The DMZ - 2019-08-22

« first day (3171 days earlier) ← previous day next day → last day (1707 days later) »

8:29 AM

@RoryAlsop It's not bad, but the artstyle is as if they took 3 failed game projects, salvaged all usable assets and crammed it into one game

The second big complaint I have is that the procedural generation was thrown in, just to say it has procedual generation. The level design suffers heavily from it, and instead of having areas to explore and find meaningful rewards, you go through empty locations, with some assets scattered about, only to find a few resources here and there

@forest I hope you didn't actually go look :D

8:41 AM

@MechMK1 You've deeply tempted me to. But... I'm lazy.

Praise to procrastination

Anyways, I have a stupid question:

I just read that Firefox and Chrome (and maybe some other browsers) will block the Kazahkstani Root CA used for interception.

Would that actually change anything meaningful for end-users?

yup

It'll make it harder for Kazakhstan to MITM connections by default.

If they go on Facebook, now they see "Hello, your government is spying on you. [Visit Facebook anyways and let them spy on me] or [Don't use Facebook]

Yes, it makes it harder to do without users being alerted to it

But in the end it'll still work

Or... Find a way to circumvent.

After all, now the government can't rely on ignorance, only apathy.

What could the people do, realistically? VPN? Tor?

[In Soviet Voice]: There is no such thing as private IP address space. IP addresses belong to the people!

8:50 AM

Depends on how the MITM is implemented.

user image

hue

@forest How so?

Well, if there's no blocking going on, then you can just use Tor (although Kazakhstan does attempt to block Tor, but I think obfs4 works). But at the very least, it means users know they're being MITMed.

Yes, that's probably a good point. At least until they block Firefox and Chrome from being Downloaded

8:52 AM

And knowing is half the battle^W^W^Wuseful for adjusting their threat model accordingly.

Microsoft apparently didn't blacklist the CA, claiming "We never trusted it to begin with"

Well Microsoft also allows the US FPKI.

Microsoft just don't give a damn

user image

Last meme for today

noice

10/10 would recommend to all my clients

BuT iT woUlD imPrOvE tHe UsEr ExpEriEncE soO mUcH

You have no idea how much I heard that already

You know what's really bad user experience?
Having your account stolen

8:59 AM

Depends on whose perspective it's coming from. ;)

"Oh, the accounts are using unsalted MD5 and all the passwords are 6 characters long, in the format ?l?l?d?l?l?d. How nice!"

"The internet says we should care more about the hacker community? Suggestions?"

What about a bug bounty program?

Responsible disclosure!

Screw it, plaintext passwords and SQL Injection in the login form! Party like it's 1999!

Netscape Navigator? I'm perfectly happy with Mosaic.

sed -i 's/<audio/<audio\ autoplay/g' *.html

Not sure if you need the `\` when it's enclosed in '.

a habit of mine

You mean the `\`

escape your escapes

9:05 AM

Idk why the markup is screwing up.

Yeah screw escapes.

I'll correct you on your use of escapes while messing up my own!

The white hat hacker practices responsible disclosure, in order to improve the security of the system.
The black hat hacker defaces the website for the lulz.
The neutral chaotic hacker inserts a cronjob to automatically update the system because the sysadmin is incapable of doing so, patches the vulns that allowed him to gain access in the first place, then places a huge ASCII shlong in every `.bashrc` file and exits

I may or may not be one of those :D

I think a defacer would be a grey hat.

Black hats may patch the vuln they used to get in but... It's generally to prevent takeovers.

Same reason some sophisticated botnets have their own antivirus modules built in.

Blackhats probably sell the vuln or use botnets

Depends on the vuln

Nobody would pay good cash for shell access to auntjuliasnailstudio.com

Most blackhats don't have the contacts to sell the vuln. And some have enough ethics not to sell to governments. I've only ever sold bugs to private buyers. It pays less but it's not, well, evil.

@MechMK1 Yeah but the server it's running on might give you a couple more Mbps.

I'm too lazy to sell any vulns

This stupid f****ng piece of absolute garbage Citrix

9:15 AM

Well if you have any interesting (or at least useful) ones, I can be your middle man. :P

(Not joking)

Nah, just small time

I seriously can't get it to work. It just says launching, then starts a process, then does nothing

Jesus...

I've never used Citrix (I don't use Xen, period. I prefer KVM)

Not my choice how the customer wants to provide access to their systems

Told them more than once that it's shit and only makes problems

ah

Well it is popular.

But it doesn't work 90% of the time

Not even an error

Just does nothing

9:18 AM

Sounds like a configuration issue.

Their entire infrastructure is a configuration issue

Is this a client or your employer?

Client

FINALLY

Noisestorm - Crab Rave [Monstercat Release]

I have no idea what that is.

A meme, but this time as video

9:19 AM

I can only think of "A Frightened Boy".

It's the crab rave

crab flash video ("A frightened boy" by Joel Veitch)

Ah yes, the good old days

(aka rathergood.com/vid/crab.swf)

basically, it's a generic EDM song with a hilariously bad CGI video

9:21 AM

EDM?

Electronic Dance Music

I am really careful, because people who are really into electronic music are very very precise when it comes to their sub-sub-genres

"Well, that actually wasn't psy-trance, but rather Full-On Psy-Trance, you pleb!"

heh

I mean, nothing against EDM folks

But I'm not going up in arms if somebody calls Power Metal "Heavy Metal"

I'd just like to interject for a moment. What you’re referring to as Metal, is in fact, Powermetal, or as I’ve recently taken to calling it, Power plus Metal.

I get way more upset than I should by this guy who keeps insisting that using a dictionary attack means looking up the hash in a pre-computed table.

9:42 AM

GNU/Metal.

user image

I was just wrong on the internet a few minutes ago.

Was arguing with someone but it turned out my info was a few years outdated. :P

About what, if you don't mind me asking?

Firefox's malloc's heap size and whether it uses the system malloc or jemalloc under MSVC.

@gcp Ah, OK. Well that would explain it. I stopped doing browser research almost exactly a year before! Thanks for the correction. — forest 4 mins ago

Well, I have a big advantage there over you

Because I know I don't know shit about that :D

9:45 AM

Turns out I've been spreading false information for the last few years because outdated info. :(

@forest What you're referring to as "Metal" is actually a collection of musical styles, such as distorted guitars and vocals, extensive use of the minor scale, ...

Such is life, don't worry about it

Well at least it was just out of date, not completely wrong.

Happened to me too, when I had a discussion about bitcoin in university

And I claimed a mined block would yield you 50 BTC

Turns out that it was lowered some time ago

To like 25 wasn't it?

(I don't know for sure)

Yes, if I remember correctly

But to be honest, I never cared that much about cryptocurrencies

I doubt they will "revolutionize the finance sector" as many people claimed

They made some people really rich, and that's about it

Nice for them

9:52 AM

I think they're useful for anonymous transactions (if purchased anonymously).

Other than that, they're just a high-carbon lottery.

Basically

I never had the need to do international anonymous purchases

And I still buy my weed in cash

I've used it to buy servers, to get paid, shit like that.

Yes, but I don't have the need for such things, at least ATM

My server is at home, on my desk

It's a motherboard with an SSD and an HDD attached

Stores my music, my movies and hosts my TeamSpeak server

>not running your server on a hacked Atari 2600

>not owning a retro PC
Why even live?

0

Q: Laptop Hacked and Google Voice Texts deleted

I reported an incident to my HR rep via Google Voice. The text string is now gone. My boss is a master hacker. How can I prove he hacked my account and removed the text string. Can I sue him for doing this?

"My boss is a master hacker"

I kek'd

9:56 AM

The three systems I most commonly use: 1) A 48 core Xeon beast with 256 GiB ECC RAM. 2) A 250 MHz MIPS board. 3) A 67 MHz ARM9 computer with 4 MiB SRAM. Wonderful setup!

My boss works for Anonymous, so better watch out

lmao

@forest Wait, let me find my server specs :D

The motherboard is an ASRock Super Alloy with some built-in intel CPU and like 16 GB ram :D

Anyways, brb

I have to go buy colour for my warhammer minis

Journeyman Geek

10:38 AM

@MechMK1 one of the great regrets of my life is my mom throwing out our XT

AreWeNotTooSmart

@MechMK1 this..

Journeyman Geek

@forest why would you need to hack it? ;p

10:58 AM

@AreWeNotTooSmart The sole reason why I am here tbh

Finally bought my paints :D

Costed just 80€

@JourneymanGeek I never had a retro PC.

>inb4 gtfo zoomer

My first PC was a crappy Win98 machine

My paints are: "Night Lords Blue", "Dryad Bark", "Druchii Violet", "Pink Horror", "Auric Armour Gold", "Screamer Pink", "Stormhost Silver", "Retributor Armor", "Ushabti Bone", "Genestealer Purple", "Xereus Purple", "Casandora Yellow", "Nurgling Green", "Zandri Dust", "Screaming Skull", "Kislev Flesh", "Grey Knights Steel" and "Carroburgh Crimson"

So 18 colors in total, nice

Journeyman Geek

11:22 AM

@MechMK1 my PC wasn't retro then

@MechMK1 hm

GW?

Yes

Journeyman Geek

Is Vallejo still a thing? They're excellent

In reference to chat.stackexchange.com/transcript/message/51437172#51437172

Journeyman Geek

Come in little droppers

I dunno what that is

Journeyman Geek

11:23 AM

Brand of paint ;p

acrylicosvallejo.com/en

Ah okay. I'm stuck with GW paints for now. I might use some other brands later on when my minis don't look like they have been barfed on by a rainbow clown

Journeyman Geek

Also I knew folks who also used the cheap apple barrel stuff with good results

My bottleneck isn't the paint ;)

0

Q: Has SQRL been extensively audited?

SQRL - Secure, Quick, Reliable Login - is an open draft for user authentication. Have there been "enough" publicly available tests to make any backed statements about the security of SQRL?

2 hours later…

1:26 PM

@MechMK1 It hasn't been to my knowledge, as it's never really gotten traction. There was an article about it on the blog here a few (5? 6?) years ago. I don't expect this to change now that WebAuthn has been standardized.

@Xander I am asking because someone tried to edit the tag wiki, stating that it's a reliable, high-security protocol for authentication. A bold claim without any evidence, hence my question

But good to know that my suspicion was not unfounded

@MechMK1 Ha ha. Yes. That would not be appropriate.

I'd generally avoid "loaded" words like "high security" or "reliable"

Yup, and it was a bad edit anyway. It was about the subject of the tag rather than the tag itself.

A more neutral description like "SQRL is draft open standard for user authentication. It presents an alternative to traditional username/password-based solutions."

The wiki description is the same. Describing something as "practical" is just not factual

If a framework I use provides an implementation of algorithm A, but not of algorithm B, then the usage of A is more practical for me. That doesn't make A a better algorithm than B.

But none of the rejection reasons seem appliccable

It's not spam or vandalism, not copied content either

1:33 PM

@MechMK1 I wrote a custom reason for the description and chose "Lacks Usage Guidance" for the excerpt.

> Tag Wiki Descriptions should avoid loaded language, such as calling a technology "practical" or claiming something offers "dramatic improvements".

People regularly confuse tag wikis with tag subject wikis.

So, gave it my own shot to see if this one is better

2:16 PM

What you guys think would be the cryptographically more secure method of generating passwords? Linux utilities like /dev/random, /dev/urandom, openssl and pwgen or online password generators like lastpass, etc. ?

@daya Depends on what you use them for. I would generally prefer offline methods over online methods. The only time I use online password generators is for example passwords in StackExchange answers.

I personally use KeePass to generate my passwords.

The thing is: Passwords have little to do with cryptography itself.

@MechMK1 For regular sites like twitter, facebook, etc

Then an offline password manager is the way to go, in my opinion. Typing it into a phone app is a pain for a minute, but then you have it done and don't need to do it again.

@MechMK1 Well I myself know almost nothing about crypto

Passwords are luckily only tangentially related to cryptography

2:21 PM

@MechMK1 I already use a password manager but I was just wondering which method will be more secure

What password manager, if I may ask?

Most of them have some kind of password generator included

KeePass

Same as I. The keepass password generator should do fine.

/dev/urandom looks good too :P

It's unnecessary, and requires mapping

Because /dev/urandom doesn't return characters, it returns bytes

So you need to map them to printable characters

2:24 PM

Perhaps not surprisingly, we have an answer that describes how to create a password using /dev/urandom

53

A: One liner to create passwords in linux?

It depends on what you mean by "readable". If you want to use only hexadecimal characters, you will need 32 of them to reach 128 bits of entropy; this line will work (using only commands from the coreutils package): head -c16 /dev/urandom | md5sum This variant produces passwords with only lowe...

Device files like /dev/urandom are generally only required if you need a steady stream of randomness, such as when overwriting a device with random bytes

It is just one command head /dev/urandom | tr -dc A-Za-z0-9 | head -c 13 ; echo '' from unix.stackexchange.com/questions/230673/…

You can do that as well

Your password will not be more or less random than if you were to use keepass

@MechMK1 I don't see your wiki edit in the queue yet, but I'll keep an eye out for it.

@Xander It got rejected because of a later edit

@daya A demonstration:
- `GOGvY4eqLEqqafnhLeGu`
- `3LJjyvHcuw5Q4MhufA8z`

2:26 PM

Ah, sorry, that was me. I put in a excerpt not realizing you were doing one as well. I was expecting to see yours coming in over top of mine. Suggest it again if you like.

@Xander No, yours is perfectly fine

One of these two password was generated via /dev/urandom, the other via KeePass. Which one is more random?

@MechMK1 They're going to be effectively the same.

Either is more than good enough.

Exactly. They are both 20 characters long, and both include uppercase, lowercase and digits.

@Xander That' nice but as I said I was talking their security comparably

@MechMK1 I am not sure

@daya Yeah, the security is effectively the same.

2:29 PM

@daya The answer is that they are both fine.

@MechMK1 I have been in an enterprise where Citrix was used for >90000 virtual desktops. Worked amazingly well, and a godsend for maintenance, patching etc

@RoryAlsop I only have problems with it.

@MechMK1 Has to be set up right but can be awesome

@daya If a hacker were to steal the hash of both of these passwords, and even had the knowledge that both were 20 characters long, has Uppercase, Lowercase and Digits and both were from a random source (even if it were a weak one), any attacker would just say "Forget it"

Attacking a weak RNG is feasible if you have LOTS AND LOTS of data

but 20 bytes? Nah

RNG?

2:31 PM

Random Number Generator

Oh

Essentially what your question boils down to: Which of these is more random?

And the answer is: For your purposes, they are all fine.

Yep

Okay, thanks :)

The reason why entities like Microsoft warn against things like using System.Random for cryptographic purposes, is because with enough data, it's possible to "predict" the numbers that will come

But again, your purpose is creating passwords, and the amount of data required for that is so small, that even a somewhat bad RNG will do fine

So feel free to use KeePass, /dev/urandom, etc...

Ok

2:57 PM

This infrastructure makes me go insane. For over an hour now I have tried to connect to this XenApp desktop and it just does not work

NO MY SESSION DID NOT EXPIRE I JUST LOGGED IN WHAT THE HECK ARE YOU TALKING ABOUT AHHHHHHHHHHHHHHHHHHHH

7 hours later…

10:24 PM

is cicada 3301 bullshit?

11:12 PM

Yes.

11:39 PM

does anyone know why cryptogeddon has shut down?

« first day (3171 days earlier) ← previous day next day → last day (1707 days later) »

Transcript for

Aug '1922

The DMZ

A serious place where infosec is discussed PS we don't do hard...

404-errors moderate-anarchism pretending-to-work staring-into-the-abyss

join this room
about this room

00:00

06:00

12:00

18:00

all times are UTC

site design / logo © 2024 Stack Exchange Inc; legal

mobile