The DMZ

Terry Chia

04:18

@ThomasPornin If I make the assumption that the underlying code doing the verification is secure, what would the best way of using key files as a 2FA method?

Would it be enough to generate a random number of bytes in a file, hash and store it and hash an input file for comparison whenever I need to authenticate, or should I use something like RSA?

AviD

08:54

@Iszi re windows phone - sorry I wouldnt be able to answer that, contracts with telcos work very differently here.

FWIW, i get my updates straight from MS, no lag necessary. Wouldnt have it any other way, why in hell would I want/expect my cellular provider to handle updates for me?

just like I wouldnt expect my ISP to update my OS.

hmm, okay, bad example - I know that there are those that do.

okay, I wouldnt expect my electricity company to program my microwave.

Terry Chia

@AviD Wait, ISP's updating OS? :O

That's new. Never heard that before.

CodesInChaos

@TerryChia The problem with key files is that a trojan can steal it, and keylog your password at the same time

AviD

09:39

@TerryChia I know, shocking, right? But yeah, they offer it as a service.

yknow, for the clueless grandparents who need somebody - anybody - to manage their settings for them.

Rory Alsop

10:11

In the UK, most phones get their updates from the ISP. By default.

If you have a phone provided with a contract, you often need to hack or jailbreak it to get updates faster. And as ISP's can be a year or more behind the curve this is a major security issue!

Oh dear, another BEST question:

0

Q: Distributed software company infrastructure

What is the best possible infrastructure for a distributed software company from data security point of view? Company without an office, employees working from their own computers. I think about VPN for all in-company communication including e.g. private jabber server (limited to vpn network) etc...

Terry Chia

10:47

That is why the only Android devices I will get are the Nexus ones.

Ladadadada

Ugh. Just logged in to a bank account I haven't touched for a long time. They forced me to choose a picture (the size of a gravatar) out of about 100 choices as an "extra layer of security" and then choose three "security questions" from three dropdowns, each of which had about 5 choices.

They still don't even offer a hardware token. All my other bank accounts automatically sent me one years ago.

I was only logging to cancel my account.

CodesInChaos

@TerryChia Even Nexus devices have crapware you can't uninstall

Terry Chia

11:08

@CodesInChaos Really? Seemed pretty ok on my Nexus 7.

CodesInChaos

11:37

It's pretty bad on the nexus one

the dumbest part about is that when you update those built in applications, they take twice the memory

once for the original version, and once for the latest version

Being unable to remove Facebook is an offense.

Terry Chia

@CodesInChaos Facebook comes preinstalled on the Nexus one? Weird. It isn't on the 7.

Ok, dumb question. Really dumb question. If I have a C# dll calling a third party dll, I have to distribute the third party dll along with mine right?

CodesInChaos

unless it's pre-installed

Terry Chia

@CodesInChaos Right thanks, that's what i thought. I guess I'll just add the source code of the third party library into my project and compile it.

CodesInChaos

12:12

Check the license before doing that

Terry Chia

@CodesInChaos It's an open sourced one I'm free to distribute and modify so no worries there. Just wanted to figure out the most convenient way to package my code.

CodesInChaos

My C# projects almost always consist of multiple assemblies which I just throw into a zip file

Terry Chia

I'm writing a library for the authentication code I seem to keep rewriting packaged in a dll file. The idea is that I just have to import that one file into my future projects. So I guess it would be better for me to package all the source code right into the dll file.

CodesInChaos

13:17

I hate the .net collection design

Terry Chia

@CodesInChaos Hmm, why?

CodesInChaos

The interface hierarchy is totally broken, and the naming is often bad

Terry Chia

I have no complaints so far. I guess either I'm less picky or I do waaaay simpler stuff.

CodesInChaos

For example the lack of readonly interfaces. They tried to fix it in 4.5, but couldn't put them in the right place

Terry Chia

Probably both.

CodesInChaos

13:26

I'm getting increasingly picky with language&library design

Thomas Pornin

14:36

@CodesInChaos Next step is the urge to create your own language and/or library.

CodesInChaos

Of course I have that urge, but I decided to only do that after I've learned and rejected lisp and haskell

Thomas Pornin

@TerryChia A bunch of random bytes is good enough for a lot of things, but it means that servers will get the secret at some point.

You want asymmetric crypto (like RSA) when you want to be able to authenticate to systems without actually trusting these systems.

CodesInChaos

But even then you can get it wrong. I believe SSHv1 managed that

Thomas Pornin

That's pretty common with SSH: you want to log on other servers, but you don't want a compromise of one server to reveal your key (which would allow access to all the other servers)

Terry Chia

@ThomasPornin Before I go do more research on it, could you describe in dumbed-down terms how a typical authentication process will go using RSA?

Thomas Pornin

14:47

@TerryChia Server sends random challenge, client signs it.

Ideally, what the client signs will be a concatenation of everything the client and server sent so far, including random values from both. That's how it goes with SSL.

CodesInChaos

the problem with random challenges is that the server might try to impersonate the client to another server

and uses that server's challenge instead of generating his own

Thomas Pornin

15:04

@CodesInChaos That's why we want to include other data in the signature, in particular a copy of the server's public key.

Terry Chia

16:10

Man, this just stinks of poor forensic procedure: arstechnica.com/tech-policy/2013/02/…

CodesInChaos

16:44

Note to self: Add a password before traveling to the Canada

CodesInChaos

17:09

"We did it were the jewlery at nigga burrrrrrrrr." -- WAT?!

TildalWave

@CodesInChaos and switch off predictive texting LOL 'We did it were the jewlery at nigga burrrrrrrrr.'

CodesInChaos

Personally I see computer&phone as extension of my brain that should never be searchable

but I guess that opinion is pretty controversial

TildalWave

►

TildalWave

17:25

@CodesInChaos No so sure what's controversial about it. It's private and should be treated as such until the individual in question surrendered his right for privacy in some clearly definable non-controversial way. If it's 'controversial', that just means some get it while others don't. I don't like this word, it reminds me there's too many over-opinionated people out there.

CodesInChaos

I mean that searching a personal computer should be illegal even with warrant.

Scott Pack

I seem to remember hearing about a court case that had turned into digital records falling under the same umbrella as yourself with respect to self-incrimination. I should see if I can find that and see whatever came of it.

TildalWave

@CodesInChaos I agree with you, don't get me wrong. I just hate the word 'controversial'. It's Latin for opposing opinions (I didn't check the dictionary but I dig Latin well enough) but it's used for anything else than to describe this fact. Mostly, I see it used as an argument for or against something, which is plain wrong.

CodesInChaos

I just use it for something were I think many will disagree with me

My choice of words was influenced by just reading:

365

Q: What's your most controversial programming opinion?

This is definitely subjective, but I'd like to try to avoid it becoming argumentative. I think it could be an interesting question if people treat it appropriately. The idea for this question came from the comment thread from my answer to the "What are five things you hate about your favorite la...

language-agnostic

TildalWave

@CodesInChaos I like the top rated comment under this question.

@CodesInChaos 'won't the answer with the fewest votes be the most controversial :)?'

CodesInChaos

17:33

those with the most votes, but the lowest absolute score

TildalWave

@CodesInChaos But yeah they both use the word correctly, which is a rare treat

CodesInChaos

Correct use of words is unacceptable

2

TildalWave

@CodesInChaos :D made me giggle!

@ScottPack Did you find the link to that court case? I'd be interested to read it ;)

@CodesInChaos That question you're linking to (most controversial programming opinion) reminded me of a question of my own that I'm constantly reminded of each time I'm with non-programmer friends. And that is, are we programmers more aware of how much we're being programmed by the society we live in, and is it easier for us to de-program ourselves? Also, what could we gain from this?

Iszi

18:13

@CodesInChaos Holy crap - 408 answers?!

Scott Pack

19:33

@TildalWave Oh, no. I haven't put any effort into it either.

CodesInChaos

20:16

How is haxxor traced?

Thomas Pornin

@CodesInChaos This sounds like one of these horrible rep train questions.

Oh my, there is indeed such a question which has just appeared on the site.

Rory Alsop

20:33

@ThomasPornin heh - good use of Dumbledore reference :-)

TildalWave

20:47

@RoryAlsop Wait what? Thomas Pornin and Tom Leek are one and the same person or is just my imagination running wild and am reading too much into the use of a bear as an avatar? :O

Rory Alsop

@TildalWave Bears :-) Fluffy fanged and clawed specialists in security - may also be aspects of Ursu, the bear god :-)

But yeah

you can have an alternate avatar as long as you follow a few rules - otherwise the auto sock-puppet detection will get rid of them

Those rules include keeping them very separate - not voting on each other's posts (in fact not voting on the same posts at all) etc

TildalWave

neah not really interested, i'm pretty well represented by a worm

Rory Alsop

lol

Lucas Kauffman

wait thomas and tom are the same person

Rory Alsop

hahahahahahahaha

you guys

(shhh - bears!)

TildalWave

20:52

shouldn't we have an 'ursus' tag then as well?

Thomas Pornin

@RoryAlsop I doubt the sock-puppet detection script would detect the occasional cross-vote. They must have some sort of threshold.

Rory Alsop

I'm just impressed that someone can get two 10k+ accounts that quickly. Seriously know their infosec, do bears

@ThomasPornin yeh, but they won't let us know :-)

keeping the details woolly helps prevent people gaming up to the limit

Thomas Pornin

However, "ethical" is not the same as "was not caught in the act".

@RoryAlsop It's Security through Obscurity. It works.

Rory Alsop

@ThomasPornin don't say that, folks will get the wrong idea :-)

Lucas Kauffman

especially coming from a bear

TildalWave

20:54

Rory Alsop

we have all been conditioned to 'trust the bear' - I for one salute our new ursine overlords

2

Tom Leek

@RoryAlsop YOU MAY LIVE. FOR NOW.

Rory Alsop

:-)

Lucas Kauffman

And so the security wars started between the Rory and the Bear

Thomas Pornin

Sounds like the name of a Disney movie.

Lucas Kauffman

20:59

Clash of the titans

Rory Alsop

@LucasKauffman Rories and the Bears - the Peacekeeper Wars

TildalWave

sorry to spam with images but i can't resist another one...

Rory Alsop

I wonder why this image worked, but the previous one was blocked...

TildalWave

@RoryAlsop You're on 3G again? You need 4G for beer porn

Rory Alsop

not on 3G, but am on work laptop - writing my presentation for an event tomorrow

TildalWave

21:10

I actually drank that Ursus beer pretty often when I was in Romania, it's quite decent lager. Never had any between the (.)(.) tho :(

Lucas Kauffman

@RoryAlsop Let's all sing a long :p

CodesInChaos

Scott Pack

@RoryAlsop So which one of you are Scarran?

TildalWave

@CodesInChaos uf, GO... tough game and a tough opponent

Scott Pack

I need to get some of my Go on. I have a board, but have only been able to play once. It's hard to find someone willing to play.

CodesInChaos

21:15

I mostly play online

TildalWave

@ScottPack there's Go clubs all over the world, i'm pretty sure you have some around as well ;)

Rory Alsop

I'm trying to learn, but keep being embarrassed just how little I know

Playing against computers is all very well, but doesn't teach you why you lose, and a few of the individuals I have played really don't help either

CodesInChaos

Every go player I met called himself weak

Rory Alsop

There seems to be smugness in beating someone but not letting them know why

@CodesInChaos exactly

Scott Pack

@TildalWave Son of a bitch, there allegedly is one here. Sponsored by the guy who runs the gaming research lab. Makes sense.

CodesInChaos

21:19

I just play many games and how something sticks

TildalWave

@ScottPack well if there's tens of them here in my parts of the woods, then i guess they're everywhere. and i agree it's not the best game to play on-line. for me, it was my father that taught me some strategies and it's nice to have someone talk you through it, no matter how advanced you think you are

CodesInChaos

But many go players spend more time reading about go than playing go

people have very different learning styles

Scott Pack

@TildalWave There is one in town, fortunate since it would be at least 1.5 hours to the next closest one.

CodesInChaos

IMO it's a fine online game. I played perhaps 30 games offline, and 2000 online

TildalWave

@ScottPack I imagined Athens would be larger, dunno why... I've checked now and it's about 1/10 of my city if not less in terms of population so yeah 1 go club per ~ 25k people roughly (uneducated guess)

Scott Pack

21:29

@TildalWave Population here is interesting. According to the census the city population is about 25k. We also have a student enrollment (on this campus) of around 30k. We're also in the middle of a vast rural expanse.

TildalWave

@ScottPack I probably thought it's bigger because of the uni true

Scott Pack

@TildalWave Sure. The city definitely feels bigger, but that's because for about 9 months of the year our population is more like 50k rather than 25.

Thomas Pornin

@ScottPack And half of the 50k is young people who are, as we all know, highly visible and noisy.

Scott Pack

@TildalWave Now, don't confuse us. There's another university in the state that has a student enrollment of nearly 60k and is in a city with a metro population of ~1.8mil

@ThomasPornin Generally speaking yes. Although, I am generally proud of our students. With the exception of a couple of neighborhoods they tend to be polite and good neighbors.

TildalWave

@ScottPack Neah don't worry I realize you're not in Columbus OH, that's probably the city you were referring to when you said roughly 1.5 hour drive away

Scott Pack

21:35

@TildalWave Affirmative.

@TildalWave You seem surprisingly informed with respect to the American MidWest for somebody from central Europe. Is that experience or quick googling on your part?

TildalWave

@ScottPack Also I know precisely what you mean by Athens feeling bigger. I'm from a city that's ~ 300k in population and I've lived good three years in nearly a 1M city in Romania and it felt smaller due to the lack of infrastructure and city vibe

@ScottPack Neah not googling much it's just general knowledge. you'd be surprised what all people from small countries are knowledgeable about, it's almost a must anyway. not a particular fan of this as it makes a lot of 'Jacks of all trades' tho

@ScottPack that, and possibly also that small countries' population tends to move around more. It's only an hour's drive in any direction for me to get to a bordering country ;)

Scott Pack

@TildalWave You might be surprised to hear how many people, just within a couple of hours of here, know less about it than you do. :)

TildalWave

@ScottPack OK, OK, you pushed it out of me... I'm old I admit

Scott Pack

@TildalWave I intellectually understand that concept but it is difficult for me to really get. As a youth I would drive 65 miles, to the next population center, to see a movie.

:)

Now now. You're not old. You want old? @RoryAlsop. That guy's old.

TildalWave

pssstt

Scott Pack

21:45

I'll let you in on a secret. That hair on his gravatar? He wasn't born with it.

Rory Alsop

@ScottPack hahahahaha - too true

TildalWave

i wasn't born with much hair either actually

Rory Alsop

mind you, I also wasn't born with the orange flashes or the laser eyes

TildalWave

or the tattoo on your back

Rory Alsop

:-)

Scott Pack

21:46

I'm still waiting for the Metaltech trampstamp.

Rory Alsop

@ScottPack patience, young padawan

TildalWave

guys i leave you to it, it's been a pleasure ;)

Rory Alsop

@TildalWave Night

Scott Pack

22:10

Sweet dreams.

Transcript for