The DMZ

AviD

14:00

@Simon of course YOU are.

Simon

Says the one who argues 24/7 with people and is never willing to admit that he's wrong.

Mark Buffalo

@AviD No ur

AviD

@Simon that's not true

Simon

It's fine, you're always right, you have the ultimate knowledge and we're crap.

Francesco

@MarkBuffalo that could be but I have been in Dresden, Aachen, berlin, koln. I found food Always a bit on the heavy side

AviD

14:00

@Simon pls

Mark Buffalo

@Francesco Plain? No spices?

SEJPM

@Francesco you'll get used to the local food with enough time

AviD

also, speak for yourself. There are plenty here that it does not apply to.

Francesco

@MarkBuffalo that's an interesting point of view. I have too many accounts and I don't care any longer for creating passwords

Simon

Speak to someone else.

Mark Buffalo

14:02

@Francesco I simply don't have very many accounts anywhere. I hate creating accounts. If I did have more than a few accounts, especially important ones, I would probably use a password manager.

AviD

@Simon y u so kranky

Mark Buffalo

I really don't care about any of my accounts, except 1 or 2

Simon

@AviD YOU EDITED SOMETHING THAT WAS UNNECESSARY BECAUSE IT WAS OBVIOUSLY SAID IN A PLAYFUL WAY

Mark Buffalo

I'm a lurker in most places, like reddit, etc.

Simon

IF THE GUY DID TAKE OFFENCE AND/OR COMPLAIN, IT WOULD HAVE BEEN A GOOD EDIT

Thomas Pornin

14:02

0

A: What is DROWN and why is it even possible?

To understand the attack, one must recall Bleichenbacher's attack from the late 20th century. In that attack, the attacker uses the target server as an oracle. When using RSA-based key exchange, the client is supposed to send a secret value (the "pre-master secret") encrypted with the server's pu...

Francesco

no I didn't take offence since I guessed it was for laughing

SEJPM

@MarkBuffalo so you doin't care about your SE account?

Simon

Tada ^

AviD

@Simon not everyone that wanders in here will understand that

Simon

@Francesco Thank you.

@AviD And you think those guys would fit here?

Francesco

14:03

I was bashing german food and I was bashed for being italian

Mark Buffalo

@SEJPM not really. I can live without it

Francesco

:-)

Simon

@Francesco :p

AviD

@Simon good, but then tomorrow someone else wont get it

@Simon irrelevant.

Simon

@AviD Fine, why do we talk about sex here, then?

AviD

14:03

dont go all SFBro on me.

Simon

Surely a such subject is going to offend someone eventually.

AviD

@Simon honestly no clue

Simon

Why doesn't it all get censored?

I don't remember you censoring anybody else's posts.

AviD

usually cuz @kalina is in here trying to get moderated

or @RoryAlsop is in here bragging

or @Simon is in here truly worried

Terry Chia

@ThomasPornin I think the key takeaway that makes things much worse is that disabling sslv2 on some versions of openssl doesn't actually disable sslv2.

Simon

14:04

Fine, keep doing what you're doing.

AviD

@Simon you're more fun ;-)

Francesco

look please let's get back to the original topics, we were discussing this new drown attack (@ThomasPornin took care of that) password managers (we have +2 for keepass, +1 for not using them) and german culture

Simon

You're doing allllllll right.

AviD

yes, I'm kidding.

Ohnana

@ThomasPornin even better, the acroynym is butchered

AviD

14:05

because most people are familiar with the line.

Mark Buffalo

@TerryChia Yeah, in some cases, you can force this attack to work even if they aren't using sslv2

Simon

@ThomasPornin Oh come on, that's too much to read.

SEJPM

@ThomasPornin +1

Simon

starts reading the post

Ohnana

> DROWN stands for Decrypting RSA with Obsolete and Weakened eNcryption.

AviD

14:05

@Francesco +3 for keepass

Ohnana

FAIL

Simon

@Francesco +4, that's what I use too and the fact that it's free makes it perfect.

SEJPM

do we actually have a question on the old bleichenbacher attackers?

Terry Chia

@SEJPM more rep for you: ssrg.nicta.com.au/projects/TS/cachebleed

SEJPM

@TerryChia om nom nom

Mark Buffalo

14:06

FFS

my kids are buying in-app purchases

I thought I fucking disabled that

Ohnana

@MarkBuffalo y u no pincode it

Thomas Pornin

@SEJPM This answer covers it briefly: security.stackexchange.com/a/20851/655

Mark Buffalo

It's my wife's phone

Ohnana

@MarkBuffalo y she no pincode it

Mark Buffalo

I don't control anything she does on her phone. at all

none of my business

Francesco

14:09

@Simon For me the point is being open source and so "checkable" by the experts. I am happy to pay/donate for a good product

Thomas Pornin

OK, now that I have described the attack, I will actually read the article.

4

Mark Buffalo

lol

Lighty

Bear is gonna bear

Simon

@ThomasPornin "(And that fashion of using all-uppercase acronyms for attacks is really ridiculous.)" +1

Mark Buffalo

@ThomasPornin see, this guy is the real NSA

Not me!

SEJPM

14:12

@TerryChia you can ask about this (I won't), this sounds rather uninteresting compared to DROWN

Mark Buffalo

secretly steals @ThomasPornin's knowledge and adds it to the Ancient Repository of Federal Knowledge

AviD

@ThomasPornin did @ThomasPornin just reversengineer yet another sooper seekret logofied crypto attack?

I always miss the good stuff... :-(

Thomas Pornin

@AviD No... I just read the abstract, looked at the figures, and jumped to the conclusions.

But the article deserves a more careful reading, that I will now do.

AviD

heh

Mark Buffalo

I like how you got upvoted before people even read your answer

Thomas Pornin

14:14

I am not the only one to jump at conclusions.

Mark Buffalo

I READ IT FIRST

Haha

SEJPM

@MarkBuffalo there's a bear below the answer, IT MUST BE GOOD

AviD

@MarkBuffalo its an automated hypnotic reflex

Thomas Pornin

@TerryChia "This is despite the fact that OpenSSL's RSA implementation was carefully designed to be constant time"

Well, that's it: OpenSSL made some ritual gestures to make believe that they did something constant time, but they failed.

(Note to @AviD: here we are not talking about DROWN, but something completely different.)

Simon

I wonder if there will be a point in time where I'll criticize how OpenSSL was made.

Probably not.

AviD

14:16

@ThomasPornin thank you kind sir for the executive summary.

Simon

@ThomasPornin Is that a disclaimer because you think ovid can't follow a discussion?

If so, that's funny as hell.

AviD

I still have no idea what we're talking about, I only pop in once in a while to slap soimin, havent had time to read what we're on about.

@Simon lol not

SEJPM

@AviD the next big TLS attack

AviD

its a courtesy summary

@SEJPM that I picked up (well, -ish) - have link?

Simon

You think bears are all about courtesy?

SEJPM

14:18

11

A: What is DROWN and why is it even possible?

To understand the attack, one must recall Bleichenbacher's attack from the late 20th century. In that attack, the attacker uses the target server as an oracle. When using RSA-based key exchange, the client is supposed to send a secret value (the "pre-master secret") encrypted with the server's pu...

drownattack.com/drown-attack-paper.pdf

drownattack.com

blog.cryptographyengineering.com/2016/03/…

AviD

@SEJPM thanks!

SEJPM

arstechnica.com/security/2016/03/…

AviD

@SEJPM oh crap it is seriously logofied and webified....

aaaand too many chrome tabs.

Mark Buffalo

@ThomasPornin Would you think Hanlon's Razor applies here, or is it safe to put on my aluminum foil hat?

Thomas Pornin

@AviD And apart from that new attack, other people appear to have published another, completely different exploit of a side channel leak in OpenSSL, called CacheBleed: ssrg.nicta.com.au/projects/TS/cachebleed

Talk about a bad timing...

Francesco

14:20

by the way maybe it's me but the kind folks at keepass could opt for https over http

Mark Buffalo

@ThomasPornin Is this recent?

SEJPM

@MarkBuffalo patched today

M'vy

> The solution: don't use SSL 2.0. Dammit.

Thomas Pornin

@MarkBuffalo Apparently it was published just today.

AviD

@MarkBuffalo never safe, aluminim conducts brain control waves

M'vy

14:21

Could not put that better

Simon

Another freaking article to read?

God damn it.

Mark Buffalo

@ThomasPornin damn.

Simon

THAT ONE IS ABOUT PROCESSORS?

AIN'T NOBODY GOT TIME FO DAT

SEJPM

@MarkBuffalo but you can still make a question about it...

Mark Buffalo

see: this is a funny thing about the NSA saving encrypted communications and storing them

SEJPM

14:22

@Simon old processors

Thomas Pornin

@Simon And cache lines. And inability of OpenSSL developers to accept the inevitable.

Mark Buffalo

eventually, a weakness will be revealed in an implementation of tls/ssl/whatever, and they may be able to exploit it

That's actually really good thinking

SEJPM

@MarkBuffalo storage is cheap

Thomas Pornin

@MarkBuffalo It is implausible that the NSA records encrypted communications and stores them. There is a lot of the stuff; it would be very expensive.

Simon

"In order to mount the attack, the attacker has to be able to run the attack code on the same machine that runs the victim code"

Ok guys, there's nothing to see here, carry on.

SEJPM

14:23

@Simon say that to amazon and google and microsoft

Thomas Pornin

@Simon Mind the details: the same hardware. Technically, it works across VM that just happen to share the same CPU

Mark Buffalo

@ThomasPornin I read a document where the NSA stores a lot of them for a certain amount of time, up to 2 years

Simon

@SEJPM That's fine, I'm not working for those guys.

@ThomasPornin I see.

Thomas Pornin

@MarkBuffalo In fact it is not the storage that I find implausible, it is the bandwidth. Basically, this would mean that they can take the whole Internet bandwidth and could buy enough cables to transfer it to their storage facilities.

SEJPM

@MarkBuffalo 10 bn dollars a year and 4TB for 150 dollars (or less) they can store a lot

Ohnana

14:25

@MarkBuffalo fair enough, but you might consider helping her protect stuff

Mark Buffalo

@ThomasPornin They have capture equipment built into every hop, apparently

Thomas Pornin

Contrary to just storing metadata, storing whole encrypted sessions seems to be extremely impractical.

AviD

@SEJPM "storage", is that a sweet nickname for @Simon's mom?

Mark Buffalo

yea, but if it's a simple thing like communication between individuals, that's easier to target

SEJPM

@MarkBuffalo yeah you can filter the sessions based on the endpoints :/

Mark Buffalo

14:26

The xkeyscore selectors are able to sift through that data and find all typical communication patterns

Rory Alsop

@AviD bragging? Moi?

AviD

hehe

Mark Buffalo

@Ohnana yeah, I do... but she uses computers/devices much like your average person, heh.

It's only 99 cents anyway... I'll let it slide for now

Ohnana

@MarkBuffalo lol

SEJPM

may I ask the wise @ThomasPornin to take some time for the underprivileged crypto peasants and troll Telegram a bit? crypto.stackexchange.com/questions/31418/…

Mark Buffalo

14:28

I'll tell her, and she'll forget because of the convenience

@SEJPM Who is Telegram?

SEJPM

@MarkBuffalo a bad and popular "secure" / crypto messenger

Mark Buffalo

nm

I finally read your post

Thomas Pornin

@SEJPM Not today, I have some work to do.

kalina

@AviD is that so

charming

Mark Buffalo

forbes.com/sites/andygreenberg/2013/06/20/…

AviD

14:31

@kalina ha! you unignored me! yay!

hiiii @kalina!

@kalina and, is it not?

Mark Buffalo

Okay, so 5 years, not 2 years

kalina

and immediately back on ignore

Mark Buffalo

@kalina morning

AviD

awww :-(

Xander

@MarkBuffalo How is it that you can read Forbes? Are you not using an ad-blocker?

kalina

14:31

@MarkBuffalo hi/bai

Rоry McCune

@AviD ranum.com/editorials/corporate-songs/Symantec_Revolution.mp3 <-- listen to that, it'll cheer you up

@kalina o/

Mark Buffalo

@Xander I am using an adblocker, of course.

@Xander Are you using NoScript?

AviD

@RоryMcCune hmm

wut

M'vy

@AviD that's not a tigger avatar you need but Hobbes'

Mark Buffalo

If you've got NotScript blacklisting forbes, you won't be able to read it right, I suppose.

Rоry McCune

14:32

@AviD the lyrics are really... special

Xander

@MarkBuffalo No, I'm using Chrome.

RoraΖ

Wait I'm NOT supposed to use SSLv2?

Simon

@RoraΖ Only since today, man.

Mark Buffalo

uBlock Origin + NoScript here.

Xander

@RoraΖ No, go ahead. Use it as much as you like.

SEJPM

14:34

@Xander but hang yourself afterwards pls?

M'vy

@RoraΖ not since last decade

Matthew

@RoraΖ No. You should use SSLv1. Much better - no-one ever broke it in practice!

SEJPM

@Matthew give me a spec and I'll use it

Matthew

* lack of breakage may be down to lack of official release. Use of SSLv1 is limited to people who can access the specifications

RoraΖ

I'll update all my browsers to support SSLv2/1

SEJPM

14:36

@RoraΖ they're no longer shipping with support :(

Ohnana

@SEJPM i use telegram

SEJPM

@Ohnana poor you

Ohnana

@SEJPM :>

Mark Buffalo

> This material is based upon work supported by the U.S. National Science Foundation under Grants No. CNS-1408734, CNS-1505799, and CNS-1513671

I wish the NSF would support non-university-affiliated researchers

Matthew

Would it be mean for someone to say "hey, is your IP address 127.0.0.1 if you run ipconfig?" in response to

0

Q: Running Kali linux

I have been going thru some Information security articles on how to browse Internet anonymously without being back-tracked and found that Kali Linux is one for the best tools around there. I have installed kali Linux 64bit version on my USB drive and would like to use it as a plug-n-play OS with...

Thomas Pornin

14:41

@Matthew In fact, rumour has it that when the protocol was first presented to external cryptographers, the audience had assembled and described several devastating attacks before the present had actually finished his presentation.

That's why SSLv1 is said to be "embarrassing".

Xander

@ThomasPornin Whoops. That's not an auspicious beginning.

Mark Buffalo

reuters.com/article/…

good game.

diagprov

@ThomasPornin Was that a pun Dr Pornin?

Ohnana

@ThomasPornin ouch

Thomas Pornin

@diagprov Of course.

Matthew

14:46

@ThomasPornin But not in active use... I was very careful with wording - they were attacks based on theory, rather than practice!

Mark Buffalo

14:57

ok I've got 8 months to lose like 50lbs

Journeyman Geek

0o

Matthew

@MarkBuffalo I recommend the "chainsaw juggling" approach

Mark Buffalo

@Matthew going on keto

Arperum

@MarkBuffalo If I lost that much I would be severely underweight.

Matthew

@MarkBuffalo We had someone in the office who did that - lots of avoiding specific things because their effects are amplified, I seem to remember

Mark Buffalo

15:03

@Matthew Yep... so I would have to eat purely meat, eggs, cheese... and drink only water/diet soda

It works, though. I can dump 90lbs in 6 months if I stick to it... problem is, my wife cooks delicious, lovely Chinese food all the time...

But I really just need to lose 45-50

Rоry McCune

@MarkBuffalo eat... smaller... portions

Mark Buffalo

@RоryMcCune I do :/

also, I can walk a mile a day at lunch

Rоry McCune

@MarkBuffalo evidently not, if you need to lose 50lbs. Obesity rate in China is a lot lower than the US so it obvs. isn't a problem with Chinese food per-se

Arperum

@RоryMcCune I recently started to eat portions aimed at a single person instead of 2-3 people. Result is that I lost 3kg or something.

Mark Buffalo

@RоryMcCune I eat 2 small sandwiches every day, and finally, one dinner. that's all I eat

but I'm also not getting any exercise in the past few months

Rоry McCune

15:05

@Arperum yeah it's my problem too, my missus is a good cook so I eat too much, it's the portion size that's the problem

Arperum

@MarkBuffalo And how much soda/whatever sugary stuff do you drink?

Mark Buffalo

@RоryMcCune food is smothered in cooking oil :O wife uses way too much of it

@Arperum zero. I hate sugar

Terry Chia

@MarkBuffalo Try eating less, but eating more often.

Arperum

@RоryMcCune I am terrible at estimating a good portion, I made pasta on friday and had food for three days.

Mark Buffalo

@TerryChia Yeah, that's a good idea too

but keto works regardless of my lifestyle... so. yeah. I'd like to look good at the wedding, lol

Rоry McCune

15:07

@Arperum my better half has a chronic fear of cooking to little, so the result is she always cooks too much... this would be fine, except it's very nice and I was brought up to believe that it's rude to leave food on your plate

Mark Buffalo

@RоryMcCune same...

I don't like wasting food...

Arperum

@RоryMcCune Heh. My dad feels bad if there exactly everything is eaten. You eat what you put on your plate, but if there is leftovers, that's fine.

And then you can eat the leftovers later.

Mark Buffalo

@RоryMcCune In China, I ate the same as I do now... or worse, actually. The difference is, in China, we needed to take a bus to go anywhere... which involved walking to the bus station... then walking everywhere else. So much walking. The entire society is built on walking around and getting stuff done

Simon

I usually don't take time to ask myself if I'm still hungry, I'm programmed to finish my plate too.

Mark Buffalo

I drank a lot of sugary sodas, ate a lot of sugary snacks, chips, and vendor junk... but all the walking kept me thin

Arperum

15:11

I think I got to ~78-79kg earlier last year, then the summer festivals caused me to loose some width (pants were suddenly kinda wide), although I don't think I lost much weight. ANd now I'm at 76.5kg or something.

Mark Buffalo

@Arperum 150kg -> 92 kg (bone thin) in 1 year in China :o

Arperum

@MarkBuffalo What kind of length are you that 92kg is bone thin?

Mark Buffalo

203-205cm

Simon

@Lighty I don't even want to hear about it.

Arperum

@MarkBuffalo Do you have Dutch ancestry or something?

Lighty

15:13

@Simon :P

but

Simon

@Lighty WHAT DID I SAY?

Lighty

is cipherli.st a good source as a cypherlsit? or are there any more suggenstions

Simon

@Lighty I use this: wiki.mozilla.org/Security/Server_Side_TLS

Lighty

@Simon sssshhhh.... it'll be over soon

Mark Buffalo

@Arperum Norwegian/Native American/French/Irish/various other types of honky.

Arperum

15:15

@MarkBuffalo I'm only 181 cm. And for my dad's family I tower above most of them.

Mark Buffalo

My great grandfather was 218-219 cm

Arperum

mumbles something about running into giants all over the place lately

I got a new girlfriend, and her dad is about your size :p

Mark Buffalo

@Arperum Does he like you?

M'vy

> Fashionability. Elliptic curves are cool. -- Thomas Pornin '13

Simon

@M'vy What a nurd.

Arperum

15:20

@MarkBuffalo He didn't try to kill me anyway. Didn't get a deathglare either. her brother is apparently not amused about me though. (she turns 18 next week, I turn 28 later this month)

Mark Buffalo

@Arperum wut

I'd have killed you immediately on the spot

and immediately burned your body

Arperum

@MarkBuffalo Ya well. It's not like am trying to take advantage of her. I very much do not want that.

Rоry McCune

@MarkBuffalo #Murica!

AviD

@MarkBuffalo not immediately, need to leave some time for all the desecrating

Mark Buffalo

Well that's good. My default policy is to immediately kill you and burn your body, unless I like you.

@RоryMcCune =D flies American flag dramatically

Arperum

15:22

@MarkBuffalo Good thing I'm somehow pretty likeable.

AviD

@MarkBuffalo I find torture to be more effective. and fun, too.

Mark Buffalo

That makes me even more suspicious of you

@AviD Agreed, a little fireboarding never hurt anyone... much...

Arperum

@MarkBuffalo Thanks :p I would be too.

AviD

@MarkBuffalo I read that in the Joker's voice

Mark Buffalo

@AviD Do you want to know how I got these emotional scars?

Arperum

15:23

No seriously. The very idea has haunted me. I could never have imagined it.

AviD

hehehe

but no, the other joker

Arperum

Apparently her parents expected her to come home with a friend of her brothers age (which is 3-4 years younger than me) so they weren't super shocked.

Simon

Never understood the whole thing of girls specifically going for older dudes.

AviD

Suicide Squad - Comic-Con First Look [HD]

►

Mark Buffalo

@Simon Because younger dudes are very immature and usually don't want to settle down yet

A lot of girls I know want to settle down, but the guys don't. "Luls, I don't want keeds." So they aren't going to waste their time with them

Simon

15:27

@MarkBuffalo Oh, you mean those 16 years old girls who are pregnant because they're sooo ready to live an adult life?

From my experience, the girls who claimed that they wanted to be with an older guy turned out to be very immature.

Rоry McCune

@Simon I think the suggestion is that older men are less immature

Simon

@RоryMcCune Yes, but see what I just posted.

Rоry McCune

@Simon I'd use you as an example and suggest you were more mature than you used to be but then my mind exploded trying to think of how that means you must've been when you were younger :op

4

Arperum

@MarkBuffalo I do not want to settle down. Stable relationship, yes. Settling down. Hell no.

Mark Buffalo

@Simon I mean girls 18+ who want to settle down and have a family

Simon

15:28

@RоryMcCune I was a legend on another forum because of the stupid shit I posted.

diagprov

@RоryMcCune Imma star that.

Mark Buffalo

Not some girl who was tricked by some guy into getting knocked up

Simon

@MarkBuffalo Yes, but early 20s is still really young to pretend that you figured out everything that you want your life to be.

Arperum

@MarkBuffalo These dudes are just horrible.

AviD

@Simon just like here.

Mark Buffalo

15:30

@Arperum Indian reservations. not even once...

Simon

OVID CALLED ME A LEGEND

diagprov

@Simon There's a difference between loudly proclaiming "older guys are more mature" and actually being attracted to older guys because they are more mature. That is, perhaps some are not looking necessarily on age, but just for reasonably mature, and it happens older guys satisfy that.

Mark Buffalo

My sister is 12... her classmate got knocked up.

AviD

@Simon same with early 40s.

Mark Buffalo

This is COMMON over there

Arperum

15:31

@MarkBuffalo >_>

AviD

@MarkBuffalo wat

Simon

@AviD Nah, your life is over at that point and should have been coffin shopping for at least 10 years.

@diagprov Absolutely.

diagprov

@AviD That's like nearly half a century. Wow.

Mark Buffalo

@Simon Not really. I married my wife when she was 21

Arperum

@Simon Whenever you turn 30 I want to see a picture of you going coffinshopping

Mark Buffalo

15:32

We had a kid next year

Neither of us regret it

Some people know what they want... others don't

Simon

@MarkBuffalo I wouldn't have made that decision at that age but good for you guys.

@Arperum I'll try to deliver.

Mark Buffalo

@Arperum So you don't want to get married and have kids?

@Simon Well, when girls who do want to make that decision can't find men their age, they'll go for older men

Arperum

@MarkBuffalo Not yet anyway. At some point, sure. But not in the near future.

AviD

@MarkBuffalo same (well, 22), but thats less about deciding what you want 50 years from now, but the potential to grow together, into what you both will want, and want to be.

Mark Buffalo

@Arperum Make sure she knows that... women have a lot of expectations...

Simon

15:34

@MarkBuffalo Yet I do not see the point to hurry up to settle down.

Mark Buffalo

@AviD Yep. And the younger you have them, the more full your life will be when you're older

@Simon I waited until 29 to have kids

Arperum

@MarkBuffalo She knows. And she has the same position.

AviD

@MarkBuffalo I find that most young girls that go for older guys are very much NOT about settling down, they just like showing off the older guy, and what comes with that.

Arperum

She first want to go do some studies she's very interested in (and she very well should)

Mark Buffalo

@AviD Yeah, that's true too

Simon

15:35

@AviD Yup, I also witnessed that.

It's much "cooler" to go out with an older guy.

Mark Buffalo

I dated a girl who wanted to show me off

It was stupid

Dumped her quickly

AviD

@Simon which is stupid.

Simon

@Arperum That's the logical way to do things, yes.

AviD

except that older guys do tend to have more money, and do more funner things.

Mark Buffalo

(she was older than me, lol)

Thomas Pornin

15:36

@AviD "More funner" ?

Simon

rekt

AviD

@ThomasPornin yas

Thomas Pornin

@AviD That seems excessive.

Simon

Haha.

AviD

I can word the things how any way I wanting.

cmon, my attention is split in so many ways right now - I'm not even looking at the window I'm typing in.

M'vy

15:37

the more weirder the word, the more better.

Simon

the most weirdest, the most best

Rory Alsop

Many more cromulent

M'vy

@AviD please type your password

3

AviD

hehe pfft

M'vy

Well I leaked one of my password couple of days ago cause of bad UI

Rоry McCune

15:38

@AviD geez crappy password no upper case, special chars or numbers!

AviD

@M'vy you think I know how to type my password?

Rory Alsop

Betterer: Please retype your password for confirmation

Simon

@ThomasPornin Let me know if you get your nsec ticket so we can arrange a donut meeting.

Rory Alsop

^ pls none more euphemism-ish

M'vy

@Simon is this some code for ... ?

Rоry McCune

15:42

@Simon what's nsec?

Simon

@RоryMcCune nsec.io

Thomas Pornin

@Simon I am trying to obtain confirmation.

Yes, apparently it's good.

Simon

Perfect. I'll get my confirmation too.

Rоry McCune

@Simon you should go along to this guy's talk nsec.io/2016/01/… and point out to him why he should be focusing on the awfully vulnerable iOS platform instead of Android :op

Simon

By confirmation I mean actually ask to go because I haven't yet but I'd be surprised if they said no.

RORO COME ON

Are you giving that talk? Is your nickname Keven Marin?

Thomas Pornin

15:45

@RоryMcCune iOS is rock solid; it is FBI-proof.

Mark Buffalo

@ThomasPornin Somehow I think this is a red herring or something

Rоry McCune

@ThomasPornin hey now watch, if you say nice things about iOS security @Simon will get all mad again

Simon

It's FBI proof because they're using it as an excuse to build a backdoor, you've said it yourself pornu.

Mark Buffalo

Pretty sure they already had one

The NSA put on a big show about being frustrated by Skype encryption... meanwhile, they had a backdoor in it for years.

Iszi

Here's a thought I just had: Unless you actually know how tracert works, its output can be a little deceiving. Most people, I think, expect it to show (more or less) the exact route that network traffic takes between the local system and some endpoint. But that's not the case. For each "hop", it only shows that one part of the route that one particular packet took - and this may or may not be the same route that was used to find the hop before it or the hop after.

Am I crazy, or is this just a part of life on the interwebs that I'm just now realizing?

Thomas Pornin

15:51

@Iszi That's why it sends three packets.

So that you may notice when the route varies.

Iszi

@ThomasPornin But it only logs one node.

Thomas Pornin

@Iszi It is supposed to show something when the three responses don't come from the same IP address.

Now of course, any particular implementation of the tool may fail to do things properly.

Iszi

This whole thing only occurred to me when I ran a trace that ended up having the same node listed twice - back-to-back. Only reason I could think of is that the second listing was due to a packet having taken a longer route to that node than the first.

Thomas Pornin

I am more used to the Unix-like traceroute than to the Windows tracert.exe.

I think there is a detailed traceroute output analysis in one of the Stevens book, with details about multiple routes.

I remember reading it about 20 years ago.

Transcript for