The DMZ - 2021-03-03

« first day (3730 days earlier) ← previous day next day → last day (1140 days later) »

9:34 AM

Good morning!

@FireQuacker What "legal action"? The "white hat" has absolutely no right whatsoever to any money. The company doesn't have a bug bounty program, and no reward was previously agreed on.

That's as if you shovel my driveway free from snow, then demand money from me and then threaten to sue me for not giving you any.

I heavily disagree with the idea that "something you know" and "something you have" are two distinct things. They're more like liquids and gasses. For example, the password Lemonade1 is clearly "something I know". The password K27%=Fj^d?xHQ7KgrBzhZtkn=qU8UB3Z, that I had to store in my password manager becomes "something I have". A physical key is "something I have", but if I know a key's depth and spacing, it suddenly becomes "something I know", because I can replicate it at will. What I am getting at is don't get too hung up on categorizations, as they're not as clear cut as it seems. — MechMK1 1 min ago

^ Your opinion on this?

10:26 AM

@MechMK1 I posted a comment to directly answer your comment. I also posted an answer for the OP's sake.

@MechMK1 Everything thing is actually just something you have. Knowledge is something you have inside your brain. Keys are something you have inside your pocket. Biometrics are something you naturally have. What separates them is that the attacker should have to attack each one of these separately and in a different way.

Basically, It's a guideline. Also, this doesn't answer the OP's question.

@nobody Exactly.

@nobody That is true

Also, I hate biometrics because the problem there isn't "how can I keep it secret" but "how can I make it difficult for the attacker to replicate it"

As in: An attacker can get my fingerprints much more easily than my password, and even more so if you are a PoI

Yeah you can only make them difficult to steal, never mathematically impossible.

But that's not the problem. the problem is once they're compromised, they're compromised forever

if I know my laptop is stolen, I can assume it will be breached and can rotate all my keys

10:29 AM

That's true too

If my fingerprints are stolen, well, tough shit desu

That's why biometrics should never be the primary factor.

Or they should be used only for identification (substitute to the login name).

Oh that reminds me, can you actually get fingerprints off a phone's screen?

@nobody Let me try

In theory yes, but I never tried.

10:33 AM

I can tell you that it works in practice too

I just took my phone as-is and it has a gorgeous, full thumb print on it

All the swipes have partial prints too

So how do phone biometrics counter that?

So if you can steal someone's phone without touching the screen, you can probably get a good print off there

They don't

@nobody Fingerprint sensors are distinct and not on the screen

And yes, they don't

Tap sensor. Doesn't work. Tap sensor again. Doesn't work. Wipe sensor clean. Tap sensor. It works.

The first protection of phones is that they are usually in your pocket or hand.

10:35 AM

So its best to keep biometrics off?

@MechMK1 Which method did you use to copy the print?

@A.Hersean For some people I know, that is nowhere near true

@nobody It's a tradeoff between convenience and security, as always.

Ofcourse the user always chooses conveniance

Well, to be fair, most really don't need that much security too

10:49 AM

@A.Hersean Sticky tape

@nobody I'm pretty sure it has remnant detection

So you probably couldn't use a residual print to athenticate

How does that work?

Residual print detection?

Yeah

Good question. Ask on the site :D

I don't know

Or rather, I forgot

Because I used to know for my PIB exam

Yeah I'm looking for existing questions right now

11:04 AM

9

A: iPhone 5S security: Given someone's fingerprint can I use a 3D printer to create a fake finger with a real fingerprint on it?

Vendors of fingerprint scanners usually prefer security-through-obscurity, so open specifications of the hardware module ("TouchID" in this case) are unlikely available. Apple's firmware secrecy doesn't help. But we can speculate on common features of (good) fingerprint scanners: Capacitive to...

This answer lists the measures fingerprint detectors use, but I can't convince my self they are undefeatable even with just moderate resources

How hard can it be to fake a finger?

(I know I'm probably dumb since no one has done it yet)

Given that this question is 8 years old, it could be outdated by now

@MechMK1 The fingerprint sensor of my phone works through a sticky tape. I can't replicate using a finger unregistered in the phone to push through the tape (with a valid print on the tape).

@A.Hersean Yeah, that's unsurprising. I didn't mean I could defeat the fingerprint sensor with tape

I meant I could steal the fingerprint from the residual prints on the display with tape

Ah yes.

by that point, your "credentials" have been leaked

And at that point, your security no longer depends on the confidentiality of your key, but on the inability of the attacker to replicate it

For all we know, life-like "gel fingerprints" could hit the market tomorrow

Imagine if your password was assigned to you once and you could never change it, and the security of it would depend on the attackers inability to type it

Anonymous

11:20 AM

I remember watching a video about it being somewhat trivial to get prints. But I don't remember the details so perhaps I misunderstood how feasible it is in the real world.

@MechMK1 That's one problem with stackexchange. You can't ask a question saying, "yes this question is answered here, is it outdated yet?"

@nobody Of course you can.

@J-- Getting fingerprints isn't even that hard

Technically you can, practically it will get closed as duplicate really fast

CCC demonstrated how to do it remotely

@J-- I saw someone using a high end Canon or Nikon camera to get a fingerprint from a glass

11:25 AM

@nobody Not if you specifically mention that the current answers are outdated

At least, you shouldn't

But hey, feel free to ask on meta

No I want to ask if they are outdated

Anonymous

@MechMK1 Sorry, incorrect wording.

Anonymous

Not get prints. But get them and then make them usable on phones or really any fingerprint reader.

this is for iphone 5: theguardian.com/technology/2014/dec/30/…

they later used glue and graphene and foiled the scanner

he took a picture from the minister 3 meter away... with today's zoom cameras, you could take a good picture from across the street, or from another building

Thanks, that's what I was looking for. Most method I found used a mold of the finger, and that defeats the point.

Well, one still needs to print a PCB / 3D print the fingerprint. That's not fast.

12:04 PM

25

Q: How can I accomodate custom pronouns in voice acting?

I am currently developing an RPG in which, during character creation, players may choose their pronouns as he/him/his, she/her/hers, or a custom entry based on their own text input. Whenever characters refer to them in dialogue, they will use the pronouns listed as they were typed into the charac...

voice user-generated-content

In all honesty, I find the idea of making three sets of voicelines as "he", "she" and "they" to be more than accommodating.

That's just what happens when you are a minority - you don't get equal resources poured into your representation

Imagine out of 1.000.000.000 people, 499.999 would identify as "he", 4.999.999 would identify as "she", 1 would identify as "xe" and 1 would identify as "ze"

It's unreasonable for those two to expect 100% equal representation.

Let's make the experiment even more extreme, saying ~50% identify as "he", ~50% identify as "she" and 1000 people have 1000 individual pronouns. If we were to record voicelines for every individual pronoun, that would mean 1002 recordings would need to be made, meaning the voicelines >99% of people would get to hear would get <1% of the overall budget.

-2

Q: Encrypted communication system without CPU backdoor that is able to resist quantum computers

This is a process I invented for secure communications to be resistant against CPU backdoors and quantum computers: Personal public keys are transferred in person to each person's offline device. Messages are encrypted on the offline device using the recipient's public key and converted into a Q...

This question is fucking terrible

Did you actually read the "whitepaper"?

You read it?!

Yes

It's fucking shit!

Man you must be really bored

The tl;dr is: Alice and Bob meet in person and exchange a secret key. Alice wants to send a message to Bob. Alice encrypts her message with the secret key and then sends the cipher text to Bob. Bob decrypts the message with the secret key and reads the message.

Aka. Symmetric ciphers 101

His "mathemathical evidence" that it works is that the message space (aka. the number of all possible messages of a given size) is really big

"The number of pixel combinations in a picture is infinite" - Fucking hell

12:20 PM

And I assume, to avoid CPU backdoors, the cipher has to be simple enough to be done by hand?

The paper does not mention which cipher is used

He says brute force isn't possible because the attacker doesn't know what the correct image looks like

Sounds like someone has read the page on OTP and completely misunderstands how it works

@MechMK1 So I can flip one bit in an image, and now its secure?

Because the attacker doesn't know how the original image looked!

@nobody He assumes that every key leads to every possible ciphertext

But the chance of me encrypting the word "cunt" with key k and decrypting it with a different key k' resulting in a valid Windows executable are 0

0

Q: Is a question asking if old answers to same/similar question are still valid acceptable?

As technology evolves, answers to some questions might get outdated. Now, if I see a question which I know has outdated answers, I can either post a new answer, or ask a question which points out why all the old answers are no longer valid and ask for newer answers. But what if I don't know whet...

discussion acceptable-question

Shameless plug for my meta question

Forgive the poorly phrased title

1 hour later…

Anonymous

2:00 PM

What.

Anonymous

The.

Anonymous

Actual.

Anonymous

Fuck. Is this. kodbild.com/mathematics-evidence

Anonymous

what the fuck am i reading.

Anonymous

@forest ^ you'll enjoy this.

2:03 PM

@J-- Also his math is so fucking wrong

Since it's just black and white pixels, its 2^(H*W)

Which to be fair, is fucking huge

But that's not what makes crypto secure

Anonymous

2:18 PM

@MechMK1 Yeah, he is totally clueless.

Anonymous

This line got me: "Do you think that average citizens like you and me are ready to use this kind of invention?"

Anonymous

I nearly fell out of my chair.

Does he say that in the whitepaper or the question?

Anonymous

In the comments of the question. I am yet to read his paper in its entirety.

I think I got an aneurism when I read his PDF

I don't want to call it a whitepaper

kodbild.com/how-does-the-seed-work-and-the-key-work

Anonymous

2:21 PM

@MechMK1 Hahahahahahahah.

BWAHAHHAHAHAHAHHAA

HOLY SHIT HIS SEED GENERATION

Generate a SHA-256 hash, represent it as Hex and discard A-F

MY FUCKING SIDES JUST EXHAUSTED THE KEY SPACE

Anonymous

Wait...

Anonymous

He's

Anonymous

HAHAHAHAHAHA i see that

Anonymous

Is it Computer Misuse if I hack a website to remove misinformation? :)

2:22 PM

It's a moral duty

Anonymous

opens wpscan

kodbild.com/…

also admin is the username

What's WP's password policy?

You see it because they say the password for this username is wong

Anonymous

^

2:24 PM

Awww, admin:password doesn't work

Anonymous

This guy's site is weird...

Anonymous

kodbild.com/obs-studio

Anonymous

Why the fuck has he just got a page dedicated to OBS?

kodbild.com/dhl-paket-und-packchen-deutschland-eu

Anonymous

lol. He has a PO box.

Anonymous

2:25 PM

Johann Fradin - Aubingerstr. 156 - DE 81243 Munich

His fucking Spam Policy :D

Anonymous

@MechMK1 All these random pages, I feel like I'm about to uncover a cult...

> By sending unsolicited, commercial email to any address ending in kodbild.com, you agree to be fined a processing fee of $30 for each email message recipient. If you are using fake addresses in your email an additional fee for traceback and research will be added, depending on the technical and legal effort necessary to enforce our policy. The same fees apply to unsolicited postal advertisings.

@MechMK1 lmfao

Fuck, the website to the heaven's gate suicide cult looks more professional.

He can shove his policy right up his arse. I never agreed to this shit

user image

Sick infographic

Anonymous

2:30 PM

LOL

Anonymous

Stupid question: I got an excel sheet with a column with a drop-down.

user image

Anonymous

I have 600+ items in another column. I need to give them all the same drop down.

Anonymous

How do I do it?

@nobody The fuck is this?

Anonymous

2:33 PM

I have zero idea how to use Excel.

from his wp-content/uploads

Anonymous

What a bizarre photo to upload to your own site...

kodbild.com:2096

user image

shit, wth don't they give the password too?

Anonymous

Think they changed it not long ago.

Anonymous

2:36 PM

It used to give you a password.

Anonymous

IIRC.

Does his PDF mention public keys?

His question mentions public keys

But his PDF doesn't

Only symmetric keys

Anonymous

Who wants to place bets he has at least 5 people tied up in his basement?

Anonymous

kodbild.com/cold-wallet

Anonymous

What is this nonsense

Anonymous

2:41 PM

This is really, really just odd.

Anonymous

The whole thing is odd.

Anonymous

He's also coining the term "kodbild"

Anonymous

"in a Kodbild is infinite"

Anonymous

like what in the world does that even mean...

"Bild" means "Picture" or "Image" in german

Anonymous

2:42 PM

I see.

Anonymous

But what is... "kod"

Anonymous

I don't get it.

I assume "code"

Anonymous

Right, makes sense.

The two words are pronounced somewhat similarly

Anonymous

2:43 PM

So "in a code picture is infinite".

Yes

Anonymous

^^ there is text before that.

I mean really, he discovered XOR

Anonymous

Hahahahhaa.

Like every cryptonoob, he saw OTP for the first time, got a throbbing erection and opened his IDE of choice

Anonymous

2:44 PM

Hahhahahahahahahahhahahhahahahah ^

I believe not a single person interested in cryptography, who learned about OTP being perfectly secure, didn't immediately ask "So why don't we use it then?"

Anonymous

I didn't :D

Anonymous

Oh, I just saw this... This is great, wait.

Anonymous

user image

Anonymous

I'm dead.

Anonymous

2:47 PM

and just fucking used paint to place images on top of them

Anonymous

wait.

Anonymous

i am pretty sure

Anonymous

he just used paint to put the phones

Anonymous

in the hands of a stock image

Anonymous

HAHAHAH

Anonymous

2:48 PM

i cant tell

Anonymous

i think the person is actually holding them

Anonymous

either way its hilarious

The green "OFFLINE" is the best

He just....took the two images, flipped them and scaled them

The same hand is just scaled down

Oh my god

Anonymous

hahhahahahahahhahahahahaha

Anonymous

i cant breathe

Anonymous

2:50 PM

hahahah

Also that sweater looks pretty feminine

I'm questioning Bob's fashion sense

Though to be fair, if my right side was just 25% smaller than my left side, I'd honestly wear whatever fits

Anonymous

lmfao

-3

A: How do you know if the bios has been compromised?

I have been to the dutch police in eindhoven many times because equipment that was purchased in the mediamarkt is being vandalized and taken over by hackers for many years. I have also been many times to the mediamarkt in Eindhoven to return computers and drones that where still under warranty an...

WTF?

I wonder why everybody hangs up on this poor guy.....

Anonymous

3:06 PM

The amount of unhinged people that exist on the internet never fails to amaze me...

Journeyman Geek

@J-- become a mod and you will find so many more

Anonymous

Oh I could not think of anything worse...

@nobody Clearly they're all in on the conspiracy

Anonymous

^ hahah yup

I find it weirdly beautiful, like micro fiction

3:12 PM

I feel bad for laughing at so many mentally ill people today

The Kodbild one is sadder (I think) because the guy invested time and money in and thought he was inventing something amazing

Anonymous

@MechMK1 Yeah, I often feel bad about laughing at them but I kinda' figure as long as I don't laugh in their face, i.e; ping the guy and laugh at him or comment something too mean then it is okay...

At least he isn't a con artist like that Crown Sterling guy

Anonymous

Correct.

@FireQuacker The what guy?

Anonymous

3:17 PM

End of the day, as crazy as his idea is, he isn't profiting from it. Sure, it is harmful to release such an application and call it secure but at the very least nobody is paying for this nonsense.

Anonymous

@MechMK1 You don't know about TimeAI?

Ohh, that!

Anonymous

Yeah, Robert E Grant.

Anonymous

Their fearless CEO.

Anonymous

Who said he had a way of computing prime numbers infinitely then at a conference when it came to the demonstration he decided to only compute with values of below like 100 as it "wasn't the right setting/time to show the computation it can actually do".

3:20 PM

Great demo m8

Anonymous

Oh, then they tried to sue BlackHat.

I'm still amazed that he tried to speak at BlackHat

Anonymous

They paid $115,000 for a place at BlackHat, one of the sponsored talks, they got called out by Veorq and JP for being snakeoil.

Anonymous

Then they tried to sue BH for "allowing the company to be seen in a negative light".

Yeah, i remember

Anonymous

3:21 PM

They even claimed BH paid JP and Veorq to be there specifically to mock them.

Someone got escorted out for calling them out

Good times

Anonymous

Yeah, that's correct.

Anonymous

I actually got into a 2 week long argument with a woman on Twitter about the whole thing.

Anonymous

She refused to accept that it was snakeoil then she mocked my rather technical blog instead of addressing the fact that she was A. totally wrong. B. had little to no idea what the paper actually said or how it worked.

Anonymous

This same woman is also the author of a "for dummies book" and we all know how good those are...

Anonymous

3:24 PM

Before someone calls me sexist, I am not suggesting she was clueless because she's a woman.

Anonymous

It is merely a fact that she is a 50+ year old woman, with not a single day of experience working infosec at a technical level.

@J-- I find the idea that you're automatically sexist for telling a woman she's an idiot wrong

That Kodbild guy is an idiot, and I'm not sexist for saying that - I'm merely a sane person.

If a woman is an idiot, tell her. Equality for all.

Anonymous

Oh, I agree.

0bin.net/paste/…

My Kodbild response

Anonymous

I mention it specifically because she has about 15,000 followers on Twitter and many of them called me sexist for calling her an idiot.

3:28 PM

@J-- Who cares? It just shows how easily people can be deceived into believing bullshit

Anonymous

I don't care per se.

Anonymous

Just a thought that was in my mind when I mentioned her again.

@J-- Some people are just self-absorbed cunts, who think they ate wisdom with a fucking silver spoon

Anonymous

Just checked her Twitter, she is still promoting intelligence agencies and snakeoil on a regular basis. Nice to know some people do not change even when they are proven wrong.

Anonymous

All of this just made me realise that, this industry is actually filled with favoritism and quite frankly... Scammers/imposters. Take her book for example.

Anonymous

3:32 PM

She isn't a cryptographer. She has no experience in cryptography yet she was asked to write a book for "For Dummies", quite a large publisher runs these.

Anonymous

It follows then that because of her name alone she got this position, after all, she couldn't have got it because of her technical or academic position, she has neither.

Journeyman Geek

@J-- Why? I'm pretty sure they'd do it for free

Anonymous

I mean, I kinda' knew that this industry had a lot of imposters anyways.

Journeyman Geek

I mean mock people at cons

Anonymous

Ohhhhhhhhhhhhhhhhhhhhhhhhhhhhhh.

Anonymous

3:34 PM

Right, yeah. No, of course they were not paid.

Anonymous

Robert Grant is just a lunatic.

@MechMK1 Wait... does Kodbild ever actually say the key is to be used only once?

3:49 PM

the more you know, more you realize you knew nothing...

the kodbild guy need a course on crypto first

he know enough to create a product, without knowing why that's a bad idea, and that's dangerous

good thing his site is very amateur and very few people will consider downloading and using his software

4:26 PM

Rats... A "hi grandpa" scammer just called but hung up after my first response. I need to practice sounding like an old man.

I try to waste as much of those scammers' time as possible. I have zero sympathy for scammers who prey on the elderly.

Actually, I have zero sympathy for scammers in general, but I have even less for ones who prey on the elderly, if that makes sense

4:40 PM

@FireQuacker Those "people" deserve a short drop and a sudden stop.

@FireQuacker No

4:51 PM

why on Earth a website loads a ~900kb script to "record performance metrics"?

blessed be the noscript author

there are more scripts than content...

On the kobild guys site?

no, on a popular news portal in Brazil

there should be ~500kb of content (without images) and > 2MB of scripts

way more than 2MB, because one script is almost a MB, and there's at least a dozen

I am still trying to understand what the kobild guy achieves

0

A: Is a question asking if old answers to same/similar question are still valid acceptable?

No. The whole point of the site is to provide authoritative answers. If the answers need to change, then new answers need to be added, not new questions added. That way, even the historically-correct-but-currently-incorrect answers provide context. Plus, the SEO on those questions can remain poin...

looks like the encryption I made in 1998 in VB when I didn't ever heard anything of key, AES, IV, or cyptanalysis...

@MechMK1 Schroeder replied. What do you think?

4:59 PM

I just got the "girls cypher" and automated it...

@ThoriumBR What's that?

it's a substitution cypher used by the girls on my high school...

ohhhh... and everybody knew it?

it's the simplest substitution cypher possible, where one letter maps for only one other letter... so if X maps to T, T maps to X...

Caesar cipher?

Nope, I'm wrong

5:03 PM

@nobody I was on 7th grade, and the girls on the morning classeswrote encrypted messages to the girls on the afternoon classes... nobody knew I knew the cypher because I knew the names of the girls, so I could deduce a couple letters

within a week I had the entire dictionary, and after a year I told the girls I knew everything they were writing

lol

you write the letters A-Z on a circle, and draw lines connecting one letter to another, so every letter is connected to only one letter

In 7th grade, I came up with a slightly more complicated cipher (I forgot the details of how it worked). Then I found out I had nothing to encrypt

if there's only one CAMILA on the group, and a message starts with 6 letters, and the second and last letters are the same, I was pretty sure the encrypted word was CAMILA, and I had a couple letters on the dictionary... with 3 or 4 messages I had pretty much everything

Nice, looks like you're a natural cryptanalyst

5:07 PM

so I used that cypher to create my own crypto system... it was clever (for me), but it wouldn't resist Kerckhoffs's principle...

@nobody FYI, Stack Exchange announced that they are going to study the problem of outdated answers: meta.stackexchange.com/q/361097

the idea was to mix that cypher with another scheme where the first letter was a valid letter, the second letter was coded to say how much letters you would ignore, then that number of letters of random garbage, then the next valid letter

so if you would write HI, and that mapped to ZK, you would write ZBHEK (where Z is mapped to H, B means skip 2 letters, HE are garbage, and K maps to I)...

@FireQuacker yeah, somebody downvoted and commented an answer of mine from 6 years ago, when I recommended going from salted MD5 to salted SHA for password storage

@FireQuacker Thanks, I didn't think of checking MSE for this. Looks like all the sites figure out a solution for themselves.

1

Q: How can I improve my sheep dipping process?

Problem: The hiring department occasionally sends me Word documents asking to clear the file as "safe" to open and review for purposes like resumes etc.; they can come from anywhere and are often unsolicited job applications. Based on the cornucopia of Word exploits out there and my relative inex...

hardening quarantine

what about sending me the files, and I sanitize them for $5 each?

"send me the files, and receive them back sanitized. formatting may not be preserved, images and tables may be on wrong positioning"

4 hours later…

8:51 PM

7

Q: Are ads on YouTube asking donations for sick children via drove.com a scam?

The past few weeks YouTube has been showing me advertising asking to make donations to help pay medical bills for sick children via a crowdfunding site called Drove. However, the ads look very suspicious. In one example, a child called Tovi in a hospital beds talks in a Slavic language about bein...

scams online-payment donation crowdfunding

Found a new low today

1 hour later…

Anonymous

10:08 PM

@MechMK1 Yikes...

« first day (3730 days earlier) ← previous day next day → last day (1140 days later) »

Transcript for

Mar '213

The DMZ

A serious place where infosec is discussed PS we don't do hard...

404-errors moderate-anarchism pretending-to-work staring-into-the-abyss

join this room
about this room

00:00

06:00

12:00

18:00

all times are UTC

site design / logo © 2024 Stack Exchange Inc; legal

mobile