The DMZ

7:50 AM

@ThoriumBR they already control us very well - see conversation around the algorithmic nature of what Facebook etc feed you

A. Hersean

9:13 AM

Wow, I did not expect my answer to security.stackexchange.com/q/238625/127837 (who started as a one-line comment) to gain such a momentum. I should write more often in a blunt controversial fashion, without using "YMMV", "may" or "in most cases".

Rory Alsop

9:31 AM

@A.Hersean it's an interesting answer. I'm not sure I agree...

A. Hersean

For me considering localization as a an authorization factor is a principle. A default set of mind. Then, one have to think outside the box and adapt to the considered use-case and threat model, as usual. But it's a good guideline, or frame reference, to spot inconsistencies or vulnerabilities in the architecture. It makes you think of the good questions.

So even for me, I would not agree with my answer in 100% of the cases. But certainly in most of them.

Rory Alsop

10:22 AM

I see where you are coming from, but I would class it almost always as a week auth mechanism

for example - you make a transaction in the UK then an hour later try to logon in Australia - it's not going to be you :-)

MechMK1

@A.Hersean Am I the only one who considered "somewhere you are" as like a literal geographic point and not like a broad area like a country by GeoIP?

A. Hersean

11:43 AM

@RoryAlsop In fact, for me it happens a lot to be refused to authenticate or to receive security alerts, because the geoip is so crappy. Between my home connection, my phone connection, my work connection and my VPN connection (all in the same country, the VPN is just in a VM to separate my personal browsing from my work, and it tunnels the connection to a personal server (always the same) hosted in my country).

Often at home, and always at random times, google/youtube think I'm in a Russian speaking country and switch my interface to cyrilic unreadable (for me) verbiage.

It might make sense for banking cards to use it in an authorization filter.

But for internet stuff, it's a poor idea for authorization, and worst for authentication. Especially for those using VPN with virtual localization that change at each connection.

* the geoip database

@MechMK1 The definition of "somewhere you are" is blurry, this help confuse the discussion, because different people argue using of different definitions of the term, without noticing the ambiguity. Basically, they do not argue about the same concept, or the same use-cases.

MechMK1

@A.Hersean That definitely doesn't help discussion

A. Hersean

The comments of my answer are filled with trolls that do not notice they are trolling.

Since I do not feed the trolls, I do not intervene.

Rory Alsop

@A.Hersean Most of the comments are from people who are definitely not trolling, but have a different viewpoint to yours. Which may be equally valid.

you say it's mostly authorization. Others say it's mostly authentication.

I'm probably in the latter camp in general, but then for the last 20 years I have mostly worked with global banks, and large corporates, where it falls better into the authentication camp

A. Hersean

Some do not agree, that's OK. I talk about those that contradict themselves or how they argue between themselves.

Rory Alsop

So I wouldn't rule those comments out - they arejust from a different perspective than yours

A. Hersean

11:55 AM

But we might also have different definitions of trolling ^^

Rory Alsop

@A.Hersean hmmm - also possible

A. Hersean

Those are definitely benign trolls in my very broad definition of the term.

MechMK1

I'm this weird category of troll where I don't even know if I am trolling or serious

I just ironically post well-researched and on-topic answers

A. Hersean

@RoryAlsop In banking use cases, I can see why it's used as an authentication factor, because one cannot travel faster than a plane and you can have strong confidence on the accuracy of the localization. But that's a very specific case.

Rory Alsop

@A.Hersean in wider corporates as well, it is used as part of auth. For example, if you are not in this building/room/whatever, then I don't believe you can be you

A. Hersean

12:02 PM

Depends on the specifics, but I would argue that it could be you, but you are not supposed to be there.

The thing is, often authentication and authorization serve the same purpose : deny access. So it's easy, and often convenient, to mix them.

But when you can authenticate then deny, you can also log with more details.

So it is often useful to distinguish the two, if only for this reason. At least in my work were often we require strong logging and accounting of security events.

MechMK1

The easiest distinguishing for me is AuthN = Who are you?; AuthZ = What can you do?

Conor Mancone

12:36 PM

@MechMK1 The rule of MechMK1: he posts good answers because he's a toll trolling trolls.

MechMK1

@ConorMancone I still think the best troll post I ever made was the spongebob one on workplace :D

Conor Mancone

That one was amusing :)

MechMK1

Sadly, it was the peak of my comedy

Everything else pales in comparison

At least it was high effort

Conor Mancone

It's always so sad when your best moments happen so young :(

Might as well just get a job at McDonalds and wait for the end now...

MechMK1

They say if a mathematician doesn't do their great work by age eleven, they never will.

Conor Mancone

12:48 PM

lol

MechMK1

I mean it's basically what I am doing :D

I can't wait to show my kids my shitposts, should I ever have any

Kids, I mean. I know I have shitposts

reed

1:38 PM

what's the difference between shitposting and trolling. Or a flame?

According to wikipedia, there's not much difference

Maybe it's an umbrella term to define posts that are basically shit

but some shit is good

MechMK1

1:54 PM

I mean, the terms are used loosely

A. Hersean

@reed Are you thinking about 2girls1cup?

MechMK1

A "shitpost" used to be a post that contributes absolutely nothing and has very low quality

The intent of a "shitpost" - in that classical sense - is not necessarily to distract or troll, it could just be someone who can't contribute anything better

A. Hersean

I think "some" and "good" are subjective...

MechMK1

I don't think "some" is subjective

"some" refers to any quantity more than "none" and less than "all"

Trolling on the other hand is very much defined by its intent.

A. Hersean

Well... I don't think... at least I can't think anymore, it's Friday.

MechMK1

1:57 PM

A. Hersean

@MechMK1 I disagree, some trolls are oblivious to what they are doing.

MechMK1

@A.Hersean Then I don't think you're trolling

A. Hersean

Not right now, indeed.

MechMK1

Some people are just genuinely stupid

A. Hersean

yeah...

MechMK1

1:59 PM

I think trolling requires an intent, you can't accidentally troll.

A. Hersean

Then, there's Trump, who is both a dumb troll and a clever one.

He might be the ultimate troll.

MechMK1

Reminds me of a guy who said he wants to decrease his kg and increase his lbs, because all the fit guys have higher lbs than kg.

The response from Anon was: "I can't tell if you are trolling or genuinely retarded"

A. Hersean

Correction, he would be if he asked to be called "they", instead of "him", not because he would be non-binary, but because he would view himself as a king and should be addressed in this fashion.

MechMK1

@A.Hersean He would be if he was claiming to be transgender after being elected so he could be the first female US president

A. Hersean

However he is too much of a white male supremacist for this to ever happen.

MechMK1

2:04 PM

So am I and I would do that immediately just to dab on Hillary

I wouldn't even change anything about me, just wear the same clothes as usual, grow my beard out, but demand everyone to call me Miss President

Or insult someone on 4chan and then mention my tripcode in a press conference

A. Hersean

I know you are, but not to his extent. He refrains for obvious racist, fascist or chauvinist comments, but his lack of comments on those topic and his actions speak for himself.

MechMK1

I still don't quite get how trump is fascist. Can we please define what "fascism" is in this regard? Because the fascist manifesto by Mussolini calls for:

- Universal Suffrage
- Proportional Representation on a regional basis
- Voting rights for women
- An 8 hour work day for all workers
- Minimum wage
- Participation of Worker's Representatives in the functions of undustry commissions
- Support of Labor Unions
- Reduction of the retirement age to 55
- A peaceful but competitive foreign policy

I mean, call me a fascist, but I don't see anything wrong with any of these points

Because I honestly feel like "fascist" has become just another word for "someone I don't like"

A. Hersean

I use the common definition of the term, not the original one. Same as when people calling USSR's ideology "communism", when in fact its application was very far from what was envisioned by Karl Marx.

MechMK1

@A.Hersean Well, they called themselves that. Just like Cuba, Cambodia, China, North Korea...

A. Hersean

That is, I'm using the journalistic/trollish definition (unless the original one should be the trollish definition??).

MechMK1

2:15 PM

@A.Hersean What is the journalistic definition?

A. Hersean

Because, as I said, it's Friday, and I stopped thinking.

MechMK1

I'm a bit worried about this trend that anything can mean whatever I want. A fascist is whomever I declare a fascist, a Nazi is whomever I declare a Nazi.

A. Hersean

@MechMK1 The one almost everybody keeps referring to while not really knowing what they are talking about. Basically, the common journalist does not know what it is talking about, but still talks as if it is an expert.

MechMK1

@A.Hersean So basically, a "fascist" is anyone I declare a fascist, and I know what I am talking about

A. Hersean

Since you know what you are talking about, it means your opinion does not matter because it will not be heard. You must not know what you are talking about to call someone a fascist, nazi, feminist, ecologist, etc. At least that's the rule for Fridays and for newspapers.

and twitter

MechMK1

2:26 PM

Oh don't worry, I have so many things I don't know about and still talk about confidently

reed

3:15 PM

I thought "fascist" was only abused as an insult in my country

looks like it's now a wordwide trend

it has basically become a synonym for "arrogant". OMG, you are telling me to shut up, you are a fascist

A. Hersean

Instead of putting the "ADHD" label on lazy people, I should start using acronyms that no layman understand. Like "you're just a CSRF non-gender-specified-person!".

"How can you say that! That's so wrong! He's clearly an XSS!"

"No way, I thought he was a transient unserializable..."

reed

stop being such an office macro in the neck

A. Hersean

I guess I'm pretty badly affected by the EOW syndrome today... (eow = end of week)

reed

yeah, you know when you don't feel like doing anything at all, you open youtube, and the home page suggests a video from 13 years ago: "Man destroys computer"

I know I need to click on it

MechMK1

3:30 PM

Am I the only one who just calls people asshole if they act like one?

A. Hersean

yes

Do you feel alone now?

I can offer you counseling for 25€/h.

+ taxes

MechMK1

No thanks I rather just shitpost in the DMZ

I can do that for free