« first day (1907 days earlier)      last day (3022 days later) » 
00:00 - 20:0020:00 - 00:00

12:41 AM
in the question:
> It's just for a test...
in the comment, replying to backend question:
I think it is php — r00t 44 mins ago
busted! LOL
 
Lol
I'm VTCing
 
testing
No ones here where is everyone today did I do something and everyone moved to a secretly new chat room that I didn't know about?
 
12:56 AM
@TildalWave Good catch.
 
Can someone please tell me what is going on where is everybody?
All by myself yeah!
 
 
1 hour later…
2:13 AM
lmfaooooooooooooooooo
 
meh wanted to search the transcript...
 
 
2 hours later…
4:09 AM
pbfcomics.com/213
 
4:58 AM
How much turmoil do you suppose there would be if somebody were to claim RSA is broken and "prove" it by publishing the private signing key for the original xbox?
 
 
6 hours later…
10:41 AM
@Joshua Isn't this cracked already? Either way it would not prove RSA broken at all, it would just prove that someone managed to get that one key for that one application.
 
 
2 hours later…
12:49 PM
@HenryWHHack weekends are usually quiet in here :/
 
 
1 hour later…
2:02 PM
@Joshua Proving RSA broken would entail considerable turmoil. Just publishing a single private key would not prove anything, though.
 
2:19 PM
@ThomasPornin I'm pretty sure publishing the private key of some important CA or DNSSEC's root zone would prove something...
 
2:30 PM
It would prove you got access to the private key somehow, not that you broke RSA
 
@MarkBuffalo that for sure, but how would you get access to those keys other than by breaking RSA?
DNSSEC uses FIPS 140-2 Level 4 certified hardware, vaults and very open procedures
you can't silently physically steal the key there
 
in memory?
 
@MarkBuffalo the RSA private key never leaves the HSM
 
hm. well, I don't know enough about crypto to really comment on this
so you're saying I can't breach someone and take their RSA key that way?
 
@MarkBuffalo DNSSEC key rotation procedure goes as follows: Three people with their personal smart cards fly to the vault where the HSM is located
a laptop is booted up and initialized and connected to the HSM
The authorized people authorize the signature of the verisign public key with their smart cards
the public key is sent to the HSM which hashes it and signs it and sends the signature back
the end.
the HSM is deposited in the vault again and all power is taken from the laptop
 
2:37 PM
ah, I see
 
next question: does everyone using RSA use DNSSEC?
 
@MarkBuffalo ?
 
you keep talking about DNSSEC key rotation
Thomas is talking about RSA
 
@MarkBuffalo the DNSSEC root zone uses RSA right now
once they do the KSK roll over they may also use / replace that with ECC though
 
2:43 PM
so let's take DNSSEC out of the question
let's say I breach someone using RSA
is this feasible?
I really need to learn crypto. This is my absolute weakest area
 
my point was: If you have the private root-zone DNSSEC KSK, you must have broken RSA, there's no other way.
 
I understand that point, yes
 
@MarkBuffalo you can't just break RSA
if properly padded and if proper keylengths are used this is infeasible
 
@SEJPM I am not talking about breaking RSA. I am talking about gaining access to the machine containing private keys... not DNSSEC
@ThomasPornin @SEJPM any recommended crypto books to start out with?
 
@MarkBuffalo how good is your math?
 
2:46 PM
I know some of you prefer a hands-own approach, but I think I need to start lower than that because of concepts
It's so-so
 
@MarkBuffalo the more decent machines will prevent you from ever extracting the private key
including everything CAs deploy and should include everything that software companies deploy for production signing
@MarkBuffalo HAC is the reference for general crypto
 
Adi
G'day!
 
doesn't include ECC and more modern algorithms (ARX, AE, and sponges) though
@Adi G'day
introduction to modern crypto is the best for well, modern crypto
 
@SEJPM HAC?
need an ISBN, or less vague title
 
It's full of proofs and all that fancy stuff and includes things like KEMs and Pailier
@MarkBuffalo handbook of applied cryptography
 
2:50 PM
seems dated
but core concepts sounds fun
 
Adi
What are your goals? I might be able to recommend something
 
@MarkBuffalo the things lacking is the more fancy stuff, i.e. SHA-2, AES, ECC, NFS, KEM/DEM, ARX, AE, sponges and all that stuff
 
to understand core concepts of crypto
 
Adi
@MarkBuffalo Coursera's Cryptography I and II
More than extremely recommended
The professors are top notch
 
I have a lot of misconceptions about crypto
because I never really bothered to learn it properly, and instead tried to find ways around it
 
Adi
2:51 PM
I personally like the interactive nature of these courses more than reading a book
 
nice, the course starts soon
 
Adi
Yep
I took both courses. Best decision I made in 2014
 
also
after taking that course
thoughts?
 
Adi
Never heard of it
 
He should've used cracking
 
Adi
2:55 PM
But I know the author
 
Not hacking
Is the author competent?
 
Adi
An excellent coder
I had no idea he did crypto stuff, though
Honestly, don't think beyond the courses for now
 
looks more like a book that will teach you how to classic crypto with python
 
Adi
@Mark Once you attend them, you'll have a better idea where to move next
You can even ask the professor directly to guide you where to go next
 
yep, I will do this then. Thanks, @Adi
nice, so I can chain crypto 2 after this
@Adi Question, though... are courses captioned, or do they have accompanying material in text?
Oh wow, there are transcripts. This is perfect
Yeah, this is perfect for me.
 
3:00 PM
@Adi can you please roughly sketch the contents of the second course? There's no info on the page :(
 
I'm really pumped for this course
I'm also going to pick up python
 
Adi
3:26 PM
@SEJPM Now that you mentioned it, I went to my notes to find something to write
I have a very good folder structure for the courses, so it's difficult to lose some course
I fucking have absolutely no reference of it
I'm genuinely spooked
I even have no emails about it, no downloaded PDFs, nothing
 
@Adi did you actually do the second course?
 
Adi
@SEJPM In my head, I have
In reality, it seems I haven't
Oh
Stanford’s Cryptography II course is like the big foot of online courses
 
@Iszi what, the S&A pun? It's a definition dude. also the crop in hand pun gives me lolz every time
 
@Adi I do the same. I have a bunch of folders from 2010 and onwards
 
@RoryAlsop yeah, that's a common misread. it's from a disney movie :)
 
3:29 PM
but the stuff I did in school is not very noteworthy compared to what I do now
so I think I'm going to delete it
 
Adi
Wait, did Cryptography II happen? I got a post-course survey but never an e-mail about it starting.
Wow.. looks like I'm not the only one
 
fortunately it starts in June. Join me!
 
Adi
Daamn.. now I remember!
I signed up for it like 4-5 times
It keeps getting pushed
That's why my brain is too confused about it. The constant cycle of hope and disappointment
 
hopefully you won't be disappointed this time around
 
Adi
I know I won't
Because I have no hope it will actually start
 
3:34 PM
Haha
 
yay for low expectations
 
Adi
@MarkB I actually just signed up for Crypto I now
Not a bad idea to refresh some Python crypto skills
 
Not bad at all
 
Adi
Interesting. I'm going back on my courses log; I found this
 
Thinking of immigrating?
 
Adi
3:38 PM
Nope
At that time, I was interested in the US immigration laws for some reason
and the philosophy difference between jus soli and jus sanguinis laws
This reminded me of how I was very excited to learn all kinds of stuff just a few years ago. Wow.. a lot has changed
 
glad you posted that link
I sent it to my wife
She's eligible in June
 
Adi
Your wife is a crypto-nurd?
 
No, the immigration thing
She's a C programmer, but doesn't like programming. go figure
 
electrical engineer
ya, I looked it up on coursera... lol
Student loan down to $2900.
rejoices
 
Adi
3:44 PM
What's a "student loan"?
 
murican capitalist pig thing
 
Adi
Of all the Coursera courses I took, the one I enjoyed the most was called "A Beginner's Guide to Irrational Behavior"
I'm not able to find it anymore :(
 
@Adi a sign that america is a LDC
 
@SEJPM Least/Less-Developed Country?
 
@MarkBuffalo yes, least
 
3:46 PM
LOL
:-(
Well, aren't you from Germany?
Colleges in Germany charge you tuition if you don't speak German d:
 
@MarkBuffalo yes, I'm from the third world country germany as @Simon likes to say it
@MarkBuffalo -> learn german? It's fun. Sometimes.
 
I have a distaste for Merkel based on an out-of-context video I saw some time ago
 
@MarkBuffalo Merkel > Obama > anybody else in the world > Trump
 
Trump >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> Dead horse >>>>>>>>>> flies >>>>> pond scum >>>>>>>>>>>>>> Obama >>>>>>>>>>>>> Ted Cruz >>>>>> Jeb Bush >>>> Merkel
oh and Merkel >>>>>>> Clinton
 
@MarkBuffalo so you're a trump fan?
 
3:50 PM
Nope.
Not at all.
 
oookkkkay
 
Adi
@SEJPM I was doing that like 5-6 years ago for that reason
 
@MarkBuffalo you forgot sanders
and rubio for that matter
 
@RоryMcCune I like Sanders
I like him even though I completely disagree with many of his stances
 
@Adi so you tried to learn german and then rage quitted?
 
3:51 PM
I like him for the same reason I like Rand Paul... because these folks are consistent, and actually stand up for their beliefs. They aren't swayed from day to day
They aren't flip-floppers
 
Adi
@SEJPM I learned quite a bit before I was accepted in a school in Finland, so I didn't see a point in continuing
 
At least I don't think they are
 
sanders appears from what I've seen to have a consistent set of positions (kind of like Corbyn in the UK)
 
@Adi are you a native english speaker?
 
Sanders has a really good stance on a lot of issues
 
3:53 PM
I do like this compared to the usual politician ("what do I say to get elected") stance
 
I really love many of his stances... but I shy away from a few of them, which I consider deal breakers
 
as you have some idea what they'll do
 
@RоryMcCune agreed
 
Adi
@SEJPM Nope. Aramaic
 
@Adi Are you of Jewish descent?
 
Adi
3:54 PM
@MarkBuffalo Extremely difficult to answer
I'd say I have no clue
 
Recently, that is
Of course you are if we go back far enough d:
 
Adi
Half of my family is originally from Palestine
 
@Adi was german easier than finnish for you?
 
The name "Adi" is a hebrew name
 
Adi
@SEJPM Like 100x easier
I took me 4 years of learning Finnish part-time to get to the level I got with German in 4-5 months
 
3:56 PM
PIR, ZKP, MPC and ECC - Crypto II
 
Learning Chinese took me about a year
It was really difficult
 
@SEJPM from my limited exposure, finnish is frickin' weird, where german is more explicable
 
Now I only know about 1000 words... enough to communicate basic things, but that's about it
@RоryMcCune Yeah, I had a bunch of Finnish friends in games. It feels so weird
 
Adi
@MarkBuffalo East Asian languages are indeed very difficult
 
@Adi I really didn't put any effort into it. I randomly picked up a few words here and there, and kept using them.
When I went to the college in China, I was able to test out... immediately... because they only taught the first 800 words
So instead, I did the cultural immersion / history thing
 
Adi
3:58 PM
@MarkBuffalo Except for Arabic, all Category V languages in FSI are east Asian effectivelanguagelearning.com/language-guide/…
They are difficult
 
It's very easy for me now
but the road to get to that foundation was very difficult
 
Adi
I guess that's how learning stuff works :D
 
ya
weird. I find Japanese and Korean to be a hell of a lot easier than Chinese
I can already understand a lot of Japanese anyway.. only when it's written down, and kanji is used heavily
 
4:38 PM
7
Q: Why is there no password verification when changing passwords?

cremefraicheMy jimmies were somewhat rustled when I didn't get prompted for my current password when modifying it.

59
Q: Can we fix the security flaw in the password reset dialog and ask for a user's current password?

AndrewCNOTE: Not asking for a current password allows an attacker who somehow hijacked the current session to hijack the account, in direct violation of OWASP Guideline AT-011 I decided to change my password via the my logins link, and was presented with this dialog: Notice the lack of confirmation ...

this is pretty bad
it took me about half a minute of thinking to think of where to execute a POST request with JS while signed into SE and deny any attacked user access to his account
 
damn
0
Q: Which intelligence agency cracking capabilities cannot be explained to this day?

tarlebAt the end of 2014, there were reports and talks about the cracking capabilities of the NSA and other Five Eyes agencies. The analyzed data revealed that, e.g. VPNs and HTTPS connections were decrypted routinely, while OTR and PGP apparently were resistant to any attacks. The documents were som...

also, that seems too broad
 
5:00 PM
anyone fancy helping me with an sql injection?
 
sure
 
well im a bit stuck... I have thios:
question = mysql_escape(message["question"])
answer = mysql_escape(message["answer"])
cursor.execute('SELECT * FROM answers WHERE question="%s" AND answer="%s"' % (question, answer))
ws.send(json.dumps({"type": "got_answer", "row": cursor.fetchone()}))
the escape slash is weak though all it does is slash escape the characters and i think its weak like the add_slashes() function ... but i cant think on how to over come it
it literally just finds a character and adds a slash... im thinking maybe a unicode injection but im a little lost
I wonder if im doing this wrong... and my goal should be to use a function and fetch all
rather than just accepting its a fetch one
 
@TildalWave you could ping the SE team with details, as per:
@Deer if it's really a security issue in your opinion, follow the steps described here, it might trigger a faster response from the team. (And who knows, you might see your name in the Hall of Fame ;)) — Shadow Wizard Mar 2 at 9:50
 
5:18 PM
@MarkBuffalo save me T___T throw some ideas my way T___T
 
@RoryAlsop I've very much given up on helping SE fix what they so often find the time to brag it works so perfectly
I'm not trying to be cynical or anything like that, it's just that I've experience with their resistance to do anything and it's an unsettling thought to go through it again
 
@TildalWave ok
 
lets be honest if SE want to spend some time on their security, I'd probably start with getting SSL everywhere...
 
@RоryMcCune I suspect the issue is that this isn't their security but their users' security
SE considers users a commodity, they don't really care about individual users, only about the userbase as a whole
 
@Gilles true, as I mentioned rather flippantly a while back it'll probably take an attacker compromising the session tokens of some prominent people/staff to get them to make a change
which is disappointing but not completely surprising
also with more automated SSL options being available now, you'd hope that might make it easier for them to implement.
 
5:31 PM
indeed
re SSL, what surprises me is that they aren't even bothered to make it work at all
 
they're kind of aware that it's a problem but may not be much of a priority, given how long it's taking
 
They don't want to default to SSL, ok, fine. But SSL doesn't work on meta. Until recently you couldn't search over SSL.
these are major features that break, and it's gotten worse over time! (meta used to work before they moved to cloudflare)
 
@Gilles You don't ask the sheep where the herd should go. Ultimately, you shear the sheep, except those that you eat.
 
@ThomasPornin bah.
 
It is useful to remember that as a SE contributor, you are more the product than the customer. Once you have acknowledged that, it is easier to accept any sloppiness.
5
(i.e. be zen, @TildalWave)
 
5:39 PM
just whipped this up to try and help me logic this thing out... but i feel as if im chasing a red herring:
import json
import MySQLdb
# List from http://php.net/manual/en/function.mysql-real-escape-string.php
MYSQL_SPECIAL_CHARS = [
("\\", "\\\\"),
("\0", "\\0"),
("\n", "\\n"),
("\r", "\\r"),
("'", "\\'"),
('"', '\\"'),
("\x1a", "\\Z"),
]
def mysql_escape(s):
for find, replace in MYSQL_SPECIAL_CHARS:
s = s.replace(find, replace)
return s

stri = raw_input("What is your injection?: ")
escS = mysql_escape(stri)
mysql = ('SELECT * FROM Cheese WHERE name ="%s"' % escS)
print (mysql)
 
6:08 PM
@ThomasPornin yeah but being zen currently means enjoying my Sunday and reading a book, not arranging furniture with SE devs :P
 
6:24 PM
I'm re-reading The Songs of Distant Earth because it's probably been over 20 years when I read it. I got past that part where they mention how democracy worked. Crucial part that hasn't been mentioned here is that anyone could be elected for a president, if you wanted it or not (and a short part describing how to avoid it, such as terminal illness, not being of legal age, too old, being a criminal or actually wanting the job)
 
6:47 PM
@RoryAlsop this thread needs a bit of cleaning security.stackexchange.com/questions/116630/… (merging two user accounts, the "answer" should probably be moved into the question,...)
 
6:58 PM
@silverpenguin sorry, just got carried away by jetpack joyride
 
Adi
The language discussion from earlier reminded me of this
 
@RоryMcCune I agree with this part
@Adi lol
@silverpenguin

> cursor.execute('SELECT * FROM answers WHERE question="%s" AND answer="%s"' % (question, answer))

Can you do unicode injection? Like:

`\u0022 ;SELECT * FROM answers --`
 
the only problem will be that \
 
Adi
Oh no no. Why the hell do we have code in the DMZ?
 
dont ask me im just an innocent manatee
@MarkBuffalo psst... that did something
@MarkBuffalo but i am unser what lol!
 
7:07 PM
:-]
I just learned how to create the whole jetpack joyride game, minus graphics, just by watching it play
what an eye opening experience
 
what game is tht?
 
it's a tablet/phone game for android/ios
so you just stand in one place the entire time. let the world keep generating and coming at you
collision with the ground = ok. makes you walk. collision with the roof = makes you fly against it. collision with a zapper (random rotation spawn using X degree turns) = trigger death. collision with coins = trigger coins++. collision with anything deadly while in a vehicle = destroy vehicle, then dispose of all visible killing objects on screen. hit jump key = yCoords += jump amount. etc
 
@Adi hackers?
 
rough example
Now I want to make a decent game instead of my crapfest
@silverpenguin so let's see here... hmm
@silverpenguin What is the default message return type?
show me all columns
 
Adi
@RоryMcCune I'm not so sure about the hackery going on here, though. If you're stuck at bypassing addslashes() in 2016, then probably this isn't for you.
 
7:15 PM
re: no SSL here evrywhere
they have 150 sites in the SE network
all of which have meta sites
For proper SSL you'd need a certificate for the meta sites
 
@SEJPM ACME protocol and automation FTW :)
 
but meta.*.stackexchange.com (invalid) is invalid as is *.stackexchange.com (doesn't cover meta)
 
@SEJPM sure but when certs are free why not just get one per site
and automate the renewal process
 
Adi
I'm with @RоryM on this one
It's not like a new SE site is being created every 30 minutes or something
 
@RоryMcCune this is only possible recently and only with domain validation (let's encrypt)
 
7:17 PM
@SEJPM DV is better than nothing :)
 
there's a blog post about this somewhere
 
add some HSTS to the mix and it's not that bad for a lot of threats
 
Adi
@RоryMcCune Except today. Today I hate HSTS!
 
Mark Henderson on February 09, 2016

Let’s talk about encryption. Specifically, HTTPS encryption. If you’ve been following any of the U.S. election debates, encryption is a topic that the politicians want to talk about – but not in the way that most of us would like. And it’s not just exclusive to the U.S. – the U.K. is proposing banning encrypted services, Australia is similar. If you’re really into it, you can get information about most countries cryptography laws.

But one thing is very clear – if your traffic is not encrypted, it’s almost certainly being watched and monitored by someone in a government somewhe …

 
there's an older one
 
Adi
7:18 PM
Chrome goes the extra mile with HSTS
 
@Adi lol well it can be irritating for testers and if/when HPKP gets common that could be very annoying
 
Adi
But only Chrome, though
 
@silverpenguin are you using python?
 
@Adi ah well just avoid chrome then :)
 
Adi
If the site uses HSTS, then you cannot bypass cert warnings
 
7:19 PM
#FirefoxMasterRace
@Adi yeah various browsers are getting more militant about that stuff, I think web app testers will soon need a dedicated testing browser
with that stuff disabled
 
@RоryMcCune yeah they should be
 
you come across invalid certs waaaay too often on tests to have a hard block
 
Adi
Oh, this reminds me, I need to plug one of my friend's Firefox Hardening Script
 
but having seen the mess that just about anyone forking chrome has made of it, it'll be a brave person that takes it on
 
Adi
Firefox Hardening Script (for security and paranoia): github.com/pyllyukko/user.js
3
@RоryM Could you please pin it for a couple of days?
 
7:21 PM
> [91m --> Welcome to the National Security Agency telnet portal <--
Please enter your username and password to continue
2
um
closes shodan.io tab
 
Adi
@MarkBuffalo Hahahaha.. you should see some of my boxes' SSH headers
 
@Adi Yeah, I'm more worried about getting listed
 
Adi
I do my best to make sure everybody who wants to brute-force me thinks 10 times
It hasn't worked very well, though :D
 
yeah, that will make you an actual target
 
Adi
7:24 PM
In fact, using such provocative descriptions seems to encourage attacks from China and Russia even more
 
Yeah lol
But they already know where the NSA's online portals are
It isn't hard to find them anyway
It's not even a secret
 
@MarkBuffalo yeah it's right there on the notice board in the break room, amiright?
 
@RоryMcCune damn you
 
Adi
Holy cow! Let's Encrypt has issued about 1M certs so far! Ö
 
@Adi all certificates are only valid for 90 days
 
7:30 PM
none of my sites have https
time to switch hosts
 
> Limit the browser from storing anything even remotely sensitive persistently (mostly just making sure private browsing is always on)
 
my posting provider sucks bad
 
> Still be usable in daily use
yeah, no
I want my history to be preserved across sessions
 
Adi
@Gilles The whole idea is that a non-noob takes the script, removes the stuff he doesn't want, and keeps the rest.
For example, I loved the thing with limiting to secure TLS suties
Also disabling domain guessing was pretty sweet
 
I've noticed that quite a few hosting companies are starting to provide lets-encrypt certs as part of their packages
which is good as we'll start seeing it roll out by default
 
7:34 PM
@silverpenguin I just read the rest of your messages... wait, this is about adding slashes and python?
 
Adi
@RоryMcCune Indeed. Plus, more exposure for Let's Encrypt
Some hosting companies are viewing it as a threat, though. Assholes!
 
@Adi yeah it's a win/win, hosting company gets a new feature that they can bascially provide for free and lets encrypt get more users...
 
Adi
Because they'll lose the $5 they charge for the cert
 
@Adi yeah I do not shed any tears for the SSL cert industry
 
@Adi Yeah, they're scared out of their minds
 
Adi
7:36 PM
 
after their charging for what is running some SSL commands and managing keys properly
 
Adi
You're kidding me with these flags!!
 
@Adi where were those?
 
yeah, I clicked 'invalid'
 
Adi
@RоryMcCune Some "private" room
Two dudes going at it together
 
7:36 PM
ahh
 
@Adi they've been at it for weeks (disagreeing over interpretations of the POSIX spec...)
as long as they're doing it in their own room I'm inclined not to intervene
4
 
Adi
@Gilles As with 99% of stuff people do.
I agree
 
@Gilles Err... weeks?
 
Adi
@MarkBuffalo People are passionate about different stuff
 
Well, arguing with someone negatively for weeks is a bit weird...
 
Adi
7:44 PM
I once saw a thread going for 5 years (yes, 5 YEARS!) about whether 5.56mm and .223 are the same or are different.
It was borderline religious
 
wow.
I usually shy away from arguments when it's clear the person is... insufferable.
There was this one argument I saw on Facebook about natural-born citizens. It was just... retarded in the most epic sense of the word.
 
Adi
You know, I learned something
In any argument that extends for more than a few hours, all parties are insufferable
 
Two extreme right wingers were arguing that being born in America is not enough to qualify to become a natural-born citizen. It didn't matter that the Naturalization Act proved them wrong... it didn't matter that their definitions were wrong
They kept clinging to some stupid notion of reading some book written hundreds of years before the formation of the United States entitled, "The Law of Nations."
Ah, okay... so not hundreds of years. Anyway, they were using the definition from that book. Why? Because... because the founding fathers had that book on their bookshelf.
That was their entire argument. If you dared to show that the Naturalization Act proves them wrong, and that the Founding Fathers were involved in the creation of the Naturalization Act, they would argue that you're a godless liberal heathen... even to other right-wing Christians... lol
This arguement literally went on for years... and years...
and the proponents of the argument (2 guys), kept defending it. They got even more and more insane with their rambling as time went on
It started in 2007, and they continued it until... well, until I blocked them in 2015
 
00:00 - 20:0020:00 - 00:00

« first day (1907 days earlier)      last day (3022 days later) »