@D3C4FF What answer did you get the disciplined badge for? Seems a bit strange to me to delete an answer with at least 3 up-votes, or indeed that there would be a badge for it :)
@TildalWave actually, i found an answer i had written somewhere was wrong and someone else had answered the question correctly so i figured i'd trade a few points for a random badge :D
@D3C4FF The easiest seem the Fanatic 100 days consecutive visiting the site and Electorate for 600 up-votes on questions with not more than 1800 up-votes on answers... but I didn't run through all of them
Actually, it says "votes" so obviously either way, up or down
Well. To be fair, the only reason i couldn't check in on the easter weekend (when it just HAPPENED to crash) was because i was in fucking tasmania in a cave for 3 days
-_-
Turns out 150M underground you cant get mobile coverage?
Crazy i know.
Damnit. Where the fuck did those 40 rep points come from!?
@D3C4FF +30 from here and +10 from Photography... This sum is only updated once per day I believe
Added my views to that How can photographers support non-profit charity organizations? question. I wish I had more of such questions here, I could offer real work immediately.
@D3C4FF You think I should attach some example photo to the answer? Seems appropriate for the site, but I'm not sure if that's a custom there?
Bought a PVC card printer (for work) on ebay, dude is taking forever to post it and i reckon he might be trying to scam me, took 45 minutes of poking around on the net and i've got pretty much every detail on him. On the plus side, he seems legit... xD
It's depressing just how many companies get SSL completely wrong. I just looked at a bunch of really well known companies like pepsi.com, coke.com, starbucks.com and all of them throw up SSL warnings. Even firefox.com does.
@Ladadadada I find it very normal. They don't need SSL for that part of the website. firefox.com redirects to mozilla.org and firefox.com probably used internally or they give people intended to use it a cert to add to their trusted certs
@Ladadadada Just because SSL exists doesn't mean that you need to use it for everything.
@Ladadadada I mean yeah sure, we can sit here and criticize everything for the fun of it, but at the end of the day they know what they need, especially in cases like these.
No one fixes these things because their websites are working. They redirect to SSL for login and back to non-SSL for the rest of the site. The use-cases they developed for work fine.
But switching to SSL should be as easy as adding an s in the right part of a URL. Instead we need tools like HTTP-Everywhere, and even that doesn't work for all sites.
(sigh) I hate do this, but I'll do it. _You_ can't login (AFAIK) to `https://firefox.com`, so it's Mozilla's staff's thing. There's nothing to do on `pepsi.com`, the login site is `https://points.pepsi.com/` which fully supports SSL. I agree on `starbucks.com`.
i have a doubt.
I saw that some e-commerce scripts can also run without ssl, but everyone recommends to activate it to protect sensitive data.
I just saw a site that has an e-shop link, if i click it my browser says that the security certificate is not reliable, and in fact if i click on "conti...
Can someone with more DNS filtering experience add another answer to this? I'm sure I have missed a lot. For me this is by far the most important type of question, and should be answered thoroughly and quickly.
@Adnan If the cookie that was sent in a HTTPS response has a secure flag on it, then it can only be read through a secure connection, and reading it through a non-secure HTTP will fail (it actually won't be added to request headers). So I don't see that last comment so relevant, but yes the previous one with secure flag obviously is ;)
@Manishearth The cookie will be set through an HTTPS page, but when the user visits the homepage (the one for which you suggested the usage of HTTP) which is on the same domain, the browser will send that cookie, the important one (the login cookie). — Adnan23 mins ago
Anyway, good morning to all :) I hope you're enjoying better weather LOL
@TerryChia Was in italics... substitute as appropriate :))
@Adnan Dunno I just woke up... I could be missing something? Besides coffee :))
@Adnan Damn sunny at 2C? Sounds like you need to be careful of snow blindness then... Which is a lot better than what I'm about to get here... rain depression :(
What you want is format-preserving encryption. There is unfortunately no ready-to-use standard for that, but some reasonable constructions are known. I would recommend the Thorp shuffle which is an extremely unbalanced Feistel scheme; given enough rounds, this can implement a permutation which is...
Heh I knew I had to tag that question with hash for The Bear to give his insights :)
Maybe that's cheating, but it's for a good cause :))
@Polynomial @Poly @Poly @Poly a what's that song question for you. I can't find the performer. Guys are definitely from Blighty, it's an a cappella song, fairly new-ish (say a few years old) about guys going out on a Friday night... or it could be Monday? Not sure, but it wasn't a huge hit, just one of those songs that came and disappeared. Any ideas?
@TildalWave Some time ago there was a guy called asadz (now he has another name, I don't remember it), he frequented The DMZ for a week or so. He pretty much drove everybody insane (well, especially me). That message had a very similar style to his.
@Adnan I was here and I remember, I just fail to see the resemblance. What's it supposed to reference? I'm not talking about some gay song, never mind that buttography LOL... It's just some song about a big night out that's all.
@AntonyVennard LOL well this is sublime: Just install the full IBM Security solution, and let it use the TPM. What good it will do to increase the security of your data is unknown. :))
@TildalWave I know :) Basically, I'm asking because we have a customer having trouble with one backing up his disks and we're trying to understand exactly how intrusive it is in terms of encrypting disks.
My favourite line is The TPM chip is a "secure" brokerer of data signatures and keys
@AntonyVennard I'm trying to find a proper manual, but the Lenovo page isn't of much help either: The ThinkPad Embedded Security Subsystem provides for authentication and encryption of data communications. IIRC you set the password in BIOS and the TPM then takes over the encryption... but there's ample warnings on a few pages about that, so... well bollocks, pardon my French... What model/serial?
I've had a nosey around for manuals etc, but haven't pulled up much. We've seen the BIOS screens etc, but we're unsure exactly what level of encryption would be involved...!
We'll find out though, we have one on order. I just wondered if anyone had any experience seeing as it probably falls under the umbrella of "endpoint security".
@Polynomial Oh stop it, it's not that kind of a song. I actually heard it a few times on some alternative radio. It's a pretty cool song, not some Friday, Friday,...
@Polynomial You mean your memory? :P It's something along the lines of going out on a [day of week] night,... have some beer with my mates,... whatever, I don't really remember the lyrics but it's most definitely not gayish. Nothing in the lyrics suggested being that.
@Polynomial me neither, but that song was cool... but no I don't think any of these two... similar, but no instruments support... probably like 4 or something dudes but only one actually sings, others just hum and keep the beat
@ThomasPornin I'm not actually whining. I don't mind the reps, it was just a joke, started a while ago when @Terry said that it's good that there's someone with less rep than him (me).
I am trying to learn how a secure web application is developed. Particularly, I am unsure of how passwords are sent from the client to the server. For a typical user/password login form. If the client sends a plaintext user/pass in a POST request over HTTPS. Is this secure enough? Considering the...
@TildalWave Yesterday we were speaking about cookies. I played around with the evercookie and it turns out it's quite easy to remove. Cleare the browser + Silverlight data + Flash data.
@Adnan I know, I've been trough the documentation also but I didn't find anything in it that would really make it more persistent than the run-of-the-mill cookies for those that wanted to bypass it. That's why I didn't go back and mention it in the answer, it'd only confuse OP further.
@Adnan I noticed the upvote from Bear #1 after 15 minutes, too late for a clean cancel. I made an edit to reset the counter. You can unupvote if an edit was made after your upvote.
don't think there is an equivalent for non-mods. In beta it is very useful for everyone to know, but I guess once graduated, the site has effectively proven itself so that info isn't really needed
@TildalWave we can share general high level info, ie "we had a bit of a peak in traffic due to XXX post - is this a rep-train we should hop on?"
@TildalWave Ahh - I don't think we get granular enough data to follow Thomas' tests. We can see the effect of a reddit post etc., and I'm sure SE can drill down to the nth degree
@TerryChia If that's the goal, we could post it on reddit. It could be a fun experiment (for Science !).
Actually I wonder whether a reddit post could be a surefire way to get a Publicist gold badge. Does the badge work for links to answers, or only links to questions ?
My assumption:
When a firewall is configured to drop spoofed packets, it tries to ping (not necessarily ICMP) the source IP and sees if it belongs to a real host or if it's up, and if not, it drops the packet.
My question:
What happens if the source IP of a spoofed packet belongs to a real and...
Aside from @AviD and @ThomasP hopefully giving a couple of blog posts (which incidentally can provide rep-trains of their own if linked suitably), anyone want to propose new QoTW or blog about one of the existing ones on the list?
Since starting the Security Stack Exchange Blog on 15 July 2011 we have some excellent blog posts, and a large number of these are from our Question of the Week posts. Going forwards, it is probably simplest to post your favourite Questions of the week as answers on this question, and vote for yo...
@ScottPack After 5 seconds of posting this link here it received two downvotes on reddit. Edit: One of them was taken back. Edit2: Okay, somebody is playing a game.
They're using the upvotes to measure SNR, so they try to somehow automagically nudge posts
So if something gets a whole lot of upvotes quickly, then that means it's popular, but doesn't necessarily mean signal. Similarly, if something receives lots of views, but not many upvotes and very few comments, then it's probably noise.
For the SSL, I would like to get some hard figures on the adoption state of several things: newer TLS versions, AES cipher suites, ECDSA / ECDHE, anti-BEAST systems, UTF8String in certificates... also, some stats on certificate issuers, usage of certificate extensions, key sizes...
I currently have located 4000 SSL/TLS servers (0.574% of tested IP addresses). When that reaches 10000, I'll do a first run of statistics.
@AntonyVennard Actually I do the initial steps of the handshake, but I complete no handshake. I send the ClientHello, then gather the ServerHello and Certificate from the server. Then I unceremoniously close the connection.
I need to do that a few dozen times for each server, to work out its list of accepted cipher suites. And I do that twice, to see if the server enforces its own preferences. And then I do that four times because I test SSL 3.0 and TLS 1.0 to 1.2. I also test SSL 2.0 but that requires only one connection.
My code is multithreaded; I begin investigating a new IP address every second. I find about 20 servers per hour. In a fortnight I shall have my 10000 machines (my threshold to be able to make statistics with a decent precision)
@ThomasPornin Blimey. Quite interesting though - I look forward to the results. I'm not sure what my servers run SSL-wise - I should probably care, but so far I've not really been motivated to fix it.
fuck u u pricks and fuking realise that drug taking is a persomnal fukin choice which should be allowed if u wanna call this world a free fucking place
You might want to nuke that.
If you didn't get the flag. I left a comment explaining that it didn't really answer the question, but then I decided it was probably best not to...
i have a doubt.
I saw that some e-commerce scripts can also run without ssl, but everyone recommends to activate it to protect sensitive data.
I just saw a site that has an e-shop link, if i click it my browser says that the security certificate is not reliable, and in fact if i click on "conti...
Is it safe that sometimes my Anti-filtering program does not change the DNS address?
My assumption:
When a firewall is configured to drop spoofed packets, it tries to ping (not necessarily ICMP) the source IP and sees if it belongs to a real host or if it's up, and if not, it drops the packet.
My question:
What happens if the source IP of a spoofed packet belongs to a real and...
fuck u u pricks and fuking realise that drug taking is a persomnal fukin choice which should be allowed if u wanna call this world a free fucking place
