The DMZ

« first day (3317 days earlier) ← previous day next day → last day (1572 days later) »

Anonymous

9:33 AM

On the recent changes of staff leaving...

Anonymous

we continue to be committed in investing in the community and ensuring that it has a seat at the table as we keep moving forward. These changes are a part of that process.

Anonymous

laughable.

MechMK1

10:08 AM

Q: Generating a CSR for 32 bit private rsa key

I used an OpenSSL 1.0.1k 8 Jan 2015 version to generate a 32-bit RSA key, and I tried to generate a CSR for the key $ openssl req -new -key privatekey.pem -out csr.pem 139645847348928:error:04075070:rsa routines:RSA_sign:digest too big for rsa key:rsa_sign.c:127: 139645847348928:error:0D0DC0...

^- 32-bit RSA Key

These people are the ones doing crypto in your apps

Anonymous

lmfao

MechMK1

32-bit RSA keys in my application!? It's more likely than you think!

So just to make sure I get the math right, a 1024-bit rsa key is 2^992 times better than a 32-bit key, right?

MechMK1

10:51 AM

To illustrate just how insecure it is, all possible private keys are already downloadable here. — MechMK1 1 min ago

MrHeliose

wasn't 1024 bit the minimum recommandation for asymmetric crypto?
and wasn't 64bit considere insufficient for symmetric one?

MechMK1

80 bit is the absolute lower bound for anything I would consider "probably not cracked by the NSA by now

128 is what I consider safe for symmetric

as for asymmetric crypto, it's more like 3000-ish bits for RSA

but asymmetric crypto depends heavily on the alg

Anonymous

My laptop needs charge but I cba to get my charger.

Anonymous

I'm WFH and in bed

Anonymous

So getting up and out to get the charger feels wrong

Anonymous

10:57 AM

Latest from Twitter: we now need to use a gender neutral version of Man in The Middle.

Anonymous

:upside_down:

MechMK1

We at our company jokingly used "Person-in-the-Middle", when one co-worker of mine added that this would be very insensitive to those identifying as otherkin, so we renamed it to "Entity-in-the-Middle"

MrHeliose

4chan behind this maybe

MechMK1

No, 4chan has better things to do

Like stand in a swastika in habbo hotel

I was there, it was hitlerious :D

Anonymous

I hate InfoSec Twitter.

Anonymous

10:59 AM

Full of attention seekers.

Anonymous

Full of non-technical people pretending to be badass.

Anonymous

I've never known a community be proud over being non-technical.

Anonymous

But on InfoSec Twitter, if you're non-technical, it's fine! You're just as valuable as anyone else!

MechMK1

Just people adding #InfoSec to get street cred

Pathetic

Anonymous

Because apparently feelings are more important than facts over there. Even though if you're non-technical you are objectively not value to technical roles.

MechMK1

11:01 AM

I mean #pathetic

MrHeliose

I remember the fight between 4chan and the french JVC community was hilarious

on pixel.io

MechMK1

You know most people here are anons, right? :D

Anonymous

Which reminds me of the other day, Mech.

Anonymous

The Twitter InfoSec crowd were acting proud that they don't have CVEs.

Anonymous

Can you imagine being proud that you don't have any CVEs?

MrHeliose

11:02 AM

y it was likely

Anonymous

It's okay not to have any, but why the FUCK would you be PROUD that you don't?

Anonymous

Do you even realise how fucking stupid that is?

MrHeliose

@J.J because you'r a true H4cK3r if you don't have cve, you only have 0d

MechMK1

@J.J It's a phenomenon I call shitting on the giant

And it's a strategy that many people who are somewhat new in a field do

Anonymous

Well, it's sad & pathetic.

MechMK1

11:05 AM

They find a person/technology/thing/etc. that is generally well-liked, well-established, etc. and then claim that said person/technology/thing/etc. is actually really bad

Anonymous

There is nothing to be proud of not having a CVE lol

Anonymous

And if you think you SHOULD be proud of that

Anonymous

You will never achieve anything in this industry.

MechMK1

Like "Oh you use AES-GCM-256? You NOOOB!!! I use an ancient soviet cipher with 32-bit keys it's soooo secure"

Anonymous

And I will never understand the mentality of not wanting to achieve.

MechMK1

11:06 AM

Or "Uncle Dane??? He doesn't know shit about playing engineer!", "B4nny? He's such a n00b omg!"

@J.J Well, I understand the idea of not needing to be the very best, like no-one ever was.

Perhaps, just being good at what I do is my real test, and to have a good work-life balance is my cause.

MrHeliose

CVE is 100% not working. Let's create the Uncommon Vulnerabilities and Exposures

MechMK1

I sometimes may travel across the land with my family, and find enjoyment far and wide.

A wide range of hobbies and interests to understand, and the joy to be found inside.

It's you and me,
I know it's my destiny!

INFO SEC!

Anonymous

@MechMK1 I perfectly understand not trying to be the best.

Anonymous

Being the best is not possible.

Anonymous

BUT; I do not understand the mentality of not trying to be as good as you can.

Anonymous

11:10 AM

You shouldn't be proud of not achieving.

Anonymous

That's stupid.

Anonymous

We live in such a bullshit culture now.

Anonymous

Where everything is happy & not being good is fine!

Anonymous

"cannot cook? don't worry just order food"

Anonymous

"cannot wash up? dont worry just buy a dishwasher"

Anonymous

11:15 AM

"cannot pass an exam? its fine just say you have issues with exams and you get extra points!"

Anonymous

Its pathetic.

Anonymous

Makes me mad.

djsmiley2k in darkness

12:12 PM

@MechMK1 gonna travel across the west, to hack them is your cause!

1 hour later…

Vipul Nair

1:25 PM

I am using this application that takes a encrypted(maybe) file and plays video.How do i dump the video?I have 0 reversing knowledge.How should i approach the problem?

5 hours later…

Rory Alsop

6:29 PM

@J.J most of the response was not pride at not having CVEs, it was a reaction to folks saying you could only be a sec professional if you had CVEs. Which is just ludicrous

Most of the infosec world sees CVEs as entirely irrelevant to their job

I wouldn't expect any of my teams ever to have CVEs - in fact for certain companies I worked for, if they did have them they would likely lose their jobs

(If they got them while at those companies)

Over 20 years in infosec, many of which I taught hacking techniques to penetration testers, I would never have tried to get a CVE, as it is just entirely outside anything my role required - it is not a sign of skill, it's not relevant to any world I have worked in, etc

I know folks who have CVEs that took them a few minutes, and some who have discovered new vulnerabilities in critical national infrastructure that will not have them as CVEs

tl;dr - CVEs are not an indicator of anything :-)

4 hours later…

tigrou

10:44 PM

I'm trying to understand how challenge–response password recovery mechanism for disk encryption softwar e. You usually give a 32 chars challenge and get a similar response that will allow to create a new password and decrypt disk again Something like this : https://topics-cdn.dell.com/RecoveryGuide/images/GUID-BD2C598C-AAD4-4FEB-93C5-C3D091895FD8-low.png
AFAIK it does not simply checks the response since software running on encrypted disk (PBA) does not know the password itself (that would make encryption useless)

« first day (3317 days earlier) ← previous day next day → last day (1572 days later) »

all rooms