The DMZ

Terry Chia

15:01

@RoryAlsop What's the word on my QOTW post?

Rory Alsop

15:16

@poly and @Terry - I would imagine we will carry out a certain amount of normalisation once we get the final results. I guess we set the targets a little too high.

Thomas Pornin

It is HARD to send an executable to a customer these days.

Polynomial

@ThomasPornin I misread that as "It is HARD to execute a customer these days".

Thomas Pornin

The filters at my workplace remove executable files from emails.

gmail refuses to send executables

Terry Chia

zip it up?

Polynomial

it examines files in zips

Iszi

15:17

@TerryChia Lots of filters look inside ZIPs.

Thomas Pornin

Hotmail classifies my emails as spam because my email address contains a "forbidden word"

4

Terry Chia

password encrypting the zip files usually work for me.

Polynomial

^

@ThomasPornin zip within a rar within a tar? ;)

Thomas Pornin

@Polynomial Actually the filter which removes executables also removes Zip files altogether

Polynomial

or... A SPLIT RAR xD

Iszi

15:18

If your customer has TrueCrypt, try that?

Terry Chia

woah.

Thomas Pornin

@Iszi Hey, he is a customer. He does not understand technology beyond flint stones.

Polynomial

@ThomasPornin The gmail one examines the files inside the zip files, to a huge number of nested zips

Iszi

@ThomasPornin Too bad TrueCrypt doesn't provide a way to send self-decrypting EXEs.

Thomas Pornin

@Iszi Well, if it did, I would be the first to say "don't open them, stupid !"

Polynomial

15:20

@Iszi If it could, the exe would be stripped ;)

Iszi

@Polynomial Oh.... right... duh.

Polynomial

just send him a passworded zip

and say "sorry about the password, our mail filters are a little strict"

Rory McCune

@ThomasPornin uuencoded exe ?

Polynomial

trololol

@RoryMcCune base64 it!

just send him the sourcecode and a tutorial on how to use gcc.

Jeff Ferland

Yes! Base64 encryption!

Thomas Pornin

15:21

@RoryMcCune Hey... I am halfway coding a base64 encoder in C.

Jeff Ferland

vomit

Polynomial

@JeffFerland heh, I'm always amused that people think that just because they can't open a file with notepad and read it, it must be encrypted.

Jeff Ferland

"We use base64 encryption”

Terry Chia

Trying to learn TeX now. Interesting to say the least.

Rory McCune

well if they're using a modern version of windows it'll be available and IIRC has Base64 encode/decoding :)

power shell that is

hmm sorry for any dupe posts I'm on a train and the wifi is a bit spotty

Polynomial

15:25

what-if.xkcd.com/10

haha

"London sits in a steamy jungle straddling the equator, with a climate generally resembling Manila's. The food is still bland, the Thames is full of piranha, and it's the only place on Earth where tigers apologize as they attack you."

Terry Chia

How long does it take to award badges? I got Civic Duty and Suffrage today, but was not awarded Vox Populi yet.

Polynomial

@TerryChia Takes up to a couple hours usually.

Thomas Pornin

@TerryChia Some badges are immediate, others are a matter of regular cron jobs which may run once a day.

Terry Chia

Hmm. Very weird that both suffrage and civic duty was awarded in matter of minutes, but Vox Populi hasn't.

Thomas Pornin

@JeffFerland Hop ! Done. Base64 encoder, in C. Works like a charm. At least I will be able to send arbitrary files through copy&paste in RDP.

@TerryChia By the way, for your MD5-of-random-passwords question: a good GPU can hash about 2^30 passwords per second.

Polynomial

15:30

Interesting answer here: security.stackexchange.com/questions/19731/…

Thomas Pornin

So if the attacker has 1000 GPU and is ready to spend a fortnight of computation, then you need passwords with entropy beyond about 2^50 to defeat him.

Polynomial

So, er, bcrypt then. ;)

Thomas Pornin

With random characters (uppercase letters, lowercase letters, digits, a couple other signs) you get 6 bits of entropy per character

hence, 9 random characters "ought to be enough"

Polynomial

I always imagine the "b" stands for "bitchslap", since that's clearly what it does to attackers.

Iszi

@Polynomial Randall has way too much free time on his hands.

Thomas Pornin

15:32

but REALLY random, mind you.

Polynomial

@ThomasPornin Yeah, in reality I wouldn't say more than ~3 bits per characters for effective entropy of most passwords.

i.e. human generated passwords.

Terry Chia

I see. Just pondering this cus I have no control what hashing schemes random sites are using.

Polynomial

@TerryChia The best solution for sites like that is a long random password generated in something like KeePass.

Terry Chia

Yeah, most of my sites have 15-18 random characters stored in LastPass.

Polynomial

I just work out what their limits are (or just use the limits they state, if they do state) and use those.

so if it's alphanumeric only and a max of 20 chars, I use 20 chars alphanumeric.

if they have no limit, I use ~30 chars alphanum + caps + symbols

there's no downside to it. might as well be crazy secure.

Terry Chia

15:36

heh yeah. i mostly just bash on my keyboard for a few seconds.

Polynomial

that's not actually very random

Iszi

@Polynomial I hate sites that have limits, and don't state them. Drives me nuts, especially when the limits are lower than 12 characters and/or exclude some fairly common non-alphanumerics.

Polynomial

you get proximity anomalies, e.g. x,c,d,v,f being likely to be together.

Terry Chia

so you randomly generate them?

Polynomial

@Iszi Any site that limits password lengths to anything less than ~40 characters needs to be fired out of a cannon into the sun.

@TerryChia Yup. KeePass has a generator.

@Iszi Or worse, limits them to alphanumeric characters. What the hell is the reason for that?

usually implies: a) plaintext, and b) worries of SQL injection.

not exactly confidence-inducing.

I came across one the other day where the password had to be exactly 8 characters, alphanumeric.

which is just... what? :s

iirc, it wouldn't allow capitals either

that's only 2,821,109,907,456 possible passwords.

CodesInChaos

15:42

I use the same low entropy password for most websites

Only high value websites get their own password

Polynomial

eek.

that's gonna bite you when one of them gets pwned.

unless they're throw-away accounts

CodesInChaos

will probably bite a bit, yes

but remembering many passwords isn't fun eithe

Polynomial

that's why I use keepass

Iszi

@Polynomial Yeah, burn those too.

Polynomial

I only need 2 passwords

Iszi

15:44

@Polynomial I've run into one or two of those. Can't stand 'em.

Polynomial

dropbox password + keepass archive password

though I keep my email password memorable for safety.

it's still like 50+ characters though :P

so I remember 3 passwords, and generate a huge number.

though I do use a shitty low-entropy common password for throwaway accounts

oh, I lied. I remember 4 passwords. laptop has full system encryption

so I remember the TC pass

CodesInChaos

TC is probably my strongest password by far

since it's the only one that must withstand an offline attack

Iszi

@CodesInChaos I don't follow. How is it your other passwords do not need to be able to withstand an offline attack?

CodesInChaos

For others an offline attack requires a database compromize, in which case they'll need to reset the passwords anyways

For TC the standard thread model is the offline attack. Which is worsened by TC sucking at key derivation.

Polynomial

@CodesInChaos I wasn't aware that TC sucked at key derivation.

CodesInChaos

15:55

There security level should be comparable to PBKDF2 at 1000 or 2000 iterations

Iszi

@CodesInChaos Reliance upon this presumes that the compromise will be noticed, acted upon, and/or disclosed in a reasonable time frame.

Polynomial

@CodesInChaos That's not many. I thought it was more like ~50k iterations.

CodesInChaos

> 1000 iterations (or 2000 iterations when HMAC-RIPEMD-160 is used as the underlying hash function) of the key derivation function have to be performed to derive a header key

I'd like to see scrypt support with big factors in truecrypt

Polynomial

I'd be happy with bcrypt.

anyway, HOME TIME!

and off to 44con tomorrow (yayz!)

laters .o/~

Jeff Ferland

16:13

1

Q: Is this login authentication safe?

I have been thinking of a way to authenticate users so as to pick out the users using cracked versions of my game from the people who have actually bought it. I came up with this idea: The client asks the login-server for his bl_hash, which is updated every 12 hours. (Does it need to be a smalle...

I feel like that question's title alone deserves an entry on securityreactions.tumblr.com

Iszi

16:24

@JeffFerland Loving that site now, are you?

Jeff Ferland

@Iszi So much.

I'm really tired :(

Iszi

@JeffFerland What're you talking about? You just woke up!

Scott Pack

That's what happens when you wait up at 4:30am and then to go work where you spend all day drinking White Russians.

Rory Alsop

16:45

@TerryChia scheduled for Friday posting !

and opened up QoTW meta post for #35

Iszi

17:03

How's this possible?

faildesk.net/2012/09/04/your-mailbox-runneth-over.

As I recall, Exchange only sends out-of-office once per day, per recipient.

Does Remedy randomize its sending address?

Thomas Pornin

@Polynomial Doesn't work. The explosion shockwave within explosives travels at around 2.5 km/s. A cannon cannot propel a projectile faster than that, and you need to get to 11 km/s to escape Earth gravity.

Unless the projectile is itself a cannon, which fires a sub-cannon, and so on.

Or the explosive is a nuclear blast.

Or the "cannon" is an electromagnetic accelerator.

Scott Pack

@Iszi I would find it unlikely, but what I would find likely is that the user did something stupid (detailed in the post) and the Remedy admin did something stupid when they set up the auto-notification email address.

Thomas Pornin

(All of these suggestions are serious NASA projects -- even the nuclear one.)

Iszi

@ThomasPornin Are you sure your name isn't Randall? Seems your knowledge base and interests overlap his a good bit...

CodesInChaos

So Jules Verne should have used a nuke, not normal explosives, to send people to the moon. Good to know.

Iszi

17:14

@CodesInChaos A series of nukes, I believe, is the currently proposed solution.

Iszi

17:26

I'm simultaneously disappointed and elated that I haven't noticed any questions in the Close section of Review lately. Disappointed because I need one to double-check myself on something related to an MSO post. Elated 'cause... well, it's just good to not have questions that need closing, right?

Thomas Pornin

@CodesInChaos Strangely enough, a steam-powered cannon could work. A pressure wave can be made almost arbitrary fast, if enough pressure is applied.

Iszi

@ThomasPornin Steam traveling faster than the speed of sound? I'd like to see that!

CodesInChaos

speed of sound depends on the pressure

Thomas Pornin

Project Orion (nuclear propulsion)

Project Orion was a study of a spacecraft intended to be directly propelled by a series of explosions of atomic bombs behind the craft (nuclear pulse propulsion). Early versions of this vehicle were proposed to have taken off from the ground with significant associated nuclear fallout; later versions were presented for use only in space. A 1955 Los Alamos Laboratory document states (without offering references) that general proposals were first made by Stanislaw Ulam in 1946, and that preliminary calculations were made by F. Reines and Ulam in a Los Alamos memorandum dated 1947. The act...

CodesInChaos

The funniest part about jules verne's cannon was that humans were in the bullet

Jeff Ferland

17:30

@CodesInChaos Insert human. Get gelatinous mass.

Thomas Pornin

@CodesInChaos Yes, exactly. The idea is to increase pressure so that speed of sound reaches 11 km/s. Then it becomes "easy".

CodesInChaos

The humans in the story survived without injuries XD

Iszi

@JeffFerland But that's what "inertial dampeners" are for, right?

Iszi

17:47

Argh. Damn TVTropes. Okay, I'm back.

Jeff Ferland

@Iszi science.slashdot.org/comments.pl?sid=1354597&cid=29275947

@Iszi Just remembered I have internet and my computer with a decent graphics card is now online. Will try to remember to check out that thing tonight.

Scott Pack

@JeffFerland Just another, what, 20 years before your Internet gets turned on?

Jeff Ferland

@ScottPack Apparently it really helps a tech's average job time if they just close the ticket out and don't do the job.

Scott Pack

@JeffFerland That sounds about right, yeah.

Iszi

@JeffFerland I think that's a lesson they carried over from when they worked in fast food.

Oh... @Gilles I did a crawl through the Freefall archives over the weekend. All caught up now. Amusing stuff.

Too bad the site is so ridiculously 1990's.

Scott Pack

18:00

All caught up with all 2000+ comics?

How's that child neglect coming?

Iszi

@ScottPack Hey, I made it to her birthday party just fine, thanks very much. The sleep deprivation project is going well, though.

vignesh

18:15

hello all

Lucas Kauffman

18:53

hello

Iszi

@LucasKauffman I see what you did there. Take that talk back to The Comms Room, now.

Lucas Kauffman

@Iszi oh you don't like boobies?

Iszi

@LucasKauffman Oh, I love those. They're just not generally a common topic over here. You'll find they're much more often discussed in The Comms Room.

Lucas Kauffman

thats true

I dropped some there yesterday

Iszi

Also, you've reminded me of a bash.org quote. (MBNSFW)

Lucas Kauffman

18:55

they were very gladly accepted by the audience

Scott Pack

Or, when we do discuss them, we're significantly more clandestine.

Lucas Kauffman

@Iszi commsroom too rough for you lad?

feel intimidated by the manly and rough sysadmins in there

ticking timebombs where the slightest user complaint will set off a chain reaction of pain

Iszi

Ah, does anyone else remember this one? "What was the first modern web search engine?" (HowToGeek) I'm getting all nostalgic just thinking about it.

Of course, "JFWCI" just doesn't have quite the same ring to it.

Iszi

19:45

In case anyone else could use a quick & handy reference to the "10 Immutable Laws"...

0

A: The Memes of IT Security

Meme: Law #x of Security. (Or Law #x of Security Administration) Originator: Scott Culp (Microsoft TechNet Contributor) Background: In November of 2000, Scott Culp published two articles on Microsoft TechNet regarding what he saw to be "Immutable Laws" of Security and Security Administration....

Come to think, we've got a lot of questions on our site that are probably addressed in those laws.

Gilles

@Iszi hmmm. Challenge: for each law, come up with a scenario where it's wrong and ask a question about it

Iszi

@Gilles Ummm... I think for most of those, the only scenario I can think of is "The bad guy is a three-month-old baby".

Gilles

Some are more challenging than others. I'd be hard-pressed to find a situation where #10 is violated

@Iszi #1: sandboxes. #3: credit cards. #5: armed guards. #6: dual controls.

Iszi

@Gilles You sure you've got your law numbers right, there? Some of those don't quite add up.

Gilles

@Iszi I think I got them right, yes. Which ones?

Iszi

19:59

@Gilles #3 and #5

Either that, or I just don't get how they apply.

Gilles

#3: banks issue credit cards, which have a memory and a processor, and are physically under the control of someone who is not the bank and may be an attacker

Iszi

@Gilles Ah. Then refer to #10.

Oh, same for your response to #1.

Gilles

#5: in some military situations, there is an armed guard, and the password is more about following procedures than about authenticating

@Iszi #10? What's that got to do with it?

Iszi

@Gilles I'm not quite sure how a password is not about authenticating.

@Gilles Sandboxing, and the technologies that protect credit cards from being pwned, are not panaceas.

Gilles

@Iszi it is about authenticating, but sometimes the password is weak by design

beth posted an answer about that a couple of weeks ago

@Iszi yes, so? They are, nevertheless, the right answer in some situations

Iszi

20:05

@Gilles You'd have to spell out a real-world scenario for me to get that, I think. Or point to Beth's answer.

@Gilles I'm not saying they're bad ideas - just that the laws still do apply.

Gilles

@Iszi dammit, I can't find her answer. What's a synonym for battlefield?

Iszi

@Gilles Combat zone? War zone?

Frontline? (Not synonym, but related.)

Gilles

@Iszi gotcha

it was an old answer that recently got the spotlight

9

A: How do you manage security-related OCD (i.e. paranoia)?

Yes, I think it's possible to be too paranoid. Although, also, I just finished talking security with a bunch of performing artists - people with no money who really need to spend their time promoting their work and creating new work... not building the Fort Knox of security just so they can use ...

Iszi

@Gilles Law still applies. You're ignoring the possibility of a malicious insider.

Gilles

@Iszi you're completely missing law #0: there's no such thing as absolute security. The goal is acceptable security, the ideal is optimal security.

Iszi

20:12

@Gilles That doesn't invalidate the other laws - it just provides a way out, given data/system owner approval.

Lucas Kauffman

@Gilles I don't trust those answers

AviD

20:44

202 messages?? Faaaaak.

Iszi

@AviD Welcome back

AviD

ha.

Iszi

►

Gilles

@AviD Fake? No, they're real. Take a screenshot if you don't believe me

@AviD come to think of it, here the meme is link or it didn't happen, so: chat.stackexchange.com/transcript/151/13-20

AviD

@Gilles huh? no, I believe it. I was cussing because of the infernality.

Iszi

21:07

This one's been sitting around all day. Wondering if it might be borderline Too Localized...

1

Q: How to harden my Buffalo LinkStation Pro?

The Buffalo LinkStation Pro Duo that we use can be pretty easily hacked into. The good thing about this is that this NAS runs Linux and can therby be improved in features, e.g. running an NFS or LDAP service as well. The bad thing is, anyone with access to the LAN can become root on the device - ...

hardening

AviD

@Iszi it's also borderline SF material.

but it is borderline. I'm inclined to just leave well enough alone.

Iszi

Some of you guys might want to pop your heads in over here...

4

Q: What are the potential dangers of the UDID leak?

Can anyone enlighten as to what a hacker could use a UDID for? The leak this morning of 1 million UDID's by AntiSec makes me worry- but should I? What is the worst case scenario for a hacker who has his hands on a million UDID's?

security udid apns

Stack Exchange

21:38

Blog - Stack Exchange: Stack Exchange API V2.1

Kevin Montrose on September 04, 2012

There’s been a low-key beta of the latest Stack Exchange API revision, V2.1, under way for the last month or so. I’m happy to announce that it’s official, API V2.1 is public, frozen, and out the door.

What’s new in this release?

Full Reputation History

Notifications Tab

Improved Search

User Merge history

Oh, and our first set of write methods.

We’re starting small, with the least important of our content, to safeguard the quality of our content.

Comments created with the API show which app created them when you hover over them, like so: …

Kev

21:51

Hey folks, would this be an ok question on this site: superuser.com/questions/469238/…

Gilles

yes, probably (I realize on second reading): you're asking whether there's a risk

@RoryAlsop is online and can give you an authoritative answer

Kev

@Gilles yeah, I can't work out from their docs if traffic can leak from their 5.0.0.0 pseudo adapter across to my 172.16.3.0

Rory Alsop

@Kev Hi Kev, it is a little localised, but I think the core of the question is good and on-topic here

Kev

@RoryAlsop would you mind if I flagged it for migration to here?

Rory Alsop

@Kev sure - go for it :-)

Kev

22:01

@RoryAlsop appreciated.

Andrew Smith

22:51

x

Transcript for