The DMZ

Mark Buffalo

15:00

torproject.org/docs/faq.html.en#AttacksOnOnionRouting

SEJPM

@MarkBuffalo expected?

Thomas Pornin

@RoryAlsop Shooting other participants of a CTF works, but is considered rude.

3

Mark Buffalo

Some folks like to argue against it being possible for correlation / data analysis of TOR networks. Even the TOR developers acknowledge it's quite possible

SEJPM

@MarkBuffalo you can't defeat TA and have real-time data transfer?

Thomas Pornin

There is no need to run: the average geek cannot move substantially faster than an energetic crawl.

Mark Buffalo

15:02

@ThomasPornin lol

M'vy

@ThomasPornin Can we bring Nerf guns ?

Xander

@ThomasPornin Not if it's a paintball CTF.

Mark Buffalo

@ThomasPornin I once had to outrun a taxi in China to get them to take me

but they were driving slowly :(

Thomas Pornin

24

A: Why is Tor safer than a proxy?

In Tor, the user (you) chooses a random path through several nodes for its data. The first node in the path knows your IP address, but not what you send or where. The last node ("exit node") knows the target server address and sees the data (unless SSL is used, of course), but not your IP address...

Mark Buffalo

> (which, of course, will not say "provided by your friendly government")

lol

I already upvoted this!

@ThomasPornin Do TOR nodes have the same length along every circuit?

That is to assume the same encrypted data is being sent across every node, and not being re-encrypted, etc

or that encryption isn't giving the same length on every node

SEJPM

15:09

@MarkBuffalo TOR works by onion encryption (IIRC)

@MarkBuffalo not exactly the same length on every node, but a predictable length

9

A: Does Tor insert random delays or perform packet re-ordering to make the discovery of the communication path harder?

Tor uses fixed cell sizes. The design document states: Traffic passes along these connections in fixed-size cells. Each cell is 512 bytes, and consists of a header and a payload. Apart from that no further mixing or randomisation is used: No mixing, padding, or traffic shaping (yet): On...

kalina

@Xander I would be up for paintball ctf

RoraΖ

@MarkBuffalo The data is encrypted on the client side with all 3 negotiated keys. Not encrypted on each node

kalina

quick let's detail this information security conversation with ponies

RoraΖ

@kalina I did a D-day re-enactment once with Paintball. Not fun

kalina

Rory Alsop

15:16

I am not asleep

kalina

you're old enough and slow enough that the difference is academic

7

Rory Alsop

Probably true

RoraΖ

lol

Lighty

@kalina rekt

kalina

I try

inb4 you are trying

Ohnana

15:18

@kalina oooh shit

Arperum

@kalina AT one point I am going to get my hair dyed in rainbow colors.

Ohnana

@Arperum mohawk?

Rory Alsop

@kalina sometimes speed is contraindicated. Us old folks go more for stamina...

Arperum

@Ohnana Nope. Long hair.

Ohnana

@Arperum oil slick style or horizontal lines?

Rory Alsop

15:19

Not dip-dye, surely

Mark Buffalo

@RoryAlsop why not both? ;)

Arperum

@Ohnana I haven't decided yet how I'm going to do it exactly yet. It's currently a dark purple. ALthough it has faded a bit to a reddish purple.

Lighty

Talking about CTF

thingiverse.com/thing:1241623

that 3d model? dayum

Xander

@kalina I, unfortunately, am too decrepit for those sorts of shenanigans. I haven't played paintball in the last 10 years, at least.

Ohnana

@Arperum ooh. you'll either have to grow fresh hair or bleach the shit out of it lol

dark purple is pretty though

Mark Buffalo

15:21

damn, I just dropped 4.1k on credit cards

Arperum

@Ohnana I haven't bleached it yet, otherwise it would be way more purple :p

Mark Buffalo

that hurt. but financial responsibility must be a thing

Rory Alsop

I've just spent 2 hours booking 6 flights, 3 hotels and 3 sets of car parking. That's not an efficient use of time

Who knows how much it cost? I don't - I'm claiming it all back

Mark Buffalo

@RoryAlsop That's a lot of flying. Stopovers?

Arperum

But yes, I will bleach it at that point. I'll probably bleach and then go for blue hair first though.

Rory Alsop

15:22

It's more than I usually do in a month, yes. I try for one return flight a month

Mark Buffalo

I don't enjoy flying because I'm always flying coach, and can't sleep

after 30 something flights... it gets to you

silverpenguin

@MarkBuffalo Im 197cms ....coach sucks...

Mark Buffalo

@silverpenguin 203

silverpenguin

@MarkBuffalo you win this round

Rory Alsop

I am happy flying cattle class for a 1hr flight, but any time I have to fly more I upgrade. I used to fly 4 return flights every month, from everywhere from mid-USA to Singapore. Now I just won't do it if I have to be cramped - and I'm nowhere near as tall as you

Mark Buffalo

15:24

my wife can fly cattle class. she's 4'10" luls

silverpenguin

@MarkBuffalo I work with aircraft so i am either flying coach or private

Rory Alsop

I want a comfy flight, a good hotel with a decent bed, peace and quiet and a good shower. After that, I'm happy

Mark Buffalo

@RoryAlsop Yep... imagine a 60 hour flight

I do those a lot

Rory Alsop

Even happier if I get to be at the pointy end. And best if I get to actually fly the thing - but that's been a while

Ohnana

i've found coach to be perfectly comfortable

Rory Alsop

15:25

@MarkBuffalo how 60 hours? Even home to Australia is only 25 with a stopover in the middle if I fly cheap. It's 17 for a direct.

Are you flying laps of the planet?

2

Ohnana

then again, i'm short enough that if I take a straddle position, i can fit my head under the cabin compartments in most boeing aircraft

silverpenguin

@Ohnana ever had someone snoring, kicking you, kids screaming and farting next to you for 12 hours?

Ohnana

@silverpenguin no, yes, no, no

actually, no. a kid was whining on the way to munich

Mark Buffalo

because: rural area -> airport = 1 hour. wait at airport for 2-3 hours. fly to point 1. wait 5-7 hours... fly to point 2... wait several hours... fly across the pacific ocean... wait 15 hours to land. wait in major international airport for several hours. fly to another city... wait for several hours... fly to another one... finally, you have arrived. 3 hours to get to the hotel room...

silverpenguin

@Ohnana that is coach to me... that was my 12 hour flight from tokyo

Ohnana

15:27

i told them that if they didn't stop crying the pilot would flush them down the aircraft bathroom when their parents weren't looking

silverpenguin

did it work?

Mark Buffalo

but wait... what... you can't find the hotel because it doesn't exist

Ohnana

blessed silence :)

Mark Buffalo

so you have to go around looking for another hotel

Rory Alsop

@MarkBuffalo Ah - yeah, that's fine. Always make sure you get the business or first class lounge when at airports and that helps

Mark Buffalo

15:27

@RoryAlsop Yeah, I walk into the first class lounge sometimes

they usually don't care

the last flight home from China was so brutal

9 hours of waiting in Guangzhou

I didn't sleep for nearly 60 hours

now I don't live in rural crapholes anymore, so there's no issue

fortunately in Hong Kong, they have these little sleeper cells that you can rent. you can shower, sleep, etc. it's $187 or so, but totally worth it

sweet precious sleep

Simon

@RoryAlsop RORO I FOUND THE CATBACK THAT I NEEEEED

LACHUTE PERFORMANCE - BRZ/FR-S/GT86 Catback -

►

Rory Alsop

Googles Catback.... Oh, hadn't heard it called that before :-)

silverpenguin

@MarkBuffalo I once had to fly to morroco, catch a private jet to the states, wait for 2 days, catch a poor people plane to iceland and then wait for 3 hours to get back home.. thankfully i got a hotel room... but my flight out to israel was delayed for 2 hours and my flight back home was the next day at 4am (I have to board with the crew) I sat for 3 hours in my hotel room waiting to fly back on the jet so i could work... flying the world is a tiring task

Simon

@RoryAlsop Really? ô_ô

Gilles

2

A: Why is weakness of SHA-1 considered a threat to TLS security

If they find a different value that produces the same SHA-1 digest as the website's actual public key, what have they gained? Let's assume that we are dealing with MD5. SHA-1 attacks are still a work in progress and I expect they follow about the same lines as the attacks that are possible o...

Rory Alsop

15:32

Can't watch that here @Simon - will do later.

Gilles

excellent answer

Simon

@RoryAlsop Aw, ok.

Mark Buffalo

@silverpenguin Those are the frigging worst ever. It's so bad when you know you can finally sleep at the airport, but if you do, you won't wake up in time to catch your flight, and you'll be screwed

Rory Alsop

@Simon I see the title, so I'm assuming a revving Scooby with that Catback fitted?

Simon

@RoryAlsop Ya, a test drive with it.

Ohnana

15:33

i once tried to sleep in a terminal at KEF for 7 hrs...

Mark Buffalo

if I sleep during those 3-4 hour layovers, I won't sleep at all. then I get on the plane and can't sleep because of my body length / people bumping me constantly

Ohnana

IT. DIDN'T. GET. DARK.

WHAT IS WRONG WITH ICELAND.

Rory Alsop

I sleep anywhere that moves

Mark Buffalo

@Ohnana Day time 24/7 during some parts of the year

kalina

@Arperum hair murder inc

Rory Alsop

15:33

@Ohnana - in northern climes, you sleep in the dark times. It's called hibernation

Even where I grew up, you'd have a month and a half of daylight you could read by in the summer

Mark Buffalo

@RoryAlsop you're lucky. in China, I have to watch out for people trying to steal my phone on the plane/train/etc

Ohnana

the sun dipped below the horizon halfway then came back up

Mark Buffalo

I'm the only one awake 99% of the time on the train

Rory Alsop

And a month and a half of deeply dark night time in the winter

@MarkBuffalo fit traps

Ohnana

@RoryAlsop WTF where did you grow up?

kalina

15:34

@Ohnana the very north

Mark Buffalo

it gets really fonkey when there are like 100-200 people sleeping in one train car

all packed with CNY superstars

kalina

@MarkBuffalo cattle cars?

Mark Buffalo

i.guim.co.uk/img/media/fe8b2e9694abd8dfe60a4568e400f9466027267f/…

yes, I travel on those days. yes, I am certifiably insane. but I love it!

Rory Alsop

@Ohnana The very north - 59 degrees north, in fact

kalina

@RoryAlsop pls it's never been 59 degrees up north

Rory Alsop

15:36

Even now I'm 55.9 degrees north

@kalina lol - it's grim up north

Mark Buffalo

@kalina google.com/…

Ohnana

@RoryAlsop goddamn

Mark Buffalo

@RoryAlsop damn. -59 is the worst I've ever had it

if you had that on a regular basis... hoo boy

Ohnana

so you grew up in orkney?

Arperum

@kalina True. But think of the colours!

Rory Alsop

15:38

@Ohnana further north than Juneau in Alaska

@Ohnana there, and a place 9000 miles further south, yes

silverpenguin

@MarkBuffalo last month i had to go to amsterdamn for the day, nearly missed my flight... for erm... undefind reasons :3

Rory Alsop

At 51.7 degrees south

Mark Buffalo

@silverpenguin High on crack marijuana powder?

silverpenguin

@MarkBuffalo yup so so so so so high

@MarkBuffalo i fell up the stairs

Mark Buffalo

I think I am the only one here who has never touched drugs

RoraΖ

15:39

@MarkBuffalo Do you count alcohol?

silverpenguin

you dont touch drugs, they touch you

RoraΖ

Show me on the doll where the dirty drugs touched you?

Rory Alsop

@MarkBuffalo bet you have. The stats on cocaine on dollar bills are frightening

silverpenguin

I dont drink alcohol, i cant get drunk any more it costs me 100s

Rory Alsop

@silverpenguin I find I lose no time at all

Mark Buffalo

15:40

@RoryAlsop Hey now, that doesn't count!

Yeah, there's so much coke on U.S. dollar bills

@RoraΖ Yes. I've never drank any alcohol in my life either

silverpenguin

@RoryAlsop you lose no time? i didnt lose time i just couldnt move.. i smoked 7 strains in 3 hours ... i got carried away

Rory Alsop

I don't even know what that means... Strains?

Ohnana

@RoryAlsop different types of weed

they're bred for different proportions of compounds

Rory Alsop

Oh - is that good?

Ohnana

there are some strains that are bred for high THC to get you blasted

silverpenguin

15:42

@RoryAlsop very good e_e

Rory Alsop

(Haven't been to Amsterdam for ages, and didn't really ask that level of detail)

TildalWave

is this off-topic here?

0

Q: Confidentiality then Integrity with different keys

can any one describe how we can do what is said in the below sentence which is in Mark Stamp crypto slides on slide number 101 : Can do a little better - about 1.5 “encryptions” The whole slide is as follow : Encrypt with one key, MAC with another key Why not use the same key? Send last encryp...

Ohnana

there are others that are bred for medicinal uses, which tend to be low in THC and higher in compounds that can help with seizures and pain

silverpenguin

i finished off with a strain called "white walker"

TildalWave

because I don't think it is

Ohnana

15:43

@TildalWave i VTC'd for crypto migration

SEJPM

@Ohnana we already have a very similar there

TildalWave

@Ohnana OK, but why? Is it off-topic here?

I know it's on-topic there, but that's not a reason to migrate

Ohnana

it's tricky because crypto is a subset of Sec, but this question is delving more into the protocol, not the application of.

Mark Buffalo

@Ohnana same

Ohnana

so i thought it would be a good fit for crypto, since their thing is protocol

Mark Buffalo

15:44

I don't trust anything that requires us downloading/reading a powerpoint presentation to answer.

Ohnana

similarly, if someone had a question on application of crypto, that's more our wheel-house

SEJPM

@MarkBuffalo you don't need to download the presentation

Mark Buffalo

finally got to the top 30 all-time users on secse

Graham Hill has been dethroned

as #30

SEJPM

I just copied over the Crypto.SE formatting for (top part of ) the question and the quotation is absolutely what is in the presentation

kalina

I don't understand the question

(and don't want to)

SEJPM

15:48

@kalina "You want to do 2 things, how can it only cost 1.5 ?"

kalina

no pls I really don't want to know

it may result in me forgetting something important

SEJPM

@kalina aka how is this crypto magic so fast!?

kalina

like say, the reason why I empathize with your primitive species rather than just nuke you from orbit

it could be dangerous

TildalWave

@Ohnana I think it's borderline but it's hard to say because OP seems to be misinterpreting the source

kalina

misinterpreting the sauce?

SEJPM

15:50

@Ohnana the question is about block cipher modes

Ohnana

@SEJPM are you done

SEJPM

especially about AES-GCM

@Ohnana ?

Ohnana

@SEJPM you kept editing it :P

anyways, you know a fair amount more about this. is the question more about the protocol or application?

i'm willing to retract my close vote

SEJPM

@Ohnana 1st edit: improved meaning, 2nd edit: fixed typo

Mark Buffalo

@tylerl Greetings

@tylerl I'd like to see you post more around here! stalks

SEJPM

15:53

@Ohnana the question is about encryption mechanisms. There is no protocol involved here and no specific application of encryption / authentication

Gilles

@TildalWave It's already been posted on Crypto, so just close it here as crosspost

Ohnana

@SEJPM could you clarify "encryption mechanisms?" as in, the algorithm itself?

kalina

@SEJPM @Ohnana basically I feel much better that you didn't get the question as well

it's difficult being the least knowledgeable individual in the room on a subject that the room is about(!)

SEJPM

@Ohnana yes it is about how specific authenticated encryption schemes works

TildalWave

@Ohnana I didn't mean to push you to retract the close vote, I want to know if we've decided on the demarcation line what's OK here and what should be migrated on crypto

Mark Buffalo

15:55

@kalina I doubt you're the least knowledegable one here, haha

Ohnana

@TildalWave no ees okay

kalina

@MarkBuffalo pls totes am

All I know about encryption and cryptography is that it has something to do with blowing fish

and numbers

SEJPM

@kalina no longer

Mark Buffalo

ha. back in the day, as a kid, I wrote a little blowfish encrypted chat client

SEJPM

@MarkBuffalo back in 1994?

Mark Buffalo

15:57

blowfish is so oldschool

Like 99? Or 00?

kalina

I find that hard to believe

you were never a kid

Mark Buffalo

my friend and I used it until we decided encryption was boring

SEJPM

@MarkBuffalo '94

blowfish is from '93

Mark Buffalo

@SEJPM no, I mean when I wrote the chat client

I didn't write blowfish

SEJPM

@MarkBuffalo I know that, blowfish is by Schneier

TildalWave

15:58

@MarkBuffalo Just the client? The server was IRC? :P

kalina

how could the backend be irc when irc doesn't support encryption

Mark Buffalo

1

A: Can you encrypt data using BCRYPT?

I am replying on behalf of GhostMail. First of all we are sorry for the possible confusion. The misunderstanding related to encryption vs hashing using the BCRYPT algorithm has been corrected on our website. As pointed out by Oasiscircle they are obviously two different things for different pu...

@TildalWave irc client

@kalina you can send encrypted text over irc?

kalina

rfc 1459 contains no provision for encryption so what did you connect to?

well that's boring

Mark Buffalo

you send encrypted text over irc.

Transcript for