The DMZ

John Zhau

02:04

In pentesting, do you need to know a lot of crypto or do you just let your tools handle the identifications & cracking?

MechMK1

10:29

@JohnZhau Depends. You rarely need to know anything specific, like how RSA-CRT works

But if you see a client support 3DES, you should know it should be deprecated for some scenarios

Speaking of crypto, I saw this article today:

theintercept.com/2015/12/28/…

And this quote worries me:

> “The gold standard in disk encryption is end-to-end encryption, where only you can unlock your disk. This is what most companies use, and it seems to work well,” says Matthew Green, professor of cryptography at Johns Hopkins University.

How is disk encryption related to end-to-end encryption?

@Derpy So basically a speedrunner, who basically has a disassembly of the entire game in his head, knowing every function in the game in and out

Derpy

10:45

@MechMK1 Well, simply put the disk is one end and you are the other. :P

(and with this last message, I will probably get forever banned from the room)

MechMK1

Every encryption is end-to-end because one end encrypts and the other decrypts.

Usually I would call BS immediately, but since this guy is a professor, I strongly entertain the thought I just don't "get" what he means

Derpy

@MechMK1 mind you, there is option c) too.

MechMK1

Suicide?

Derpy

Wrong quote - the professor never said that in the first place

MechMK1

Possible

Derpy

10:52

probable

MechMK1

Or he was misunderstood?

Derpy

kinda the same

reed

Dude: "Every piece of software has bugs". Journalist: "According to security expert Dude, the NSA is probably intercepting all your data through software bugs"

Anyway, speaking of disk encryption, is it true that you can't have full disk encryption in Windows 10, unless you have a license for PRO? (Win 10 Home, which is what you usually get when you buy a PC/laptop, won't provide full disk encryption).

MechMK1

256-bit AES very difficult to crack. The chances of an attacker brute-forcing a key are negligibly small.

NSA HAS TOOLS THAT CAN CRACK AES

Derpy

@reed BitLocker isn't available on Home afaik.

reed

11:02

Windows not providing encryption for all its users is an absolute disgrace. One more reason not to use Windows.

MechMK1

Yes, bitlocker only works on pro

Though let's be honest, how many people do you know who would use it if they could

Derpy

They say that you can still use "device encryption" but I know that apparently the process isn't very documented

MechMK1

99% of users would be like "But I have nothing important on my PC anyways"

Derpy

@MechMK1 the ones that are already using Linux instead?

MechMK1

@Derpy Average Joe thinks Linux is a laundry detergent

Derpy

11:05

@MechMK1 sorry but that is totally wrong. Average Joe probably thinks Linux is a character from Peanuts.

reed

I don't think it's a matter of choice, encryption nowadays should be by default. It's like HTTPS, it's about time plain HTTP disappears and is blocked by default everywhere

MechMK1

@Derpy roeschswiss.com/en/11_linux

Suit yourself~

Derpy

@MechMK1 The joke was that Peanuts "Linux" isn't even called that way :P It is Linus

MechMK1

Never seen the Peanuts

MechMK1 was banned from the DMZ.

Derpy

(just a comic strip by Charles M. Shulz. See here. The joke by the was wasn't totally made up because back in school there was a girl that hearing me and another friend of mine talking about Linux actually asked if we were talking about the comics Linus)

Tom K.

12:52

@MechMK1 Looking at the list of publications of this person, there's a lot of knowledge there

and with architecturs like the one that for instance nextcloud offers, you do have end-to-end encryption for your drive

but I would be surprised if "This is what most companies use" ;)

my bet would also be on misunderstanding / misquote

ThoriumBR

13:18

@MechMK1 I believe what he wanted to say is that the keys to unlock the disks are in possession of the company owning the disks. It's like the end to end on Signal, for example... Signal does not have your keys, only you and your party.

the next paragraph clarifies that:
“There are certainly cases where it’s helpful to have a backup of your key or password. In those cases you might opt in to have a company store that information. But handing your keys to a company like Microsoft fundamentally changes the security properties of a disk encryption system.”

so, if you keep your keys in-company, it's secure... but if you handle out the keys to someone else, you don' own the keys, as the 3rd party may be on the receiving side of a "National Security Letter" and have to silently hand out your keys...

don't backing up your keys on an external entity protects you from that, but make sure to backup your keys offsite... losing the keys is the fastest way to secure wipe an entire datacenter...

MechMK1

15:16

Seems like that guy doesn't like PGP and I honestly don't blame him

To this day I still don't understand the purpose of subkeys, or what a "sub-key" really is

Conor Mancone

15:38

@MechMK1 He certainly makes it sound bad. I've never really used PGP though so can't comment much

MechMK1

@ConorMancone His criticisms are quite valid. I am honestly surprized how e-Mail is still a thing

MechMK1

16:01

0

Q: Free Bug Bounty Tutions 100+ lessons - Suggestions Needed

I am making 100+ bug bounty tutorials in my channel hello guys, I have been working as a cyber security engineer for the last 15 years and decided to make easy YouTube videos for most of QA guys to learn 200+ security issues in 30 hours. I will be uploading daily two videos onto a youtube channel...

If his bug bounty videos are just as high quality as his question, I'd say no need to waste that much time

Though imagine a pentest tutorial in the style of an overly loud and obnoxious "YouTuber"

> What's poppin' YouTube? It's ya boi, Zyxx0r1338, back at it again with another video for you guys! This time, we're gonna have a look at buffer overflows and learn how to make easy cash thru bug bounty programs! But first, a word from our sponsor, Raid: Shadow Legends!

And he pronounces his name as "Cy-Zor-thirteen-three-eight"

He's completely made up but damn he annoys me already. Fuck Zyxx0r1338

Fire Quacker

Why were there no downvotes?

It's already pretty close to being spam...

MechMK1

Good that you remind me to downvote him

reed

I hate those videos where people type what they should say in a text editor

That's what that guy does, in his latest videos. But in the earlier ones he was speaking (I guess with an indian accent)

MechMK1

How your Website, Database, Server and Network gets Hacked using ONE Line of Vulnerable COde

►

> 8. Don't share this information with minors / non-professionals who gets attracted to hacking tricks

Also Rule 1 and rule 3 contradict

> 1. Do not test for security issues in any website without permission (from whom?)

> 2. Do not try hack attempts on your account to identify security issues of particular website (only hackers do that)[sic]

What the fuuuuuuuuuck?

Fire Quacker

16:18

I don't know that they contradict. I'm not really sure what the "hack attempts on your account" one even means.

MechMK1

If I have permission, why on earth should I not use my own account?

It seems like it's only a rehash of the first rule

Fire Quacker

Rules 2 and 3 are subcases of rule 1, I think

MechMK1

Just enjoy this one:

How Hackers Really Crack Your Passwords - 25 ways

►

the 3 fps video is art

Fire Quacker

> If you want to misuse this information, then please STOP watching this

reed

now you guys got me curious, but I'm not sure how many minutes I should waste watching that stuff. As a noob I bet I'd still learn something new even if it was crap, I guess

Conor Mancone

16:43

@MechMK1 lol, yeah, I saw that one

MechMK1

18:26

@reed Why not watch proper educational content?

Conor Mancone

@MechMK1 If it is obviously off topic and for a 1 rep user I don't bother with a downvote. I look at downvotes not as a "penalty" but as more of an opportunity for change/learning. The loss of rep hopefully lets the other person know "Someone really disagrees with you - perhaps you should reconsider". As a result I have, in every case, reversed my downvote if the person comes back and reconsiders their position, even if (in the end) they still don't fully agree with me

reed

@MechMK1, of course I should do that rather than watching the above videos (which I haven't watched anyway). It was a half-joke on my noobness

MechMK1

@reed Sorry, I was too tired to pick up on the joke

Conor Mancone

@MechMK1 whoops, sorry, I tagged the wrong post in that reply

That was meant for @FireQuacker and his question about why it didn't have downvotes

MechMK1

@ConorMancone I agree completely. Sadly, I don't have a way of really knowing when someone edits their question in a significant way after it was downvoted

Would be nice to get a notification or such

Conor Mancone

18:32

To finish my thought though: I don't bother downvoting 1-rep users because most of the time they are drive bys, created the account for this one post, and won't come back ever anyway. As a result there is no real opportunity for improvement, so I wouldn't waste the time or the 1 rep lost (not that I even care about 1 rep)

In that case if it is clearly off topic I'll just VTC and then move on to my life

@MechMK1 Well, to be fair, a good chunk of the time I just downvote and then move on. Often though I'll leave a comment, and so I find out if they come back because they usually respond to my comment.

MechMK1

@ConorMancone Yeah, true. Usually, they're like "Uh wtf bro why you downvote me!? Fite me bro I'll kill you

Conor Mancone

Usually I downvote and move on when it is just completely wrong and it doesn't seem like there is much hope for improvement. I've found though that if I downvote and comment then, if the user cares, they'll respond and I'll find out

@MechMK1 :) Indeed

MechMK1

Luckily I am skilled in the secret art of not giving a shit :D

Conor Mancone

@MechMK1 The concept of email is great. It's just the implementation that leaves things wanting. Although given its very decentralized nature, it might not be practically easy to do better

That is possibly the most useful skill a person can have.

MechMK1

@ConorMancone Yeah, I like the idea, but I secretly wonder what's wrong with HTTPS but for e-Mail

Conor Mancone

18:36

There are only a limited number of problems that you and I can fix, but there are an unlimited number of things that can use fixing. It's best if you know when to move on...

Now I have 2 XKCDs I have to post

@MechMK1 It's time for you to fix it then!

Fortunately, the charging one has been solved now that we've all standardized on mini-USB. Or is it micro-USB? Shit.

Hmm... already forgot what the other XKCD was that I was reminded of...

MechMK1

No, fixing something is too much work. If you fix it, someone will criticize you for how you fixed it, and how they would have fixed it so much better.

It's much easier to just make snide remarks about how shit everyone else's work is

Conor Mancone

More fun too

Oh yeah, that's what I was thinking of...

I'm not always as good at not giving a shit as I should be, because I've literally had this exchange with my wife more than once:

What do you want me to do? LEAVE? Then they'll keep being wrong!

ThoriumBR

19:04

haha, yesterday my wife came here asking me the same question, I was telling a guy why having postgres open on the internet was wrong...

MechMK1

19:21

The power of not giving a shit is a mighty one, and must not be used carelessly

ThoriumBR

@MechMK1 If people are wrong and they want to keep wrong, I don't care a bit. No way I will waste time and energy discussing with people that only want to discuss... but if I believe the person is wrong and wants to be better, I take my time. I take A LOT of time...

MechMK1

Oh yes, I know that feeling

ThoriumBR

if the person says "I am sure that...", I don't bother...
"I believe that..." or "I think that...", I usually listen and say something

and when I see people discussing back and forth, I usually say "don't feed the trolls" and the person not being the troll usually understands

Fire Quacker

19:49

@ConorMancone I kind of see what you are saying, but this is a question not an answer. So a) you don't lose 1-rep for downvoting, b) downvotes help it to get deleted faster (which is good because it's almost a thinly disguised advertisement), and c) downvotes send a signal which blocks accounts from posting more bad questions.

reed

20:10

@MechMK1 Isn't that the great thing about pentesting? You are only supposed to find things that sucks, not supposed to fix them

or am I wrong?

MechMK1

@reed That's why I'm pentester

So I can spend my days telling people they suck, without ever having to do it better

I'm an asshole and get paid for it

reed

I basically never downvote because other people's downvotes are usually enough, lol

Fire Quacker

20:29

You're welcome

Conor Mancone

@FireQuacker I didn't actually know that downvotes get factored into blocking accounts. That's definitely a relevant detail

Fire Quacker

116

A: What can I do when getting "We are no longer accepting questions/answers from this account"?

Note: The Help Center contains articles addressing question bans and answer bans. Why am I getting this message? As stated in the tour links on every site, Stack Exchange is a network of question and answer sites, not help forums. This implies that all questions should be objective, answerable, a...

> To avoid bypassing the filter, its internal rules are a secret, but it is partly based on downvotes cast by other members of the communities.

MechMK1

20:57

This is easily the shittiest feature from SE

Because it means you literally have no chance of ever improving

Fire Quacker

Not so

You can fix things

I think people have done it before

Well, now that I think about it, I was going to mention Yvette, but her case was a 20-year suspension, not a post ban

Maybe nobody has come back from a question ban

Back in the old days, Jon Ericson would occasionally work with people to get them back on track

ThoriumBR

I usually don't downvote, but reading this I may change... The absolute majority of my votes are upvotes...

reed

21:18

So this community sets permanent bans based on IPs? Oh my

ThoriumBR

posting from a big company/college with a central proxy and one IP coming out will be bad...

or from North Korea...

Rory Alsop

21:47

@FireQuacker yep - people manage it all the time

The rules are actually pretty good at preventing the majority of folks who are not welcome, without too many false positives

Transcript for