This answer exemplifies the major problem with paranoia, the inability to prioritize threats. You start out talking about the biggest, baddest adversary there is, but also one that's mostly irrelevant. It's an interesting academic exercise to talk about the NSA, spying, etc. But in reality, the average user is trying to protect themselves from CRIMINALS. While some, including myself, would put parts of the NSA and GCHQ into this category, I'm much more worried about the guy trying to steal my money or computer than the criminal spying on me. — Steve Sether14 mins ago
Right now I'm writing a proof-of-concept crack for this BBC password nonsense
It's horrible :) To provide some numbers to back claims by other answers:
This provides some numbers of how many songs are popular per year. For the last decade it was as low as 300-400 Top40 hits per year! Average word count for a song is 300-600, depending on the style, and they do 7-10 words ...
we're losing sight of why the nsa is not okay and replacing it with "the nsa is always bad" despite the fact that these are the people that gave us SELinux
the NSA is a redeemable organization, they just need to apply ethics to their work a lot more
> Pandoc can convert documents in markdown, reStructuredText, textile, HTML, DocBook, LaTeX, MediaWiki markup, TWiki markup, OPML, Emacs Org-Mode, Txt2Tags, Microsoft Word docx, LibreOffice ODT, EPUB, or Haddock markup to
> HTML formats: XHTML, HTML5, and HTML slide shows using Slidy, reveal.js, Slideous, S5, or DZSlides. Word processor formats: Microsoft Word docx, OpenOffice/LibreOffice ODT, OpenDocument XML Ebooks: EPUB version 2 or 3, FictionBook2 Documentation formats: DocBook, GNU TexInfo, Groff man pages, Haddock markup Page layout formats: InDesign ICML Outline formats: OPML TeX formats: LaTeX, ConTeXt, LaTeX Beamer slides PDF via LaTeX Lightweight markup formats: Markdown (including CommonMark), reStructuredText, AsciiDoc, MediaWiki markup, DokuWiki markup, Emacs Org-Mode, Textile
I tried markdown + pandoc extensions for simple technical specifications (10e1 pages) and I pretty quickly ran into limitations. I would NOT recommend it for a book.
Crappy facilities for tables. No facilities for indexing. Cross-references aren't that great.
I suppose that for anything really technical with the non-text features that are now fashionable (such as tables), you will want something with more control -- but you tend to lose automatic conversion to other formats such as EPUB.
@ThomasPornin Books have had indexes for centuries. True, they used to be compiled manually, but that's one of those things computers are good at: why would I manually collate all page numbers?
@ThomasPornin yeah, thanks for pointing that out - lots of ppl don't know about it - it is helping, but pandoc's not perfect in my case - I really want to have a LaTeX-centered solution, but I might just fiddle with pandoc
@Gilles I have not tried making an index yet with pandoc, but I thought there are facilities for that. The table of contents is there and works as expected.
@RoryAlsop It can make references to sections. But they break when you change the section title, which is pretty brittle. Unless there are pandoc extensions in the latest version that I'm not aware of (it's been a few versions since I explored its capabilities)
@ThomasPornin that was one of my arguments to pick it: you can throw an untrained developer at it and they produce something sensible, which isn't the case for LaTeX
@ThomasPornin - a non-pandoc related question. (BTW I absolutely hate how hard it is to compile it on a slightly off-the-bleeding-edge gig). There's a little weird language called Cryptol, and a bunch of automated provers (Z3, CVC4). Are there any higher-level languages that take in formalized protocol descriptions?
@DeerHunter I'm aware of Proverif (wow, it even has a Wikipedia page, which mentions a couple of related tools). I don't know how it compares with the competition.
@DeerHunter I don't compile pandoc; I type "apt-get install pandoc" and I rejoice while I bathe in the blood and tears of masochistic packagers.
6
For formalized protocol descriptions, I don't have names at hand, but it would be a good search start to lookup that formal TLS implementation (in F#). Lemme find a URL...
@DavidFreitag In 21 seconds, I was able to get every possible password combination for the BBC password syntax, sans numbers. gonna add numbers and see how it goes
@ThomasPornin Well I knew that much (as you've told me now two or three times), but I didn't know if there were any F# specific features that could be leveraged
The languages derived from ML are favourites of people who write formal specifications and provers (at least, the clan that started SML and then Caml back in the days; the other sect still clings to Lisp).
So the "specific feature" which is leveraged is really the uncanny similarity of the F# syntax with the syntax of OCaml, that existing analysis tools can digest (more or less).
Though of course there cannot be any proper formal, provable specification if you do not invent your own language dialect for it.
@ThomasPornin Someone in Space.SE chat once said that this is because the number of people who understand an answer is inversely proportional to the amount of updoots received.
@ThomasPornin I had an accepted answer once, but I was so tired I got it fundamentally wrong because of a few concepts I mixed up in my fatigued state... got accepted, upvotes... and then I had to go and edit it silently.
@DeerHunter Well some of us are far more masochistic than others. For instance, some of us use package managers.
@MarkBuffalo The reason I don't believe you is that you need to search through every song ever written ever, then index and search the lyrics, oh and just for kicks you also need to test for l33t speak too.
@MarkBuffalo What point is that? They have access to potential searches for this information? That's not the point you're trying to make by writing software to "crack" it
The point is, if you can access their search information, and you do a comparison using the BBC password method, assuming you know the song, you can attempt multiple phrases against it
@MarkBuffalo And I'm trying to say the only people with access to this information is a state actor, and if they're looking for you you're fucked anyway
@MarkBuffalo people are currently choosing "Spring2015" with depressing regularity. If they choose passwords based on something more random than that, it's a win
@Gilles also cost from when the helpdesk gets so inured to easily resetting passwords that they start having lax processes for doing so, so someone bad persuades them to do it over the phone
And social engineering, if you know they visited that news site (news sites sell visits to advertisers anyway), or you recommended that someone pick a password based on this... and you know their favorite song
then you google lyrics for that song. more than likely, the first result is what was picked
So you go through the list and try to break it
Put in a few catchy phrases, and test against every possible input for that phrase
The program is simply a proof of concept that, if you had that information (again, might be unlikely; I tried to consider extreme tinfoil situations to justify it), you could crack it much, much faster than a normal password, because you know so many parameters about it
Let's say I registered a domain on Namecheap and want DigitalOcean to be my host. This can be achieved by first setting the nameservers to DigitalOcean in Namecheap's backend:
Second, we add some NS records in DigitalOcean's interface:
My question: assuming an attacker knows I've set my nam...
Let's say I registered a domain on Namecheap and want DigitalOcean to be my host. This can be achieved by first setting the nameservers to DigitalOcean in Namecheap's backend:
Second, we add some NS records in DigitalOcean's interface:
My question: assuming an attacker knows I've set my nam...
