@MechMK1 Not anymore because I deleted mine :) I really thought that the OP was referring to breaking into someone's account, but there was a comment about using login CSRF to get the victim to login to the attacker's account (which it could be used for). I read through the OP question again and saw that this is indeed what they were referring to, so my answer was invalid

Login CSRF in this case isn't much more than a poor man's session fixation attack, which is pretty darn low impact, but still technically has an attack vector

Can't decide if I should put my answer back and make it clear that the impact here is very minimum, or just leave it as-is. Considering that the OP was asking, "Is this login CSRF?", I'm not sure if my answer was very helpful regardless

@ConorMancone How so?

@nobody Which part? How is it a poor man's session fixation, or how is there still an attack vector?

poor man's session fixation

It may not be the best comparison, now that you're making me think it through :) But... Usually with session fixation you get the victim to use your session. Ideally this means that they then login and so you can pre-steal their session and gain access to their account.

A lot of times though session reset on login means that you can't fix the session and then keep it once they login. As a result the best you can do is login yourself and then get them to use your session, logging them into your account.

(kind of a reverse session fixation)

Hmmm... going the phishing way with this would probably get you better results.

Yeah, but it's still a stretch

Getting them to store card info in your account is a bigger stretch than phishing

But if it gets you a bounty, it doesn't matter how much of a stretch it is

Goodness, hacker one gave out a $500 bounty for someone who identified a login CSRF on hackerone:

hackerone.com/reports/834366

The researcher gave the same "motivation" as I explained above

Doesn't seem like a $500 vulnerability, but :shrug:

Yeah but in this case, if you get a researcher to submit a bug through your account, you will receive the bounty

That's the problem with bug bounties

When I started my job as pentester, I signed an ethics agreement, which among other things, stated that I must repost vulnerabilities to the best of my ability - and neither over- nor understate their risk.

But with bug bounties, you're incentivized to blow everything out of proportion. Imagine how many people saw Server: nginx/1.18.0 in some response header and tried to sell off the vuln as high impact information disclosure

@MechMK1 This counts as a vuln?

No, but that doesn't stop people from reporting it as one

When I see information discloure like this, I always report it as low-impact finding. Like "Yeah, you're giving the attacker unnecessary information, but disclosure of the version info itself isn't really a vulnerability"

It reminds me a little about the guy who spoke about bugs in Firefox

He reported several bugs, and they were all just closed after a while due to "inactivity". Mind you, not him being unable to provide information, but the Firefox devs not responding.

That's one way to get the number of open bugs down: Just close them.

According to him, the other was to only accept security relevant bugs. And so, people marked every bug as security bug.

Then they said only critical security bugs. And so, people marked everything as critical.

@MechMK1 Disclose the bugs on twitter and they will get patched really fast

Or so I've heard

@nobody It's not just security bugs, but also other bugs

For example, VLC Android has a bug that the media controls on the lockscreen just disappear. I don't know what exactly causes this, but once disappeared, only forcing the app to quit completely and re-opening it gets them back

Has been reported, nobody cares

@MechMK1, I found a bug in YOURSELF

how do I report it to you?

@reed Here

What's the bug?

Is it on my shoulder?

Actually, It was a joke that it's not really a joke. If I wanted to tell you something in private, what should I do?

@reed Well, you can use gpg if you want

@reed my public key is

-----BEGIN PGP PUBLIC KEY BLOCK-----

mDMEXfJDORYJKwYBBAHaRw8BAQdAm+kQLxeFhkxuh6aE2OYsxlBRF9NQOF02gSvI
etGJNH+0B01lY2hNSzGIkAQTFggAOBYhBDmpLDBVjB7g6b8a4mT1YIbwyyxaBQJd
8kM5AhsDBQsJCAcCBhUKCQgLAgQWAgMBAh4BAheAAAoJEGT1YIbwyyxaIKMA/3g2
6T7KzCq0wMLUFPbCGnxPxeI/a/79xH584aadFBwWAQCI7dttW+GoWxSUdQIF26W/
REPeIofZcQ/8GnVq9lcyDrg4BF3yQzkSCisGAQQBl1UBBQEBB0Bjzd0Y8gY6jZ1O
znjKuCFDK/ouZ5SPD6OgnE4YP+bUZQMBCAeIeAQYFggAIBYhBDmpLDBVjB7g6b8a
4mT1YIbwyyxaBQJd8kM5AhsMAAoJEGT1YIbwyyxa79AA/2tYyq6s8uFj/SWw+qf1

Ctrl-D to end the message

Or just use a GUI client like any sane person living in the modern era

You mean that I should encrypt the content and then paste it here?

@reed Yeah

Could ask for chat.stackexchange.com/rooms/info/101773/gpg-garden to be unfrozen

We could, yeah

But if it's just one message I think it's fine

It's not like we'd spam the whole DMZ with gpg-encrypted messages

@MechMK1, ok, it's not that important or secret though, but encrypting it here could be fun, lol. It'd be the first case of "encrypted off-topic". It's just something I wanted to tell you, but I am not sure if it's ok to say it publicly. So I'll think about it, maybe write something, encrypt it, then paste it somewhere for you. I would actually want to go for a walk now

@reed Man, you're making me nervous now :D

@MechMK1 that's why my ssh banner literally is Windows 9 OpenSSH-Server 3.11v95...

@ThoriumBR Make a Touhou fanboy squee by setting it to Windows ⑨ OpenSSH-Server 3.11v95

@reed steganography guys... post a meme with the message embedded...

aaaand I got over 40k points!

Congratulations, m8

@reed That's not the 1st case of "encrypted off-topic" here.

@A.Hersean Yeah, forest and I had that

Which is why the GPG Garden came to be

It is still technically against the rules

But it wouldn't have been the first time

is tinychat.com still a thing?

yep, still online... create a room, post the link here, encrypt everything and send there

@ThoriumBR Congrats, although I thought people with >~25K stopped caring about rep :)

@nobody Actually sooner. Site analytics don't really matter to a lot of people

sure, after 25k there's nothing new... I am looking forward to 65536

I think 10k was the big one for me

Because I can see deleted stuff

32768 went by and I didn't noticed

And that shit is the best part of SE

Yeah I'm aiming for 10K too.

yes, deleted posts are funny sometimes

then I guess I'll stop

A big spike in votes near the 24th of november

I wonder why

We could start a similar process that is common on social media: exchanging votes, like exchanging likes. I ask a stupid question, then you guys all vote it and answer it. Then we all vote each other's questions, and so on. Lots of points in a few days. StackExchange hacked!

We must wait until Schroeder is on vacation though

I read an answer first and make sure not to read who it's from

Just to ensure I'm unbiased while voting

Depending on the financial state of SE, you could get a swag package when you reach 100k

Fuck yeah, merchandise from a company I deeply hate

What are you talking about hate for? This is FREE stuff

Sure, treat everyone like fucking garbage and then give a select few people socks and a T-shirt

I don't care what the logo is if they give it to me for free

I don't have to wear the shirt in public

and right now, "in public" means in front of my wife and kids...

When political organizations I don't support send me mailings, I will happily keep any pens or stickers. The jokes on them; they're wasting money and I'm not changing my mind.

@FireQuacker Now I am halfway tempted to send you a SS uniform, just to see if you'd keep it

Imagine a company that sells the most angelic t-shirts you've ever worn. Like just touching the fabric will make you fill endless bliss. But the flipside is that whatever is printed on the front is just absolutely horrible. Pictures of mutilated children, animals being tortured, etc. etc.

Jesus, sometimes I wonder what the fuck is wrong with me

I think the same...

@MechMK1 You're a hacker, MechMK1

I am a hacker too, but my imagination is not that dark

I have a system, you're looking for vulnerabilities

@MechMK1, I'm going for a walk, I imported your key and I'll write something to you later, encrypt it and past it on pastebin.com (unlisted, expiration after 1 day). BTW pastebin now has password protected pastes, cool (but nothing beats GPG of course)

@ThoriumBR Something in my brain is seriously fucked and to be honest I don't even want to begin debugging it

But hey, at least we're having fun :D

@MechMK1 it can be changed... thought patterns are only neural connections. thinking on different subjects can reconfigure the connections

@MechMK1 Here merchandise about fascism is actually sold and some people collect it

I would actually accept an SS uniform, it would be cool stuff to wear for fun, trolling, comedy, etc.

Recently there was a bit of a scandal because a politician sung an old fascist song on a radio program, so I found myself singing it too lately, because it's catchy and there's also a dance version, lol

@reed Didn't you wan to send me something?

@MechMK1 yeah but I needed to finish writing it, now I'm done

@reed nice

@MechMK1 apparently I have a problem (might be a conflict in my distro) when encrypting using the key that you pasted here, but I think I can encrypt it with your rsa4096/D284BE8A key

@reed Not sure if this is the same key, but I have this rsa key

-----BEGIN PGP PUBLIC KEY BLOCK-----

mQINBF3uO8EBEADrTi5iIb/zgAm1UwT62DHXhEvOjhFktW3JdmWrUTDS96If5SFE
LYxxCoVd3cE6Cg3Qi8g81UDYYLvR5hL8vtrkAjMzmYWXzbG2AAW7zqmcvGglpHl5
Ee2HJUywts+X+pcfpKVUPS6Z/6vF0i0S5OaxQ6RnlhZX+49lFdGbZ6qU8xGXnItK
NtOIW3ST0+4aK+u4JfWT5r6/Kq7RhcjiRXXfSWPJqbmRjA+eUY0quBLyh7X71rQB
jMDDBvz2xyCCMfyDxeJ/2oY5kLduez8aG1um0TaznKQ6ADAE4QnxJ1uc52W4HPpN
AdHtBBMOlpXmCEyoTcYmmgQNfwGVdGO+QsvxgrsZ1P8CeWug6vviVL2Uuexl0pCz
tCMF8QBnQNjJ8oE/r2Ev2EPfwuwr/e1+4detlYDZejHOIZvjcCCUf5C9K1muCmfI
rkKUwO6q+gny6/xEEHBo+vTSxkwDzok5kX5/iqa5f+8hRBYZCmm73ArclOsU5Guo

yes, it's the same, I got it from your website

Honestly surprized me that that one is still valid

I tend to lose my keys a lot

pastebin.com/dDiTsQ1K

@reed Yes, I am aware of this and some people here actually know my full name

I don't treat this identity as "anonymous" and consider that anything I say here can and eventually will be connected back to me

ok, good

One thing I do always stress is that my views I present here, on SE or elsewhere are my personal views and in no way related to my employer.

I never state who I work for, but knowing where I live and what I do for a living (which both can be inferred through publicly available information), it will not be too difficult to figure out who I work for

I consider myself "MechMK1, that one dude from the DMZ" and not "MechMK1, an employee of _________"

I always find it funny that people say that, I mean, saying that "my views don't reflect those of my company/employer".

@reed Well, in the current political climate, people are very quick to say "Hello <company>, did you know your employee holds <these views>!?"

The only policy in regards to what I am able to disclose publicly is our document disclosure policy, which states that only information that is classified as "Public" can be disclosed publicly :D

But that is mostly for "Don't talk about the cool vuln you found" and not "Don't be right-wing on Twitter"

Yes, but stating that your employer or company doesn't necessarily share the same views, won't change much, will it?

@reed No, but I also don't want people to think my employer tells me what to say

Because as long as I don't disclose confidential information, my employer could not give less of a fuck what I say

"Who are you going to vote for? I don't know, let me ask my employer" LOL

I wish I could say that this is just fiction

But there are companies out there that are like that

I know

My grandfather tried to pull this, wanting my parents to take pictures of whom they voted for

Both refused to do that, and that created quite a fight that lasted for weeks

Anyways, if I need a fake identity, I pick a name generator, generate a first and last name, then pick a fake face and let's go

Hi, my name is Benjamin Greene

I've always had issues with anonymity, online identities, etc. On one hand, if you want to be somebody, you need an identity. On the other hand, if you want to be free to express yourself, you need to be as anonymous as possible. That's my view, but I understand not everybody agrees

Here comes Thomas Campbell

@reed That's why I have several accounts which have no connection to me at all

are those pics AI generated, or stolen at random somewhere?

thispersondoesnotexist.com

oh ok, that site is cool

AI generated. You can see it well in "Thomas"' shirt

Pretty easy to spot if something is AI generated if you know what to look for

And generating some fake names is very very easy. There's lots of "name" generators out there, which even ask for nationality, date of birth, etc...

The easiest givaway is that the background is usually extremely blurry

Earrings are also a huge problem for the AI

Glasses work...sometimes

Sometimes not

The AI hasn't quite figured out that the "has glasses" vector is an absolute. You have to be on one extreme - you can't have a bit of glasses

Because that ends in disaster

AI is still too stupid

Also 2 people in one image...nah

Two people usually means that the AI is going to go completely bonkers

but I believe one day they are going to take a huge leap forward with some new discovery, like, merging images with semantics, then AI might start to understand what glasses are, what they are used for, etc.

@reed We already made one huge leap

We learned that these vectors are actually vectors

You can add them and the result is what you expect

So you can add the "is man" vector to "has glasses" and you will get a man with glasses

Here's an example where glasses work correctly

But here too you see that the background is just empty

Here the person itself is generated fine, but the background is a horrible mess

This picture would be unusable

Even a casual glance at the picture would raise questions

Whereas the one before is "Random tech company employee #7230598"

these might be AI generated, and therefore not exist in theory, but I'm sure in practice there are several people who look like that, so in practice these people do exist, LOL

Yeah, certainly

But the tech company dude, even if you I would be tasked with telling whether or not this guy is real...I wouldn't know

But just a few minutes on that site and you will have a collection of faces that would all pass casual scrutiny and some even more focussed scrutiny

Too bad I compromised the tech company dude, that is an amazing picture actually

Could have easily passed for a Senior ISMS Consultant with various certifications

I once used one of those faces to create a fake Linkedin account, but it was suspended pretty quickly

Why do you think that is?

But I don't think it was the picture that was suspicious. It was probably all the bullshit I put in the CV/resume, total nonsense

Probably, yeah

I mean, it reminds me a bit of the SIN system in Shadowrun

A SIN (System identification Number) becomes more valuable, the better "curated" it is

I'm also not sure if it was suspended by a human moderator, or something automatic. I'd guess it was a human, but I can't be sure

Makes you wonder how they flagged you

Like, a rating 1 SIN just has a random person. Random age, nationality - just nothing. That's as if I would try to pass as a 78-year-old chinese woman

Rating 4 is "casually plausible": Sex, age and nationality match, supporting data seems valid on a cursory check

Rating 6 is basically an alternate life: All statistics match, valid biometrics, samples, believable history, etc...

The more time you put into a fake profile, the more believable it becomes - but also, the more effort you have to put into maintaining it

The only thing that bothers me about fake accounts nowadays is that you often need a phone number. Facebook asks for a phone number, I'm pretty sure

Yeah, getting a prepaid sim isn't that easy anymore either

Here, since 2019 people need to register themselves when buying a prepaid sim

Yada yada anti-terror and all that shit

You could literally tell the fucking ministry of interior that a guy is a terorrist and they won't do shit

A SIM card in my country requires personal identification (with documents). Maybe I could get one anonymously from a foreign country, not sure if possible. Otherwise, well, "they say" immigrants here can sell SIM cards in front of the train station, you know

If I wanted to buy an anonymous sim, I probably could

The thing is, the black market is a weird thing

You come to buy an anonymous SIM card and a burner phone so you can shitpost on Twitter

And you leave with a SIM card, a burner phone, a kilogram of weed and a machinegun

VOIP numbers might be an option too, but I'm not sure if there are providers that you can fool with fake personal data

that is, they will give you the number without needing any documents, etc.

Stupid story of the day: yesterday I went to a porn website and saw that there were live cam shows for free. I entered a room, and I was wondering if those girls were actually streaming live, or if it was the usual trick (recorded video)

there was a chat, and the girls seemed to react to the chat, when somebody said "hey how are you", the answer would be "I'm good, thanks", just as an example

I mean, they answered by voice, to what was sometimes being written in the chat. Looked real! But I was still curious

After all, they could have recorded a video, and then programmed a chat in sync with the video. So I wanted to say something too, but I needed an account. I usually pick something like mailinator for throwaway emails, but it's usually rejected: "please use a real email!"

I don't know why, but there is another well known provider of throwaway emails that actually works most of the time, so I used that and I get an email to activate the account. Guess what? The activation link in the email did NOT support HTTPS

everything was HTTPS (I use HTTPS-Everywhere), the website is one of the major porn websites, everything is HTTPS BUT the activation link. That's unbelievable. I refused to activate the account. That's all, LOL

@reed The whole point is to curb anonymous registrations. I'm sure if you know where, there is a huge market for anonymous phone numbers

and that's quite the story. Was the registration link pointed to a different domain?

@MechMK1 I don't remember, but I guess it was a subdomain

Very weird

I've stopped watching "live" pornography and instead subverted a group of hentai manga artists and subtly influence them over the course of two years to get them to draw my fetishes more. They won't feel like they're being pushed, but rather like it was their own idea

Now they will draw my sick and twisted kinks like "romance" and "true love"

I've never been interested in cam shows, I was just curious to see how it works. I just don't understand how some people can pay for porn

@reed Would you like to know?

Until recently I didn't even know that people "tip" the girls, and the more they pay the more a "toy" vibrates in the girl's vagina

There is quite a lot of psychology involved, actually

that's insane, I mean, lol. Why do people even pay for that

For that specifically? I would guess the novelty of it

Most camgirls build parasocial relationships with their viewers

there's a lot of free porn, and I, as a good old pirate, keep on enjoying free stuff

They give "pretend care" in exchange for money

or maybe I'm just poor. If I was rich, maybe I'd waste my money for that too. But I'm not sure those people actually have much money to waste

A lot of the guys who pay for that genuinely believe that if they just "keep at it" a little longer, she will "eventually realize his feelings for her" and she'll fall in love with them

No, they don't

To them, it's like an addiction

Because in real life, they have nobody who cares about them and gives them affection

The perverse thing is, a lot of people know that it's a parasocial relationship, but to them wasting thousands of dollars every month merely to hear someone say "Oh thank you for your donation, you're such a sweetheart. I love you so much!" is worth it

As for other forms of pornography, the above mentioned hentai manga is usually bought to support the artist

There is even a porn category (actually, a sexual deviation) that is called "financial domination". It's when you like girls that demand money from you. One of these days somebody will probably also invent "cyber domination", and guys will have orgasms when girls attack their computers

Oh yeah, I know about findom

A friend of mine recently upset a bunch of them by calling them "glorified e-bums"

Since well, it is the same profession. Their job in society is to beg for money, and make people feel good for giving away money.

"Oh yeah mistress, please, keep sending me infected attachments in my email, oh yeah, yeah, what a nice office macro you sent me, oh yeah"

> My port 445 is wide open for you

Actually you know what, I will do that

do what?

Cyber domination

CyDom sounds great, doesn't it?

Tell my subs to put some BTC in a wallet on their machine and I will hack them

If they throw in some extra BTC, I'll even record my screen as I do it

yeah, but it only works if you are a girl

I'm sure there'd be some gays out there who'd be into that

And if that doesn't work, I look great in a maid uniform

although now that I think of it, there's some AI that can turn your face into a girls face

some youtubers have done pranks with that AI

Nah, I'll do the real deal

I can still do good enough voiceacting to immitate a woman

alright, maybe it's time for me to go. See you around!

See ya