing electric shockwave

Mark Hulkalo

McDonalds is pretty nasty. I rarely eat there. :p

@TildalWave I understood some of those words.

TildalWave

@MarkHulkalo heh fair enough :)

Mark Hulkalo

18:59

@DavidFreitag If we can prove we can make a decent game, we might be able to convince others to fund a bigger, badder adventure.

Transcript for