The DMZ

Ladadadada

08:05

"Monkeys with guns in there hands" you say? Excellent idea.
http://securityreactions.tumblr.com/post/47194768340/ceh

Ladadadada

08:22

Regarding this.

4

Q: Any tool for scanning vulnerabilities in browser extensions?

I am scanning browser extensions of Chrome and Firefox for vulnerabilities. Is there any tool which would help me do this?

TamperData is an extension and its purpose is to allow cause things like XSS to happen. Would anyone here consider that to be "vulnerable"?

And if not, how would an automated tool distinguish between that one some other extension that allowed XSS by accident.

Rory Alsop

08:51

@Lucas ftfy

Lucas Kauffman

09:34

@RoryAlsop tyvm

Lucas Kauffman

12:21

2

Rory Alsop

@LucasKauffman hahahahahaha

TildalWave

13:13

hmmm so I did a small experiment, and it turns out that gorillas are not as popular as monkeys ... interesting.

Thomas Pornin

14:43

@TildalWave Technically, chimpanzees are not monkeys, they are apes.

It stands to reason that chimpanzees have a higher comical potential than gorillas, though.

TildalWave

@ThomasPornin Oh yes I know that :) I was using gorillas as an example of a socially behaved primate, which I think monkeys would fail, if provide for a more entertaining comical effect, true that ;)

0

A: What is the origin of the three factors of authentication?

The origin of three-factor authentication paradig is unknown, but one thing is for certain: it predates mankind. Controversial? Let's see. Ask yourself, how does e.g. a father gorilla recognize a newborn cub as being one of his offspring, even if its mom is not around? By something it has - a sme...

I used one of those unanswerable questions... could be it's also because of that, it's not been seen many times since my answer

Thomas Pornin

@TildalWave Week-ends are always slow.

As for using animals to demonstrate ancient use of security protocols, it has been done before:

7

A: Oldest security feature still in active use

In ant colonies, specialized ants act as guards and prevent other ants from entering some areas unless they "present" the appropriate, colony-specific pheromone. This is the password model, and ants have been doing that since (at least) mid-Cretaceous, 110 million years ago. So I daresay that the...

TildalWave

@ThomasPornin I think that your answer has some entertainment value also due to the way readers see your attitude towards what they believe is a ridiculous question in the first place. It wasn't accepted by OP, so that shows somewhat that you've poked his self-respect a little, which readers possibly also found funny?

Well, I did :)

@ThomasPornin Oh you see but you used cars later in your analogy... cars obviously work also... someone suggested combining monkeys and cars in answers for ultimate rep gaining effect before:

If you merge a chimp analogy with a car analogy, you may produce the ultimate rep-winning strategy... — Deer Hunter Apr 2 at 19:45

TildalWave

17:03

0

A: What do I need to do to secure log-in and registration for my website?

For protect your login page you can use this service Colobe It is a free service that protects your pages by any brute force attack. Anyway colobe requires the PHP in your server. It is very cool because colobe is a dynamic service that learn during the time and builds a global blacklist of the...

This reads as a specific product endorsement to me, with so many different web application level filtering products out in the wild, and this one merely mentioning one specific product out of ... probably thousands?

Ladadadada

18:43

@TildalWave The domain colobe.net was registered by "Pesavento, Nicola [email protected]".

TildalWave

@Ladadadada Busted! Thanks that makes it 100% clear then :)

Ladadadada

I've commented to let him know that these things should be disclosed. Let's see what he does.

TildalWave

@Ladadadada I'm not sure he'll even check. He's probably busy looking for other websites to spam

Ladadadada

I'm not so sure. He has been using StackOverflow without spamming it. On the other hand, it's easy enough to remove a downvote if he edits the answer.

A Colobe is a kind of monkey... at least that's the French word for the Colobus.

TildalWave

19:15

@Ladadadada well it's just another remote API CBL, like so many of them... Even I have my own (not selling it, tho). But I don't see any case for selecting this particular product (that is even paid for over 5000 API calls par month) over so many other, better tested and a lot more used APIs like this, that are free to use regardless of the number of API calls. At the very least he (they?) could include some stats and expected performance numbers, if anyone is to fall for it.

Ladadadada

19:29

@TildalWave True. To earn upvotes it has to be at least a good answer, and there's no evidence that this is one.

TildalWave

@Ladadadada Well I gave it my -1 but I expect it to be later deleted by mods, even I have limited patience with answers like this, even tho it's kinda fun to mock it :)

TildalWave

20:34

Yey it was deleted! Thanks to the mod that did it ;) @Ladadadada we get our 1 rep point back, time to open a can of beer and celebrate :))

TildalWave

21:16

0

Q: How does hashing work?

I have been interested in Information Security. I was recently introduced to the idea of hashing. What I currently understand about hashing is that it takes the password a user enters. Then it randomly generates a "hash" using a bunch of variables and scrambling everything. Then when you enter th...

hash

@ThomasPornin Red alert! :)

Thomas Pornin

@TildalWave By Jove !

Ok, I'm on it.

Gilles

@TildalWave surely this is a dupe

60

Q: Why are hash functions one way? If I know the algorithm, why can't I calculate the input from it?

Why can't a password hash be reverse engineered? I've looked into this ages ago and have read lots on it, but I can't find the explanation of why it can't be done. An example will make it easier to understand my question and to keep things simple we will base it on a hashing algorithm that doesn...

encryption hash

there's a bit more to it

TildalWave

@Gilles well yes, but problem is OP does not understand that they're one way, and he split his question in three points, so it would be a dupe of three other questions. Not sure how to go about with these type of questions, I've seen many that weren't closed even if they were called as dupes by others, just because they had a part in it that was different enough from other questions. SO if full with such questions

Thomas Pornin

@Gilles Ah thanks, I was looking for that one.

Done.

Gilles

21:54

I hitched onto the train

@ThomasPornin you didn't address salt

Thomas Pornin

@Gilles Actually I did, but I omitted the term "salt". I'll add it presently.

Gilles

@ThomasPornin I don't think Griffin will be able to make the link from “We do not want one hash function, but many distinct hash functions” to “If they are generated randomly (even if two passwords are the same they come out differently) how can they tell if it's correct?”

Thomas Pornin

@Gilles Actually I don't think Griffin will understand any of the answer before a thorough cleansing of the layers of misconceptions that have apparently accumulated on his mind; and this will take time.

But answers are not for the OP only; they are also for the Internet at large.

TildalWave

22:31

Why don't they understand they can up-vote more than one answer, even if they can accept only one? Is there some way we could promote voting more often? It might not be so much of a problem on Sec.SE, but I've seen many SE sites that suffer from low vote count. What's the word on how to improve users' voting habits?

While we're on the subject, I was wondering if this -1 rep cost for down-voting answers ever disappears with some reputation score, or is that same for all?

OK Griffin is learning, finally up-voted @ThomasPornin's answer too, after some convincing why that matters :)

Gilles

23:08

@TildalWave same for all

@TildalWave sec.se is middling among graduated sites in terms of average votes per post

data.stackexchange.com/stackoverflow/query/78561/… (broken now, something has changed in the db schema)

TildalWave

@Gilles ops better report that, it's spewing its own intestines for all to see ;)

@Gilles oh damn I feel like a freshman at uni, didn't even get it at first what that is :) sorry, false alarm!

Gilles

@TildalWave report what to who? It's a gross hack that stopped working

feel free to repair it if you know how

TildalWave

@Gilles see my previous reply ;) I just didn't get it, I thought these things are supposed to be hidden from us, and that some error caused it to disclose its internal structure. Had no clue that's public too. :( I'm learning...

Gilles

23:25

@TildalWave it's a public read-only copy of the SE database (only the public part, no info about flags, who voted for what, etc.)

TildalWave

@Gilles ~n and ~u variables are available on all tables?

Gilles

@TildalWave The query is generated. ~n and ~u are substituted during the generation process

TildalWave

@Gilles yeah I get it now, it's linked to database names in sys.Databases

@Gilles Is there any way to export schema? Or if someone went through the trouble of preparing it before?

Gilles

23:43

@TildalWave not that I know of, but I learnt everything I know about SQL by writing SEDE queries

there's some doc about the schema on the site, and some on Meta Stack Overflow

TildalWave

@Gilles Found it, thanks: sqlserverpedia.com/wiki/…

Scott Pack

I notice they don't mention @TomLeek or @ThomasPornin on this list.

AlshonFubawu (Alshon Fubawu)

Bears, from most to least dangerous:

(1) polar
(2) grizzly
(3) brown
(4) black
(5) Care
(6) Build-A-
(7) Chicago

2:57 AM Oct 8th via Twitter for iPhone
http://twitter.com/AlshonFubawu/status/255200327102500864

Well. I was only expecting the link.

Transcript for