« first day (539 days earlier)      last day (3239 days later) » 

12:19 AM
Did they leak only the passwords, or are emails included? And is it a list of (username, password) tuples, or is it just a list of passwords?
2 hours later…
2:02 AM
@CodeInChaos I heard it had something to do with a hash collision against a Microsoft signing cert? Seems pretty crypto to me.
@makerofthings7 I dunno. I'd heard it had been pulled too.
@CodeInChaos Last I heard, only password hashes were leaked - possibly some pre-cracked passwords also. No account names or e-mails.
I'm... not quite sure this is a good SE fit...
Q: Security quiz for developers

D.W.Does anyone know of a short security quiz that could be administered online, to test the security knowledge of a developer? I'm looking for something simple to administer and simple to grade, ideally something that would take a developer only a few minutes, as a screening tool to differentiate f...

4 hours later…
5:52 AM
@IsziRoryorIsznti Depends on what value you assign to your LinkedIn account. I believe standard value is $0.02 (US).
2 hours later…
7:50 AM
@IsziRoryorIsznti or poop.
@makerofthings7 h-uh. is it just cuz its outdated, or did big bear really not endorse bcrypt (or the like) in such a high-profile post?
@IsziRoryorIsznti hehe, just realized the password submittal site (leakedin.com) was built by two of my most favorite noxperts in their fields: Shifflet and Gibson.
Why am I not surprised?
8:32 AM
@Nine is this better for crypto, or think its low level enough to just leave here?
Q: What are the variables of AES?

George BaileyAES is a standard encryption routine that can be used consistently across multiple languages, assuming all the variables match up. My question is, what are the variables. I am aware of the following Variant (is this AES-256, or just plain AES-128) Data to encrypt Key (128 bits is common) Initia...

9:27 AM
@AviD Gibson? As in Steve Gibson? As in the Steve Gibson that runs grc.com?
@Ladadadada ayup.
saw him mentioned in one of the articles as the minds behind the password collector site.
@Ladadadada and, dont forget Chris Shifflet, probably responsible for more wrong-headedness published and reiterated around the world web, than anyone else.
I see a number of problems with this: shiflett.org/blog/2012/jun/leakedin
for example, I still see some supposedly reputable security tools basing their CSRF checks on his complete misunderstanding of the issue.
It would have been nice if they'd bothered with SSL for that site.
@Ladadadada shocking, isnt it.
Though I have a bigger problem with this: shiflett.org/about
note some of his notable books, notably a notable one on security for a certain notable scripting language.
hmm, maybe the word I was looking for was more "notorious".
perhaps that explains the dismal state of PHP security... :D
@Ladadadada why bother? you're sending it to them anyway, right?
9:42 AM
Yeah, but without SSL, you can't even trust that the javascript he sent you hasn't been tampered with.
I guess it just comes down to whether you trust this site more or less than some possible random attacker with access to your communications.
@AviD I'd jsut leave it where it is - answered already, accepted answer etc.
I don't.
@Ninefingers yeah, was kinda thinking that too, figured I'd ask since there was a flag.
Also, soon I will no longer be blue, so just a heads up, you'll need to be asking Paulo/Thomas/whoever replaces me :)
and btw, as long as we're talking about flags - did you see the numbers of flags on SO? THOUSANDS PER DAY.
each mod has to handle on average over 100 each day. shocking.
@Ninefingers whoa. how come?
9:47 AM
@AviD Yeah, their workload is insane.
@AviD Well I'm pretty busy with the new job and part time degree and am just sort of running out of life...
I guess being the largest one, they attract the most Google traffic and people ask lots of off-topic questions there that should be migrated elsewhere and just general nonsense.
I'd like to be able to rep grind again, too.
@Ninefingers oh, I totally get that.
@Ladadadada yeah. and a lot of fights and newbie-harrassing, I think.
@Ninefingers hmm. thats an interesting idea. havent done that for yonks.
already dropped down to 4th place, and I'm pretty sure @Jeff will be passing me within the next month or so.
also barely have time to read posts anymore, not even the interersting ones.
Heh. I was just reading the reviews on that PHP Security book. Love this one: "This is the first technical book that I have read that doesn't obscure the topic with trivial details or complicated sentence structures with phrasing that is hard to follow."
10:15 AM
@AviD On crypto, I hardly contribute in terms of answers. I spend all my time there editing, retagging, closing...
commenting, closing...
more closing
11:02 AM
afternoon @Nine, @AviD, @Lada, @Code and @Andre
11:15 AM
Good after Rory, @RoryAlsop
11:25 AM
@Rory good Rory to you.
@RoryAlsop good rory, @Rory
At a guess, he feels a little Rory.
11:40 AM
@Ninefingers cmon, in public??
Lunch is good - A Rory sandwich:-)
@AviD heh
@AviD Just looking to promote Sec.SE. Good to see that post has been Roryed back to our site
@makerofthings7 not you too :-)
12:09 PM
@makerofthings7 I was wondering why @Thomas' post on SO still says SHA is preferable for passwords, without recommending a slow scheme, like bcrypt.
@RoryAlsop was kinda expecting denials regarding the size of the little rory. ;)
@AviD too easy to play that game :-)
thought I'd rise above it
(see what I did there...?)
hehe, nicely roried.
Morning Rories
@ScottPack Good arbitrory time of day
I'm confused
Compare the version number versus the release date on the OSX drivers
12:30 PM
@RoryAlsop I see what you did there...
@thisjosh I'd say it depends on what value you assign the password used for your LinkedIn account.
Slightly different, there.
Put on the tinfoil hat, and presume the site is hostile. Here's some possibilities...
1. The host also has the list of account names/e-mail addresses. Given your password, (and presuming you haven't changed it on at least one site where it was used) they may now have access to any number of sites where you used the same password - and also have access to sites and accounts where anybody else used the same password - whether they'd already cracked it or not.
2. The host only has the password dump. Let's presume they hadn't cracked your password yet. Well, they have now. Thanks for helping them build their rainbow table & cracking dictionaries.
Oooh... Giving me second thoughts about playing Diablo... "For example, the popular game Diablo ignores case sensitivity, which severely limits the password’s strength." blog.avast.com/2012/06/07/…
Turns out there's another one now: leakedln.org Different from leakedin.org
Heh. Registered by Stefan Esser.
12:53 PM
@Ladadadada Now that is fun - If you use a dictionary list you can get a good idea of what passwords people use. It shows that there are individuals there using all the passwords from "password0" to "password9", for example
Can Stack Exchange Capitalize on Hot Trends? <- was this blog post designed for security.SE? :)
Even more amusingly, the comment "Your password was leaked, but it has not (yet) been cracked. Fingers crossed." came back from the password I had been using there
Reassuring :-)
@AndrewGrimm heh - absolutely. Security has a huge chunk all about hot topics
@RoryAlsop Amusing... Again, see my earlier comment about passwords not yet cracked.
storyinmemo.com/?p=98 Blog blog blah blah LinkedIn feel free to copy pasta to Security.SE
@IsziRoryorIsznti I know :-)
12:57 PM
I guess IinkedIn.org would be another similar-looking domain for the purposes of having fun. :-)
@IsziRoryorIsznti yup
Whoops, should have been IeakedIn.org
2 hours later…
3:02 PM
QotW#29 drafted and ready for review if anyone fancies giving it a look
heh - popping links up on the Mashable LinkedIn article has increased views on the blog by 300%
the LinkedIn ones didn't have that big an impact
nor did the twitter one
3:39 PM
@RoryAlsop My cat is curious about the duplicated efforts!
@JeffFerland Well, I looked for a draft authored by your cat, but I can only assume feline drafting is carried out somewhere else :-)
I can't get anything online until tonight. In office and all.
But I'll go for the edit review, I guess
@JeffFerland Sorry - feel free to hack it about and replace all the words with other words which are better
@Ladadadada nice. also kind of my point from earlier.
s/.*? /better/g
@RoryAlsop Well, it's good that we know something's going up, and it's really my fault for not having something there sooner
3:43 PM
@JeffFerland yknow, with just an "o" instead of "ou", "gray" instead of "grey", z instead s, etc
3:56 PM
but have a look at the options for next week's. There is no reason we can't draft ahead of the game if we want
Q: Vote for your question of the week #30

Rory AlsopFor QotW #30, scheduled for publishing to the Security Stack Exchange Blog on 15 June, please post as Answers, and vote for your favorite question from the whole Security Stackexchange site. Please post any question that you feel is of worth and the reason why as an answer below. Try not to prom...

4:41 PM
Wow... Everybody is getting hit this week...
We're investigating a security issue with user passwords. As a precaution, we recommend you change your password: http://www.last.fm/passwordsecurity
4:56 PM
Whoah... I didn't think Part 15 devices could operate at 1W in 2.4 GHz...
ALFA Wireless Network Adapter 1000mW High Power G Wifi (AWUS036H) $20 + Free Shipping http://j.mp/L62iFN
3 hours later…
7:31 PM
@IsziRoryorIsznti I upvoted your leakedin answer after the first sentence.
havent even finished reading it yet - tldr as per usual ;) - but I was annoyed at all the answers, and was getting ready to write one of my own (a rare occurance), till I saw yours. kudos.
@AviD Haha. Thanks.
@AviD The rest of the post is pretty much covering what I've said in chat earlier: Presuming LeakedIn is hosted (or compromised via MitM or other method) by an attacker, the least you're doing by submitting your password is helping to build cracking dictionaries and rainbow tables.
@IsziRoryorIsznti yes, by now I finished.
only point I would add is regarding the identities of the entities - they are well known, as has been pointed out, but not in a good way, as I've pointed out.
@AviD Well known, but not really verifiable without HTTPS. I kinda touched on the HTTPS bit in my post, but I can see how it would be easily missed.
It's been brought up in comments on other answers also. Remember, I put on my tin-foil cap for this one.
@IsziRoryorIsznti true on both. but my point is further than that, even assuming verifiability - authenticated identity does not equate with "trust".
in fact, as I mentioned earlier, I would trust a random attacker that might get access to my communications, more than I would trust those two.
@AviD Aha, good point there.
@AviD Ain't that comforting?
7:44 PM
whats that saying, about stupidity being more dangerous than malice?
@AviD Can't say I've heard it, but it sounds good.
@IsziRoryorIsznti sure you did, just now.
3 hours later…
10:57 PM
Q: GNU/Linux distribution for network virus || malware identification

PsyStyleI'm looking for a GNU/Linux distro that I can install in transparent setup to look for infected hosts on a LAN. I don't need to stop viruses and malwares but only identify them and the host where they come from. I don't necessarily need fancy graphics but I would like something pre-configured a...


« first day (539 days earlier)      last day (3239 days later) »