« first day (412 days earlier)      last day (4766 days later) » 

05:48
@RoryAlsop Cool Rory. :) Tbh. I wish I could say the same he he, but your is just wierd!
06:43
@StackExchange They forgot Betty Tables.
 
2 hours later…
08:53
@Karrax Mine is from my stage outfit, not the day job. Check out metaltech.me or youtube.com/user/Metaltechtheband?feature=mhee for the full wierdness :-)
@ThomasPornin I just wanted @M'vy to translate it. From the little I could get from translating it has your style.
@ScottPack Google is a virus
@thisjosh a very successful one, in that it hasn't killed its vectors :-)
Oh yes, very successful, but potentially dangerous.
As long as it isn't SkyNet in disguise, I'm not quite so worried...
The long term privacy aspects worry me, but tbh Facebook has ruined that for the younger generations anyway
You havn't contracted occupational paranoia as I have.
Although freely available video conferencing has been a nice boon.
09:10
@thisjosh I did. Then I just got really disheartened and cynical for a while. Now my ability to make a change is increasing (seniority, and greater visibility in the industry helps) so I'm much more positive about even incremental improvements
@thisjosh Yes - more and more of my clients are getting really decent video conferencing systems implemented - it really makes a difference
@RoryAlsop Looks awesome! I will check it out once I'm done with my meetings for today.
It disheartnes me when we still dont seem to learn the basic lessons "Why cryptosystems fail"
'The attacks which actually happened were made possible because the banks did not use the available products properly' note the year 1993
@thisjosh translate what?
BTW, use @Mvy if you want to highlight me :P
think the ' is messing up with the thing
@Mvy heh - you with your complicated, chat-breaking name
:-)
p.s. morning
^^
Hi @RoryAlsop :P
I'm the breaker of rules XD
It's also nice to find SQL injection possibilities in forums :P
When the site says: Howdy M SQL Error cannot understand statement near 'vy AND u.id == p.userid;
Oh my! Wild bear inside!
You were looking at translating the title or résumé as well?
The book, from my poor translating ability it has an amusing style
'How to choose a programming language -- From the need analysis to final decision'
Amusing style?
"The computer is a zealous servant but silly."
"Learning a language requires a lot of effort: Before you go on an adventure, enjoy pragmatic advice and unbiased professional. You'll save time, money and aspirin."
Pretty nice
"enjoy pragmatic and unbiased advice of a professional " may be better though
(or advices)
09:32
Good advice and entertaining. Maybe we could persuade Thomas to publish an english version.
124 pages
I would have guess there was a posessive in there ' enjoy my pragmatic and unbiassed professional advice'
hum. The impersonnal style is better here for a description
French conjugation is the creation of derived forms of a French verb from its principal parts by inflection. French verbs are conventionally divided into three conjugations (conjugaisons) with the following grouping: * 1st group: verbs ending in -er (except aller). * 2nd group: verbs ending in -ir, with the gerund ending in -issant. * 3rd group: ** 1st section: verbs ending in -ir, with the gerund ending in -ant. ** 2nd section: verbs ending in -oir. ** 3rd section: verbs ending in -re. ** aller The first two groups follow a regular conjugation, whereas the third group follows an irregul...
for those playing along at home
@thisjosh yeeeeek. German and Spanish were much easier
09:44
Well german has declinations too
for nouns!
Latin was the easiest, no conversation tests
hehe
@RoryAlsop Should you learn some Greek, I think there will be need for some auditing in the near future
10:07
Welcome the the numeric era.
"- Do you have an email address where I can send you a scanned copy of my salary note?
- No, I don't have a professional one."
I feel so depressed now...
10:26
@thisjosh AKKKKKKKKK! I'm not an auditor! (Although 90% of recruitment agent calls suggest I might like an audit role 100 miles away from my home at half the salary I am currently on...)
11:03
hahaha - @Karrax - that's you hit your rep cap twice in two days on that one answer. Nice work.
11:26
Rory, you about?
@RoryAlsop Damn nice! :) Will I lose the reputation or any accumulating reputation if I turn it into community wiki? That would suck :p
I am glad I wrote the answer not only because of the upvotes, but because I need the material for a web penetration testing presentation I am holding now in February
I have been hired for freelance pentest on their web applications aswell :) really looking forward to it.
which one?
11:56
@DavidStubley I am now, yes
How's tricks?
@Karrax Not sure actually - I know you don't earn rep for items posted after it becomes CW, but not sure about before
The poster of the question wanted the two replies combined - not sure on the etiquette
@DavidStubley well, you can do that - anyone can edit any post - but yeah, politeness would be good. @thisjosh - what's your response on this?
Reckon it's up to you two to see what you want to do
 
1 hour later…
13:17
Hey @Ninefingers - how's tricks? Shall I pop up that QOTW meta question?
@RoryAlsop Hello, I'll do it in a sec. Offline life has gotten quite hectic. Have an ill dog :(
@Ninefingers not good - hope he/she/it's going to be alright
@RoryAlsop He, and probably not. He's nearly 16 and he deteriorated very rapidly overnight and isn't looking like getting better. A shame, but he's had a great life up to now so it's not all bad.
Are we doing QotW for launch this Friday?
13:32
@Ninefingers Should be do-able - we have had a few good uns over the last wee while
@Ninefingers sucks. Our old cat got to 18 years old just fine, then deteriorated over 4-5 days really rapidly, to the state we had to have him put down. The upside there too was that the end was really quick and the other 18 years he was a happy healthy cat
0
Q: Vote for your question of the week #17

NinefingersFor QOTW #17, scheduled for publishing to the Security Stack Exchange Blog on 3 Feb, please post as Answers, and vote for your favorite question from the whole Security Stackexchange site. Please post any question that you feel is of worth and the reason why. Try not to promote your own question...

@RoryAlsop That's going to be the case here I think. We took him to the vets this AM and they've given him some bits and said bring him back in 24 hours, so we'll see, but I can't see much improvement.
0
Q: how to make software reverse engineering difficult

hrishikeshp19In software reverse engineering, we use a dissembler, a debugger, and a code patcher. OllyDbg includes all. One of the differences between actual execution of a program and debugging through using OllyDbg is, in OllyDbg the instruction pipe-lining is not used. How can we take advantage of this f...

Do we want that here? There's an equivalent on SO:
81
Q: Protecting executable from reverse engineering?

graphitemasterI've been contemplating how to protect my C/C++ code from disassembly and reverse engineering. Normally I would never condone this behavior myself in my code; however the current protocol I've been working on must not ever be inspected or understandable, for the security of various people. Now ...

@Ninefingers I think it could get some good answers here, and there is no problem with us having a security focused answer and SO's one having a coding focused answer
13:49
@Ninefingers Have popped up 3 answers on ones I think could make for good posts
@RoryAlsop Oooo, hard choice. Hold on, let me sort out that migration.
14:09
Ok, I'm going to give the OP on that question a chance to edit as Paulo only left his comment an hour ago. If there's no change, I'll migrate it.
14:29
@Ninefingers no worries
33
Q: How does hacking work?

FarhadI am specifically talking about web servers, running Unix. I have always been curious of how hackers get the entry point. I mean I don't see how a hacker can hack into the webpage when the only entry method they have into the server is a URL. I must be missing something, because I see no way how ...

That thing started with negative votes. Wow.
It got twatted
I'm a little let down that I'm the only one who voted to close it
@JeffFerland Yeh, I popped in to see if that one was going to get closed
Surely that was a troll??
@MarcWickenden No, I think it was a very real question and the first thing people ask. I spoke at a security &ethics class at the university Monday night... they're all graduating seniors and probably all need to see that question and the answers.
If you hang out in this room, it's what we do. If you don't consider yourself an infosec person... well, welcome to where most of the world, even the technical folk, is -- right in that question.
yeh, some of the answers were ok
i was more surprised people took the time to answer it than the question was asked in the first place
14:44
The question itself is the very definition of NC for the site, but some of those answers, particularly @Karrax's, are pretty top notch.
No doubt the answers make the question.
@MarcWickenden Some answerers use the question as a pretext for spelling out some information which they wanted to write "somewhere". That's how I do, usually. A very open and basic question is a good trigger for that.
2
It is the same urge that makes some people write blog entries
@ThomasPornin Yeh, defo. I get that. The answer by @Karrax in particular, i'm pretty sure he didn't write that just to answer that question
@RoryAlsop there you go :-)
15:01
Oh. "How does hacking work" is now a top stackexchange quesiton
that explains
@JeffFerland It has made a distinct spike in the traffic logs - so despite the question being NC, we're keeping it :-)
How's life with you @Marc?
15:15
@RoryAlsop Yeh good. Busy, busy. not much time for play these days :-)
 
3 hours later…
17:51
Mornin'. Err... afternoon I guess. Mornin' was a total fiasco.
Due to smoke in the area, administrative leave for those who work in the industrial area has been authorized. However all areas are open.
The latter sentence of the above tweet is false. I'm told that not long after we were (finally) released from work, our building had a mandatory evacuation due to high CO levels.
18:12
High CO levels are the best CO levels.
@RoryAlsop He deleted his Q from crypto and re-posted it here himself - problem solved :)
18:41
hello !
I have a little brain teaser for you guys which I can't resolve myself, I'm sure someone here will be interested :)
With a tip which may be useful Are you able to decrypt it?
- Well, I'm a little stumped. 3DES uses 24-byte keys, but that's a 32-byte key. Unless there's some trickery involved.
oopsie
fail on the paste... sorry !
Key sizes 168, 112 or 56 bits
from wikipedia.
or is it DES
For the context the reddit user named "A858DE45F56D9BC9" posts at (seemingly) random intervals message consisting of bunches of base64 strings, generally possesing some strange duplicate strings in a way which doesn't seem to indicate padding (maybe a few headers concatenated ?). See here for more: reddit.com/user/A858DE45F56D9BC9
@Mvy I was just looking into that
0
Q: Should a pentest report include the tester's opinion?

Jeff FerlandIn this particular case, the webserver turned out to be a shared 3rd party system and was not tested. Examples: We do express grave concern at the overall security posture of that webserver and the possible exposure to $client In general, it is our feeling that $client is a low-profile,...

@RoryAlsop Especially for you since you've got the whole public accounting / pentest background :)
18:58
@JeffFerland Will draft you up a wee answer - this is exactly my space :-)
@Mvy Interesting: "As mentioned above, a triple DES key is a bundle of three DES keys. A DES key is 64 bits long, but only 56 bits of these are used in the encryption process.
A triple DES key is therefore 3 x 64 = 192 bits long, but the keyspace is only 3 x 56 = 168 bits. " - Source: http://www.cryptosys.net/3des.html
Context (part 2): That user, "A858DE45F56D9BC9" or the admin on reddit have deleted multiple times previous posts (for an unknown reason, at least to me) but knowing the community someone must have copies of those, if that message can be decrypted I will ask them happily :)
/me loves the "xxx" and "food" tags !
19:13
@JeffFerland is that useful or you need more - tried to give a general + specifics answer
19:55
So, I just got an email from @Rebecca about gifts and moderator election. Anyone know what it is?
@ScottPack is this in addition to your swag?
Yeah, it just came in.
I think it's a consolation prize for not winning
:-)
where did you come in the results?
@RoryAlsop I can't remember. You and Avi were shoe-ins for 1/2. Then, depending on which reallocation settings one used, the rest of us all tied for 3rd->last place
what about Hendrik? :-)
heh
That's good that you're getting some goodies though
nice touch
20:07
They just don't say what. It's listed in the email as a "nice gift" but the google-docs form asks for "black or white" as well as size.
So, probably, a t-shirt, but still a bit ambiguous
maybe it's a codpiece - do they give size as S, M and L?
;-)
@Scott I got that too apparently
@Shadok It's not a 32-byte key, it is a 32-character hexadecimal string, thus encoding a 16-byte value -- i.e. 128-bit, which is a key length supported by 3DES.
@RoryAlsop I like the way you're thinking. How awesome would a sec.se branded codpiece be? The toothy lion right out front?
@ThomasPornin great news so ! Thanks for that answer, I'll try to hack something in python but I'm not at ease at all
I'm just thinking openssl should b able to decrypt it, I'll just try it now :)
20:16
@Shadok The putative IV is more of a concern: 8 characters, apparently hexadecimal too, so this probably encodes a 32-bit IV. If encryption uses CBC, then it should have a 64-bit IV.
@ThomasPornin For me IVs are the equivalent of salts in hashes, am I (approximately) right ?
@Shadok Approximately, yes.
But they must have a specific format, depending on the encryption mode.
For instance, CBC encryption means: before encrypting each block, XOR it with the previous encrypted block.
The IV is the conventional "previous encrypted block" for the first block of the message.
So it must have the same length than the block length (8 bytes for DES / 3DES)
I'm looking at that right now, that page is full of details :) openssl.org/docs/apps/enc.html (3des is supported in many modes cbc, ecb, ofb...)
Also, for security, an IV for CBC must be randomly generated with a strong PRNG
I think I'm understanding that (from a conceptual, not mathematical point of view)
20:20
whereas salts in password hashing are often used as part of the input to hash functions, so their length is more arbitrary and there are less requirements on their contents (we need salt values to be unique, but there is no need for unpredictable randomness).
In cryptography, modes of operation is the procedure of enabling the repeated and secure use of a block cipher under a single key. A block cipher by itself allows encryption only of a single data block of the cipher's block length. When targeting a variable-length message, the data must first be partitioned into separate cipher blocks. Typically, the last block must also be extended to match the cipher's block length using a suitable padding scheme. A mode of operation describes the process of encrypting each of these blocks, and generally uses randomization based on an additional input...
That Wikipedia page contains good schematics.
"Un petit dessin vaut mieux qu'un long discours." ("A small drawing is better than a long text." -- attributed to Napoleon)
I already searched and read a few papers on this but the schemas are really obscure for me ("S-boxes ? I heard there are some in blowfish which it's also used as a prng for scrypt" but that's where my comprehension stops due to my lack of skills in math/crypto :) ) Anyway it's always good to be told where to look precisely, I'll have a look at this article.
ahah, i'm french, I already used that quote :)
AES uses S-Bowes
I'll continue my search for 3DES modes specs for a few minutes, worst case i'll search through comments in libssl source code
@Shadok A S-Box is basically any function, with normally short inputs and outputs, which accepts no better definition than a list of input+output pairs
It's historical
@Mvy are you telling me i'm wrong ? that would be pretty fun (and proving my point at the same time) !
20:28
Well I'm not so much in it today, but I think I read in my theory of code book about S-Boxes in AES. But it is use for other codes too I guess
@ThomasPornin ok, i'm looking at the article :)
DES uses internally 8 functions which were defined as taking 6 bits of input, and producing 4 bits of output, and the DES specification simply listed the output for each function and each possible 6-bit input (there are 64 of them). That specification called them "S"
hence the term "S-box"
it really means: a function which is not an addition / subtraction / XOR / multiplication
It should have interesting properties too
Don't remember what exactly: non linearity? or things like this?
why does that seems like compression to me ? "6 bits input, 4 bits output", I'm must be missing soomething else
hashing would be better term I guess
Cause I bet you can't go back from the 4 to 6
20:31
@ScottPack ewwwww (or maybe: coooool)
@RoryAlsop Wouldn't match your colou?r scheme, unfortunately.
@Mvy S-boxes are relatively expensive in software implementation, precisely because they do not map well on what a CPU is best at doing. So designers use them only to get some properties which they would find difficult to get otherwise, such as non-linearity or avalanche effect.
@ScottPack Spray paint
@mvy oh ! ok in this case it makes sense but I jsut don't now yet the use of the output, I'm going to read that wkipedia page right now and get back when i'm done cause i need a few minutes
@RoryAlsop And cover up the brand?
20:32
stencils and spray paint (picky picky)
@ThomasPornin @Mvy Even if the description seems really clear to me here en.wikipedia.org/wiki/S-box I can't figure what is the output used for after that, i just lost a third of my information
@Shadok DES is defined as 16 successive rounds; each round mixes the current 64-bit states by applying various transforms, including duplicating some of the bits, XORing with a subkey (generated from the DES key), splitting the resulting 48-bit value into 8 6-bit word, applying the 8 S-boxes on these 8 value, concatenating again the 8x4 = 32 bits of output, and permuting these bits.
... or we can reconstruct the s-box state from the key and find the coordinates of our encrypted input in the s-box to "decrypt" it ? That would make sense given the article cites the term of "confusion" as used by Shannon (which happened to interest me)
@Shadok I would have to read that AES thing from the beginning.
So each S-box is one elementary operation, among others, used in the definition of DES.
For AES, there is one S-box but it is applied 16 times per round, with other operations (and there are 10 rounds)
20:42
does that mean their only interest is in slowing the decryption process as salts do ? (even if there are IVs too in encryption which is used later)
@Shadok No, not at all
For encryption, we really want things to be fast
Slowness for password hashing is a kludge to deal with the inherent sloppiness of passwords.
But for all other parts of crypto, we really aim at top speed.
I tought there would be an equivalent in crypto
Great place here, come and blast your brain with crypto ^^ A bit hard but delightful anyway !
so instead of slowing the process you just "Enlarge you space" ? (yes I meant "search space" but I had to say it)
And while I'm thinking about it, isn't there already a place to store interesting things like the one I mentionned (that's a coompletely subjective point of view), maybe a page in a wiki ?
Or could it be accepted as a question ? If so I'm posting it right now.
21:29
@RoryAlsop That's quite helpful. Had a little debate about opinion in the non-cpa-opinion sense and wanted some outside feedback.
@JeffFerland cool - I can go into bits in more detail if needed, but I'm finding I can't be bothered with all the corporate BS when outside work :-)
@RoryAlsop No reason to drag you down :)
No - wasn't a dragging down, was just explaining my summary versions rather than long paragraphs
21:45
@RoryAlsop I hear that one has trouble keeping things like that going as they get older.
@ThomasPornin I'll be back tomorrow but i may leave the window open for a few hours, I'll get back to you when I have time and maybe post my first links as a question, that could turn interesting. Thanks again for your kind explanations even though I can get a good hold on them, have a nice day and keep flowing those good answers on stackX !
@Shadok The IV is meant to be publicly transmitted (if it was meant to be secret we would call it a key). An IV is mostly "the value we need to get things started". E.g., with CBC, we XOR data with the previous block, so, for the first block, we must "invent" a previous block, and that's the IV.
Now, most chaining modes have a reason for existing, some security characteristic that the plain ECB mode (simply encrypt each block separately) does not fulfill. The search for that characteristic implies some requirements on the IV value, requirements which depend on the mode. For CBC, requirements are "unpredictable uniform randomness".
Oh right, that's the point of the prng on the first step in CBC, just because you need that first hash from a block you don't already have, nice !
@ScottPack watch it!
I see the problem with ECB, same input + same key = same output , even with a salt you start with a handicap which could easily avoid given you have a "good" source of random to generate that first IV as used in CBC mode.
I see what you did there :-)
@ThomasPornin ahem, "IV is meant to be publicly transmitted" as you stated seems to contradict my point, why require a crypto-safe PRNG in this case ? I'm always missing a little piece of info in your detailed answers ^^
or maybe it's not a requirement as I thought.
@Shadok That's a subtle point. An unpredictable IV is needed in situations where the attacker can choose some of the data to be encrypted -- it allows him to play some nasty tricks. The so-called "BEAST attack" on SSL is of that kind.
If the attacker cannot input some data of his own, then we don't need unpredictability; but we still need uniform randomness. The point of CBC is to avoid having twice the same input block, even if the data itself is highly redundant (as real-life data tends to be).
If the IV is a counter, then there is some specific correlation between two successive IV values, which may match exactly the difference between the first blocks of the two successive messages (real-life data tends to have such patterns, too). Uniform randomness avoids that.
CBC is rather needy.
For a more modern solution, lookup EAX mode: en.wikipedia.org/wiki/EAX_mode
EAX requires only a non-repeating IV (a counter is fine for that), and it includes a MAC (integrity check).
Quittin' time for EST government workers. Have a lovely evening gents. And @Rory.
@ScottPack Maybe for you. I'm on-call. And it's been pretty hot lately.
22:06
excellent ! I just bookmarked this conversation and I'm going to dig a little more on the BEAST attack which interests me (junior sys/netadmin here) and EAX could help me understand a use for MAC because I can't seem to grasp the interest (hash with a salt (=counter) per block maybe ?).
Tomorrow's going to be interesting. Whether we've got to come in or not, and when, is still pretty fuzzy.
Or, should I say hazy?
I see the parallel between a counter as an IV generator in CBC mode and my point above related to the similarity of outputs given input parameters but are we talking about the risk of having two GIF headers (copies) encoding the same way using the same IV if it's not unpredictable by the attacker ?
@Iszi Are you implying that my question is not a good fit to our Q&A format and will not yield answers that generally involve facts, references, or specific expertise, but rather will likely solicit opinion, debate, arguments, polling, or extended discussion? :)
@JeffFerland Perhaps. But I don't quite feel strongly enough about that to vote on it.
Opinions do matter in our field, sometimes.
Separate topic: How in the name of Flux-Capacitor did an answer on our site (not migrated) get over 100 up-votes in two days?
@Iszi Become a hot question and attracted a lot of users from other .stackexchange sites.
22:18
@ThomasPornin Sorry I have to go now. :/ That was very interesting , I may be here tomorrow, thanks again!

« first day (412 days earlier)      last day (4766 days later) »