The DMZ

Ohnana

15:01

@AviD wtf

AviD

@Ohnana ?

Ohnana

@AviD ttbomk?

did you accidentally russian?

AviD

@Ohnana yeah

ah

@Ohnana To The Best Of My Knowledge

duh

Ohnana

oh

AviD

8 mins ago, by AviD

@Iszi IMNSHO TTBOMK GT AFAIK

Ohnana

15:04

this mod's broken, i want a new one

Simon

@AviD Never use that again.

Ever.

@Ohnana I've been saying this for a while now.

AviD

you're all wrong

Simon

♪ Look at my code, my code is code-behind, add a few lines to Page_Load, because .NET Web sucks anuses ♪

AviD

@Simon ugh you're using webforms? ick.

but dont go blaming it on .NET just because you choose wrong / old tech.

Simon

Sure, let's not blame it for making the tech in question.

I REQUEST A NEW MOD, THIS ONE IS REALLY, REALLY BROKEN.

AviD

15:11

@Simon IT IS 14 YEAR OLD TECH

IT MADE SENSE AT THE TIME

Ohnana

@AviD THAT IS NO EXCUSE

AviD

MVC was barely a thing back then, and not at all for a generic web framework

@Ohnana YOU'RE NO EXCUSE

Ohnana

@AviD I'M ALSO NOT .NET SO WHO CARES

AviD

@Ohnana you're right though, that is no excuse for choosing to use it in 2016.

Simon

@AviD I runat="server", bitch.

AviD

15:15

lol

Simon

What's the new thing now anyway?

All I've ever done is this garbage.

AviD

ymean in ASP.NET?

MVC / WebAPI

Simon

o I do see the option when I make a new project

Too bad this thing was made using WebLameForms, not gonna convert it.

AviD

seriously, only choose that from now on - dont ever look back at webforms.

there is a bit of a learning curve to MVC - about 20 minutes for normal folk, so you should be up and running within 2 or 3 weeks.

:P

Simon

pls it looks very similar

AviD

15:19

completely not at all

only thing in common is that it is .NET - at least as far as the code goes.

actually syntax is different too - <%= %> vs @{ }

and yes that is a big difference, its not just about choice of characters, it is functionally different

Simon

But where is Page_load in all this?!?!?!?

TildalWave

OMG a different syntax for Here be Dragons? Progress!

AviD

@Simon exactly, no page, no load.

@TildalWave pfft.

Simon

Is it C# only?

OVID PLS TELL ME THAT IT'S C# ONLY

TildalWave

@Simon it carries over since Delphi, so ... no :P

Simon

15:23

Ah fuck me, it works with VB too, sigh.

AviD

@Simon nah not necessarily

Simon

I thought that'd be my argument to get rid of VB.

Nooooooooooo.

AviD

but yeah, C# only, cuz VB is stoopid.

TildalWave

only it was <# > there

AviD

@Simon sure

TildalWave

15:24

thus, progress

AviD

@TildalWave ahh Delphi.NET

IronPython

TildalWave

LOL

AviD

Ruby on NET?

TildalWave

.NET came after actually

Simon

@AviD I wish I could convince someone who's been doing VB all his life that there'd be a significant advantage to redo an application in C#.

TildalWave

15:24

damn keyboard layouts

AviD

@Simon redo? I dont think so. Unless there is a whole lot of continuing development (and not just maintenance).

Simon

@AviD I'm supposed to upgrade (which means making a whole new project) an application that was done in VB.

So I'd be reusing a ton of classes.

AviD

although I would even consider at that point, to develop new code ONLY in C#, and compile as modules.

@Simon so? reuse them as references. The joy of MSIL - it dont matter the original language.

Simon

@AviD I can do that? Whoa son.

AviD

I... dont know if you are sarcastic.

Simon

15:27

But then if I modify them, I'd have to deal with VB.

AviD

didja know you could write a subclass in C#, for a VB parent class?

Simon

n

Mark Buffalo

4

Q: Are partially typed passwords a potential security risk?

I just sat down at my work computer and began to unlock it by typing in my password, I got 6 of the 8 characters in and decided I wanted coffee and walked away to get it. I came back, realized I left most of the password in, typed in the remaining two characters and logged in. Out of pure curiosi...

AviD

> "n"?

Simon

@AviD NO YOU PONY GOBBLER

Mark Buffalo

15:30

I didn't realize this was a possible attack until seeing the question. Just tested it out...

AviD

huh thats actually worse for me

anyway, well now you do

Mark Buffalo

Yeah, I got to thinking... what could I do with this... and then light bulb.

AviD

@MarkBuffalo I've noticed noone mentions there that most browsers nowadays now give you a little "show password" notbutton to show what you've currently typed...

Mark Buffalo

@AviD ...they do?

None of mine do...?

AviD

@MarkBuffalo uh huh

Mark Buffalo

15:33

Show me an example... that's screwed up lol

Do you mean browsers, or websites?

AviD

not at all - makes sense WHILE youre typing it. Leave the field, it dont work

Simon

You can just edit the HTML and change type="password" to "text", lads.

AviD

you can also just click F12 and monitor network requests

Simon

o Markus said it in his answer, lulz

@MarkBuffalo name="pass" and id="password"?

You're a bad person.

Mark Buffalo

I just updated the answer to show a picture of @RоryMcCune hacking

@Simon Just an example. Some people do that :b

AviD

15:36

see that little icon at the end of the password field?

Mark Buffalo

@AviD Is that the button?

AviD

oh lol just realized its an eye

@MarkBuffalo yeah

Simon

@AviD looooooooool

Mark Buffalo

lol, but that's the website's code

not the browser

AviD

@MarkBuffalo nope, thats the browser. website just marks it as password...

Simon

15:37

@MarkBuffalo Nope son.

Mark Buffalo

...the... the browser does that?

None of mine do that. Not even on the phone.

Simon

ovid is using shitty browsers though.

Like Edge and IE.

AviD

indeed. it makes perfect sense - if you want the user to use long complex passwords, make it usable.

@Simon pfft.

Simon

fkin rekt

AviD

Edge browser best browser.

actually yesterday I was showing a class about certs - couldnt figure out how to find the cert in Edge.

Matthew

15:38

For some websites, the eye button changes the type of the input field between password and text, in which case it's the site

I think Lastpass mobile site does that...

Simon

♪ Look at my SqlDataSource, I'm doing SQL on the client-side, because I can ♪

3

Ohnana

> not using Brave browser

it's $CURRENT_YEAR, man

Matthew

Great Scott!

AviD

@Ohnana ?

Mark Buffalo

@Simon This was added for the "this.pass.val" example. :b

Ohnana

15:42

@AviD arstechnica.com/business/2016/01/…

AviD

reading that already...

Mark Buffalo

> Brave will replace blocked ads with its own ads, taking a 15% cut of revenues.

Simon

OH NO I JUST RECEIVED A PHP JOB OFFER FROM LINKEDIN

I'M DOOMED

AviD

kinda hipstery

Simon

PEOPLE THINK I'M A PHP DEV

AviD

15:43

@Simon arent you?

Mark Buffalo

@Simon Aren't you?

Matthew

@Simon To build LinkedIn? Think how much spam you could send!

AviD

though I would hardly call what people do with PHP "dev" work

@MarkBuffalo wat

Simon

I'm a software dev you mongs.

Ohnana

> Of the remaining ad revenue, 55 percent will go to the publisher and 15 percent will go to the ad supplier. Curiously, the last 15 percent will be returned to the user, which they can then use to make micropayments to their favourite websites.

^^ that's the part i like

Simon

15:44

She wants to "introduce you some of our clients that are looking for PHP developers right now."

AviD

@Simon not if you use PHP you arent!

@Simon ah nice, generic headhunters are the best

Thomas Pornin

@Ohnana Getting paid to surf the Web all day is an old dream.

AviD

speaking of - did you all get recruiting spam from bugcrowd too?

Ohnana

@ThomasPornin i don't make the money. I can use the credits to give to sites i enjoy. like oglaf and SE

AviD

not sure if its actually spam tho

Rоry McCune

15:46

@AviD nope it's just you

Simon

I'm blaming all this due to adding da bear on linkedin.

Ohnana

further rewarding them for not having cancer ads

AviD

@RоryMcCune so its not spam then, yay!

Thomas Pornin

@Ohnana If you obtain tokens that you can give to third parties to increase their wealth, then you get money.

Matthew

@AviD It's a phishing attack? :-)

Thomas Pornin

15:47

That's, like, the definition of currency.

Ohnana

@ThomasPornin i see your point, but i find it irrelevant since the money can't be used to benefit me -- only others

it's a similar model to freerice.com

Thomas Pornin

@Ohnana I fail to see what you mean. When I give money to a grocer, it benefits me -- because I get things I can eat in exchange.

TildalWave

@Ohnana make a site that accepts micropayments?

Matthew

@Ohnana What if you own a website and donate to it?

Mark Buffalo

@Ohnana Whoaaaaaaa

Ohnana

15:48

oh lawd stop the pings

TildalWave

@Ohnana who?

Ohnana

@ThomasPornin the brave model is indirect benefits though. it's a bit like being a patron of the public arts. you benefit a tiny bit, but others benefit more

and yeah, it took us like 5 minutes to figure out a way to abuse it lol

Thomas Pornin

@Ohnana Do you mean the receiver will not be able to know who is sending money ?

Ohnana

@ThomasPornin don't know. it's in beta right now, it looks like they're working on the software side first

Thomas Pornin

Or merely that the concept is about donation, without any actual mechanism to prevent it from morphing into commerce ?

TildalWave

15:50

why would you even need a new browser for that? A plugin should do

Ohnana

@ThomasPornin that's a good way of putting it

Mark Buffalo

I'd probably be okay with web surfing if I got paid

Rоry McCune

@Ohnana you're getting too many pings you say?

@Ohnana that's terrible

@Ohnana I hate it when that happens

Mark Buffalo

I would write a program to automate the surfing of many different websites on several different computers. Mwaaaaaaaahahahaha

Ohnana

hmm, haven't seen the unpingable lately, wonder where he's gone off to?

AviD

15:53

@RоryMcCune why are you pinging @Ohnana?

didnt @Ohnana ask not to be pinged?

I would think that would start to annoy @Ohnana...

Rоry McCune

@AviD you're right I had heard that @Ohnana was not wanting any pings

Simon

Hey @Ohnana, let me show you another Markus impersonation:

AviD

@RоryMcCune so stop pinging @Ohnana!

do you think @Ohnana learned a valuable lesson today?

Xander

@RоryMcCune Why doesn't @Ohnana want any pings?

Simon

I don't know, let's ask @Ohnana.

Rоry McCune

15:54

@AviD I think it's possible that @Ohnana has indeed learned something

AviD

:27161513 I thought that said #yoloavid

Xander

@AviD Why did @Ohnana ask to not be pinged?

Ohnana

got awfully quiet in here...

AviD

@RоryMcCune you should ask @Ohnana

Ohnana

where'd everybody go?

AviD

15:55

@Xander maybe @Ohnana was lonely

heehee

Rоry McCune

hey @Ohnana did you get lonely and ask for pings

Matthew

It's a shame that you can't ping @all

Simon

@AviD How did that not ping me?

Rоry McCune

@Ohnana you should block us all so we can't do that any more

AviD

hehe 26 @Ohnana pings on screen right now

well 27 @Ohnana pings now

well, now its 28 @Ohnana pings now

Ohnana

15:56

@Matthew you used to be able to

Rоry McCune

@AviD you say that but I thought it was 29 @Ohnana pings

AviD

@Simon cuz I replied to your deleted message

Simon

o

Ohnana

it was some bug with unicode parsing i think

Simon

u wizard

Ohnana

15:56

apparently chaos reigned for a short bit when people found it

Matthew

0

Q: Zap and Temper date is not getting any of the POST request

I just start learning Zap and Wabgoat. Im running those on my Mac. I have configured Zap to listen to my firefox. But I only get Get request, there is no Post request showing up, I also tried to use firefox add-on Temper Date, and I get no Post too. I tried the same task on my Windows desktop, It...

owasp webgoat

AviD

@RоryMcCune no man, 32 @Ohnana pings.

Matthew

Look at the bottom of the left hand pane. Is that not a POST request?

Simon

@Ohnana The DMZ was clueless about it, unfortunately.

I would have abused it like there's no tomorrow.

TildalWave

♪♫ 29 @Ohnana pings on the screen, 29 @Ohnana pings, if I ping @Ohnana once more there'd be 30 @Ohnana pings on the screen. 30 @Ohnana pings on the screen, 30 @Ohnana pings, if I ping @Ohnana once more there'd be 31 @Ohnana pings on the screen.... ♪♫

AviD

15:57

@Simon like your mom.

Simon

ovid

AviD

@TildalWave oof you broke it, all that counts as just one.

TildalWave

@AviD we could all singalong :P

Ohnana

@Matthew that says get

which is weird

AviD

well okay guys, its almost 6pm on Thursday, almost time for me to start working this week.

Simon

15:59

It's Thursday already? Dayum.

Time goes by when you've got a huge ween.

AviD

LOL

Matthew

@Ohnana The one that is half cut off in the screenshot?

AviD

dammit @Simon's ween made me laugh

6

Simon

:D

Ohnana

@Matthew oh! lmao yes it is

should we point it out

TildalWave

16:00

@Simon dude you ween the internet

Matthew

@Ohnana "Hey, have you tried scrolling?"

Simon

The Weenternet?

Ohnana

@Matthew "the word POST typically denotes a post request FYI"

jesus christ people you went on with that a lot longer than i thought you would

Matthew

The real question is of course, how gently should we break it to him...

Ohnana

oh well, ignore is a good thing

@Matthew just did

Xander

16:02

@Ohnana Do not ever underestimate the DMZ.

Simon

@Matthew By flagging his question as off-topic and never tell him?

Ohnana

you are all horrible people and i hope someone finds an injection vuln in everything you write

MAY YOUR PASSWORDS ALWAYS BE HASHED WITH MD5

7

Matthew

@Ohnana That's a bit beyond the pale!

Ohnana

yeah i went there

Simon

I hash all my passwords with MD5 because when I lose them, they're easy to recover.

5

Matthew

16:06

@Simon I much prefer the security of ROT-13. Or, if I'm feeling paranoid, ROT-26 for twice the security

Simon

@Matthew I'm an advocate of ROT-13 myself.

I also made my own implementation, which I claim is much more secure than the original: ROT-13^2

Matthew

@Simon I have been known to increase the rounds significantly. Clearly, 1 million rounds of ROT-13 are completely unbreakable

Simon

@Matthew Unfortunately, I don't a CPU fast enough to compute this many rounds.

But yes, you are absolutely right.

Ohnana

Kazakhstan passed a law forcing all citizens to install a cert allowing GOV to intercept & decrypt all SSL traffic. http://telecom.kz/en/news/view/18729

Tweeted by jeremiahg on December 2, 2015 at 6:15 PM

oooh shit

Mark Buffalo

Lol

Rоry McCune

16:17

@Ohnana aka "We aren't big enough to own a trusted CA that will give us a root cert"

Mark Buffalo

That sucks

Ohnana

@RоryMcCune forreal tho

Mark Buffalo

This is only for ssl. There are a million different ways around that

Rоry McCune

@MarkBuffalo assuming that the government don't block all unencrypted traffic that they can't intercept

which is how I'd do it if I were them ...

Mark Buffalo

@RоryMcCune sadface :(

@RоryMcCune The U.S. government just intercepts all encrypted traffic and logs it for later analysis

Simon

16:32

HOW MANY POSTS DO YOU REMOVE EVERYDAY?

I read that.

Mark Buffalo

:b

Simon

I did not know what to reply other than "You forgot the /s at the end".

Rоry McCune

7

pls @MarkBuffalo Screenshots FTW

Simon

Thank you roro.

Mark Buffalo

@RоryMcCune DAMMIT!!!!!!!!

Xander

16:36

@MarkBuffalo Don't forget, all the blue can read deleted/edited messages as well.

Mark Buffalo

@Xander Oh, I haven't forgotten. I was hoping @RоryMcCune would call me out.

Rоry McCune

@MarkBuffalo ah no posting a screenshot of a deleted message would be mod abuse

screenshotting a message before it's deleted and then posting it is just amusing

Mark Buffalo

haha

Ohnana

@RоryMcCune rekt

TildalWave

@RоryMcCune we aim to pleasure

Rory Alsop

17:02

@RоryMcCune another one I hadn't seen! :-)

Rоry McCune

@RoryAlsop it's a good one that one too!

Mark Buffalo

Doesn't work here, or in comments. Darn it.

Rory Alsop

@TildalWave reminds me - where is @ScottPack

haven't seen him in ages

Ohnana

17:19

@MarkBuffalo ctrl

Simon

@RoryAlsop He's busy not hanging out with us.

Ohnana

wow i'll get that right eventually

Simon

@Ohnana That's not keys though.

Ohnana

@Simon hmm, looks like the keyboard html only is processed in posts

TildalWave

@RoryAlsop no idea, I guess he's busy IRL

Ohnana

17:21

572

A: <kbd> elements are way intrusive

Thomas Pornin

Rory Alsop

@TildalWave yar - I superpinged him so let's see :-)

Mark Buffalo

@ThomasPornin Damn yous.

@Ohnana I love the replies.

Iszi

LOL @ This:

63

A: <kbd> elements are way intrusive

I would like to propose that from here on out we replace Caps Lock with Billy Mays William Darrell "Billy" Mays, Jr. (July 20, 1958 – June 28, 2009) was an American television direct-response advertisement salesperson most notable for promoting OxiClean, Orange Glo, and other cl...

Mark Buffalo

30

A: Java SecureRandom doesn't block? How?

Both OpenJDK and Sun read from /dev/urandom, not /dev/random, at least on the machine where I tested (OpenJDK JRE 6b27 and Sun JRE 6.26 on Debian squeeze amd64). For some reason, they both open /dev/random as well but never read from it. So the blog articles you read either were mistaken or appli...

@Gilles <3

@Iszi lol

theregister.co.uk/2013/08/12/…

TildalWave

17:34

@Iszi so this is where the idea for minecraft came from

level of geek there is disturbing tho

Ohnana

@MarkBuffalo um

Mark Buffalo

@Ohnana Keep in mind, 2013... but that's still awesome.

Ohnana

@MarkBuffalo did he call it before it happened?

i am confuse

Mark Buffalo

You mean did Gilles discover that problem before it was in the news?

Scott Pack

@RoryAlsop Work is busy. The chat room is too active during the day for me to want to leave up and by the time I get home I tend not to open the laptop unless I'm working on something in particular.

Mark Buffalo

17:39

That was 2 days afterwards, and both seem unrelated.

Thomas Pornin

@MarkBuffalo That bug is the reason why RFC 6979 is popular in the Bitcoin ecosystem.

Mark Buffalo

17:52

@ThomasPornin Reading up on RFC 6979 now. Thanks

@ThomasPornin Haha, you wrote it...?

7

Q: RFC 6979 - Why not simply hash the message & the private key for deterministic ECDSA?

Why go through the trouble of using the HMAC_DRBG process, instead of simply hashing [message | private key] to calculate $k$ for deterministic ECDSA? If the resulting $k$ or the signature is invalid, then a known byte value can be appended to the input, and re-hashed, until an acceptable result...

dsa

Iszi

Damn. I always knew Big Bear was well-known across SE. Seems lately I've been finding out more and more of his non-SE infamy as well. Why doesn't he have a Wikipedia page yet?

Mark Buffalo

@ThomasPornin You make me want to get into crypto. I've always found it interesting. WHERE TO BEGIN?

Simon

Jesus Christ Markus, stop riding him.

Thomas Pornin

@MarkBuffalo The "hands-on" method would be starting by implementing a few algorithms to get the gist of them. Hash functions are a nice start.

Personally, I started by implementing DES, then Matsui's Linear Cryptanalysis of DES.

Transcript for