The DMZ

« first day (581 days earlier) ← previous day next day → last day (4597 days later) »

Iszi

01:40

@RoryAlsop Looks like a re-post, but slightly re-phrased. Not sure how you want to handle this.

Q: How to catch a SMS spammer who is using google voice to spam me

How do I catch a SMS spammer who is using google voice to spam me. Please do not close this question. It is a valid issue that is currently happening. I have the google voice number and 2 of their burner emails with gmail. How do I gather enough information to inform the authorities?

3 hours later…

Iszi

04:29

@RoryAlsop QotW #31?

2 hours later…

Karrax

06:54

Q: Pcap file inspection

I have 3 packet capture, generated with Wireshark, of an example intrusion but I'm struggling to figure out whats going on. I also tried running the pcap files in snort to see if it detected anything but I'm not sure what the results were. I have never used snort before but the results didn't c...

network ssl windows virus botnet

that question is kind of pointless with the pcap files modified away

Vote to close it?

Rory Alsop

Morning @Karrax

I think as she hasn't updated to just have the key parts of the pcap I will close

Karrax

@RoryAlsop Morning :)

Kind also felt like doing the homework for someone

kinda*

Rory Alsop

yes - agreed

1 hour later…

Karrax

08:28

Hmm.. any reason it would be bad for an authentication mechanism to bcrypt the password with javascript before sending it to the webserver? Wouldn't it be best practice since no cleartext passwords would be discovered in logs and so forth?

I got a bit uneasy as there is apparently very few javascript libraries supporting bcrypt, and bcrypt is according to some answers the best practice way of hashing them. stackoverflow.com/questions/2299434/…

ooo.. just found a question about this: security.stackexchange.com/questions/17129/…

Karrax

09:26

Thomas Pornin got so many brilliant answers that are easy to understand

2 hours later…

CodesInChaos

11:09

Q: What is connection confidentiality? How it is implemented?

According to OSI Security Architecture, data confidentiality can be divided into connection confidentiality and connectionless confidentiality. I guess connectionless confidentiality can be achieved for example by encrypting individual messages using DES. But what are the mechanisms for connectio...

security cryptography

Would fit from the topic, but it seems awfully vague

1 hour later…

AviD

12:25

Allo allo, how all you ladies doin today

well, I've moved, hooked up to the i-juice, and started catching up on my work...

Scott Pack

AVI!

AviD

so, wadidimiss?

SCOTT!

Scott Pack

Let's see. There's a hacking proposal on Area51 that is still very poorly defined and largely overlapping with us.

Iszi wants to WDE his gaming system.

AviD

@ScottPack hmm. got that gist from the starred, but is it?

Scott Pack

Let's see...

Oh, we got more bears!

AviD

12:28

@ScottPack hehe, saw that one! starting to roll thru the archive...

@ScottPack more bears?

Rory Alsop

@AviD afternoon

AviD

Chicago style?

@RoryAlsop Rory!

Scott Pack

Duh bears

AviD

@ScottPack Tank Engine style?

Scott Pack

Oo! I got to try to explain to my gaming group how a beak faced tengu was able to use a blowgun.

That was exciting.

AviD

12:29

@ScottPack lol!

just wiki'd tengu... and forget blowgun, I'm not clear how that comes up in gaming...

on the other hand... nevermind, everything comes up in gaming groups.

Scott Pack

The adventure we were playing had an encounter where the group was ambushed by a fistful of ninja tengu. These kind, not the long nose kind.

Said right there in the book, 'The tengu attack from invisibility, first with blowguns, then move in for melee.'

AviD

@ScottPack so.... your group had no problem with tengu being ninja, or weilding a knife - or even existing, for that matter - but the blowgun bothered them?

Scott Pack

@AviD It's kind of hard to wrap your mouth around a tube and apply air pressure when you don't have a mouth.

AviD

@ScottPack ah, so we're in disbelief-suspension-yet-still-scientifically-possible mode? of course.

Scott Pack

Clearly.

AviD

12:35

hmm. birds can drink from those little straws they stick in cages, no?

or, what about about nasal air pressure?

i.e. stick it up their nose and blow.

@Karrax or this one, even simpler:

A: What to transfer? Password or its hash?

If you transfer the hash from the client, this affords no security benefit, and makes the hash pointless: If a user can login by sending the hash to the server, then the hash is effectively the password.

Karrax

12:54

Hmm I see.. Thank you. However is this like saying "Pass the hash" technique is inherently insecure? MAny applications in windows rely on this

and yes, its vulnerable for replay attack, however maybe that a risk we can afford compared to other risks involved

Scott Pack

@Karrax You mean like NetBIOS?

Karrax

yes I believe NetBIOS uses pass the hash. The attack vector is commonly known as "Pass the hash attack"

Scott Pack

I definitely does, and that's true.

Karrax

I am currently advising a client in removal of clear text passwords in database. I am recommending using PBKDF2 with SHA256 over as many iterations they can afford. This is so they can document compliance with NIST guidance. However the thing is they cant afford very much development time to fix the issue

and one issue is that consultans need to be able to log into customers accounts.. previously this was done by using the customers password. To fix this I thought maybe pass the hash would be sufficient

to keep the development cost down

Anyone know if there exist a SE chat application for Android? I gotta leave work any minute lol

Thanks for advice bwt :) I'll cya guys later when Im online again

Rory Alsop

@Karrax I use Droidstack, and the chat seems to work - think it is just a browser window for chat though

Scott Pack

13:21

I just use a browser for chat. I've never tried the Droidstack chat bits

1 hour later…

Iszi

14:23

@ScottPack Wasn't that a question you posted on Role-playing Games?

Or was it Science Fiction and Fantasy?

Scott Pack

@Iszi It was

I wasn't too terribly happy with the answers, but except for the one that was effectively NaA, they were ok.

At the table, we just laughed and moved on, so I'm not anxious to get anything real.

I'm tempted to ask about it on the Paizo boards in the hopes of getting the encounter designer to comment.

Iszi

14:49

@ScottPack Just popped my "killer bagpipe" idea in there for you.

Scott Pack

Good man

Bonus points if you mock up a picture

Iszi

@ScottPack Nope, but I'll give you another bird-like species that just might have used such a thing.

Let me know if you recognize these guys.

Scott Pack

I wonder if the darts are shot through the drones or the chanters.

Iszi

15:02

@ScottPack So... no love for Star Control?

wiki.uqm.stack.nl/Yehat

You'd have to hear 'em talk to get the reference. Clearly meant to be of Scottish descent, methinks.

Scott Pack

15:59

Doesn't sound familiar

Ok, so that's a game? Never heard of it.

Iszi

Star Control II

Star Control II: The Ur-Quan Masters is a critically acclaimed science fiction video game, the second game in the Star Control trilogy. It was developed by Toys for Bob (Fred Ford and Paul Reiche III) and originally published by Accolade in 1992 for PC; it was later ported to the 3DO with an enhanced multimedia presentation, allowed by the CD technology. The source code of the 3DO port was licensed under the GNU GPL in 2002. Gameplay Star Control II added a large number of species and ship types to the already diverse cast and replaced the first game's strategy-based scenarios with a ...

sc2.sourceforge.net <-- Give it a play. Totally worth it.

Iszi

16:59

@ScottPack There's probably some spoilers in this, but here's a video so you can get what I'm talking about with the Yehat.

►

Scott Pack

17:23

So. It's kind of warm outside, and my car was hot, so I left the windows all the way open during lunch.

Get up to leave, see a fairly solid bucket-like downpour. Somewhere around 1/8" of water in the door's cupholder.

On the plus side, this building doesn't have any hot air hand driers, so I'm stuck using a standard fan to dry my pants.

Iszi

Hehe. Down here, we've learned to just crack the windows a bit. Never trust the weather.

Scott Pack

Well yeah, I would expect that down there.

Iszi

17:48

Q: How can TrueCrypt encrypt a System Drive on a live OS?

When setting up whole disk encryption with TrueCrypt, one re-boot is required to test the operation of the TrueCrypt Boot Loader. After this reboot is when actual encryption of the system takes place. The encryption process takes place while the Operating System is running (and, indeed, other a...

truecrypt

In case anyone here knows...

Rory Alsop

18:44

@Iszi If you ever come to Scotland you will learn that not only must you distrust the weather, assume it is actually out to get you!

Lord of Time

geez, i'm surprised how much spam there is... there's literally one hundred times the amount of spam from *.ru than there is from *.cn and all other sources combined (at this business' servers)

i finally understand why ITSec is almost impossible under this barrage :/

1 hour later…

Iszi

19:48

Heh. Got two questions tweeted today. My TrueCrypt question here, and an issue with the search bar on meta.RPG.

Iszi

20:19

Oh, wow. A certain bird/chess piece is coming very near to 10k.

1 hour later…

Andrey Botalov

21:36

What does tag client-side means? In my opinion it should be used only in questions that ask about performing certain operations at client side instead of server side. Otherwise, tag becomes too broad. For example all web-application questions could be also tagged as client-side. I ask because I think that security.stackexchange.com/questions/17412/… shouldn't have client-side. Do you think so?