The DMZ

one cool anti-tamper trick I have seen (though I dunno how I'd make it) is to have two thin wire mesh cages inside the case that sit inside each other, with the device in the middle. one cage is tied to ground, the other is tied to a pin on the uC with a 10k pullup resistor. if someone tries to drill through the side, they end up bending the outer mesh such that it touches the inner mesh, pulling the pin to ground and triggering a tamper alert

plus it doubles as a faraday cage to prevent EM leakage

you can do a similar thing with cardboard and aluminium foil, but it's not as robust ;)

Tinned_Tuna

Very cool, I've read about similar structures being used directly in tamper-resistant chips

it's a good measure, and it increases the cost of attacking, but an attacker once aware of these measures can do things like propping up the mesh

Polynomial

yeah, there's a cool trick where they used laser etching in very thin glass tubes containing chlorine, with a vacuum layer over the die, so any disturbance cracks the glass and leaks chlorine onto the die, corroding it.

Tinned_Tuna

9:33 AM

cl.cam.ac.uk/~rja14/Papers/SEv2-c16.pdf

Polynomial

interesting read

if I wanted a really solid solution I'd just encase the Arduino board in epoxy.

Antony Vennard

@Polynomial Not an issue that you need to deal with, but I saw a similar project using ethernet and a few python scripts. It worked out pretty well.

Polynomial

@AntonyVennard in this case I'm running an ethernet shield and will have a simple HTTP API running on it.

Antony Vennard

@Polynomial hackaday.com/2012/12/31/building-a-hardware-security-module

Polynomial

seen that already :P

they're using it is a signing HSM though, which is a different use-case

Antony Vennard

9:49 AM

@Polynomial Yeah, it looked pretty cool. My thought was just if you hadn't seen it, that might not have been a bad starting point as the architecture is mostly sorted, it's just your specific needs you need to adjust for.

I kinda wish I had the knowledge to put together something like this.

@Poly am I right in thinking if I buy the base arduino board I can simply plug in components (I think arduino calls them shields, right)?

Polynomial

yup

basically if you get an Uno it's an Atmega 328PU microcontroller hooked up to a timing crystal and power supply, and the micro is programmed with the Arduino firmware / bootloader.

that's all there is to it.

the shields are just peripheral hardware that come in a form factor that makes it easy to plug them into the Arduino

Antony Vennard

@Polynomial Ah, that's easier than I thought! I was looking at building a few hardware things just for my own personal experiments, but the thought of soldering stuff up... well I'm likely to kill it.

Polynomial

yeah, you can just plug in shields and use simple patch cables onto breadboards

no soldering needed

the shields look scarier than they are, too. for example there's an accelerometer shield, and it comes in the normal form factor (so it plugs right over the top of the board, with like 40 pins or something)

but only 6 of those pins actually do anything.

power, ground, then 4 pins for the SPI bus interface (MOSI, MISO, CLK, CS)

and the best part about those kinds of devices is that they stack onto the same pins, as long as you do some minimal changes to the libraries.

oh, actually, you'd need to slightly mod the shields (just cut the CS pin and wire it to a different GPIO pin on the Arduino)

'cos SPI just works by setting CS high on one device and sending / receiving commands, then setting CS high on another device and talking to that.

CS just means Chip Select

Tinned_Tuna

10:09 AM

I should really write more blog about PayPal's overall shitty-nature

Terry Chia

@Tinned_Tuna Why bother?

Tinned_Tuna

@TerryChia to warn people off using them :-p

Terry Chia

@Tinned_Tuna Why bother? :P

Tinned_Tuna

They position themselves (effectively) as a bank, yet are mostly unregulated in that sense.

Terry Chia

There simply isn't a good enough alternative out there, but I remember having this conversation before.

Tinned_Tuna

10:12 AM

yea ...

the banks would be a reasonable choice, if they were cheaper

most people chose PayPal because they have a low setup cost, compared to being a merchant for a bank

It's partly why loads of alternative payment processors are springing up, banks are too costly, and PayPal is a lawless backwater.

Polynomial

10:30 AM

@lynks I am genuinely scared :P

Antony Vennard

10:48 AM

@Polynomial Okay thanks. I might get myself some arduino kit. I'm sort of thinking this summer I might learn more about electronics, so, it'd be a good project I think.

Polynomial

@AntonyVennard there's always electronics.stackexchange.com too :)

ManishEarth

@Polynomial There also was Arduino.SE

Antony Vennard

@Polynomial Yeah, true. I should hang out there more. Unfortunately I currently feel like I'm below the minimal knowledge needed.

Polynomial

well I highly suggest learning Ohm's law first

just because it's so fundamental

then learn about power (i.e. P=IV)

that'll get you through most basics

resistor and capacitor combination equations are useful too.

Kirchoff's Laws are also good to know, but you can get by in most digital stuff without them.

ManishEarth

Generally you just need to know what resistors and caps do

the rest is all logic circuitry

Polynomial

10:56 AM

well, yeah, but you need the math to get the right values for things

even stuff as simple as driving an LED from a 9V battery requires some maths

and getting the power calculations wrong when driving loads from uC GPIO pins can cause a dead chip

ManishEarth

@Polynomial yeah that too

Tinned_Tuna

@ManishEarth it depends what you're trying to do. If you're building your own radio circuitry, you'll need to know about how inductors work

ManishEarth

Yep

Tinned_Tuna

and then work up to things like rf circuits

Polynomial

@Tinned_Tuna yeah, analog stuff is more tricky

AC and RF are generally mathsy

Tinned_Tuna

10:58 AM

I hate analogue stuff, mainly because I can't seem to bake it into my head well enough

ManishEarth

I guess I've taken a lot of physics for granted when meddling with electronic circuitry :)

Tinned_Tuna

digital, fine, TTL & FET-based logic and up, fine.

analogue and RF? I always need to consult a text book

Polynomial

pretty much the same here

except my TTL / FET stuff is a little hazy in places

Tinned_Tuna

but RF is very fun...

Polynomial

moreso with FETs than TTL

RF can be a lot of fun, yes

Tinned_Tuna

10:59 AM

FETs are occasionally magic, and I'll have to work through from first principles.

or consult a book :-p

having a university level library on hand is exceptionally handy.

Polynomial

tbf, a lot of what I do with microprocessors is practically RF due to high clock freqs

Tinned_Tuna

lol

Polynomial

every damn trace is a patch antenna

yay for clamps and decoupling

Tinned_Tuna

I think that the high clock frequencies is useful... yey for tempest attacks

Polynomial

heh

it's specifically easier on CRTs due to the scanline transformer

when you have a component whose job is to generate an EM field, you're already in the money for TEMPEST stuff.

ManishEarth

11:23 AM

It seems like the daily routine of bears is to wake up, surf Security.SE, find any new questions that haven't been answered by another bear, and answer them all.

:)

Terry Chia

11:39 AM

Who likes a challenge? :P digitaltrends.com/mobile/hack-redact-message-get-15000

Rory Alsop

Back in the early nineties I simulated the newest generation of high frequency circuitry for Siemens. It was ostensibly digital but in reality it was astonishingly analogue, and used all sorts of bias and timing tricks to get faster response times from transistors

@ManishEarth try changing your avatar to a bear. It may work.

Terry Chia

@RoryAlsop Was that before or after you invented fire? ;)

Rory Alsop

Of course it may not. ..

ManishEarth

@RoryAlsop Let's first see if @TerryChia's ear works out :P

Rory Alsop

@Terry - pffft. Tamed fire, not invented it.

ManishEarth

11:51 AM

What about this bear?

Rory Alsop

@Manish - on a mobile device I hardly notice @terry's ear

Tinned_Tuna

12:21 PM

I guess the fastest way to get into Redact's service, assuming perfect use of crypto, good key management, strong protocols, etc. is to develop an iOS zero day exploit :-p

Thomas Pornin

@Polynomial For a HSM worth that name, you need tamper resistance, and some permanent storage. There must be a way to store at least 128 bits worth of secret data, which will still be there when you power the machine again, but which cannot be stolen.

Polynomial

@ThomasPornin that's pretty much what I'm doing

there's an SD card for the actual records, and the master key is in firmware

since the secure bit is set, you can't pull the firmware back out

Q: Is it worth applying a MAC on data in a HSM?

I'm building a basic HSM out of an Arduino, and am using the following scheme to store data: Master symmetric key $k_m$ stored in firmware (secure bit set to prevent trivial extraction). Secondary symmetric keys $k_s$ stored as plaintext in web application database, one per user. HSM record key...

Thomas Pornin

@Polynomial You can't ? It's hard to get tamper resistance without power.

Polynomial

@ThomasPornin huh? how do you mean?

oh, you mean decapping?

Thomas Pornin

@Polynomial For instance, putting two wire meshes so that drilling triggers an extra contact makes any good only as long as the meshes are actually powered.

Polynomial

12:28 PM

sure

I discussed this above. The records can't be decrypted unless the master key from firmware and record keys from the db are compromised.

pulling out the HSM immediately triggers an alert due to failure.

killing the server does the same.

and I'd likely encase the uC in epoxy resin as an additional defense mechanism

so it's a risk in a case where an attacker has unrestricted physical access to both the HSM and the server, for a long period of time, and can completely shut off the server and HSM without being disturbed by security in the DC.

but at that point it's largely moot.

there's also an option for battery backup tamper protection, which is what a lot of chip+pin machines do

Tinned_Tuna

Or, keep a big cap or battery in there that powers the whole destruction thing for a length of time

ensure that the destruction method can work when the memory is un-powered & decaying (assuming volatile memory)

Thomas Pornin

@Polynomial Oh, you can have some level of protection with systems such as yours, but I would be wont to call it a "HSM".

Scott Pack

@ManishEarth He's the Patron Saint of ServerFault.

Thomas Pornin

The same way that however you paint it, a super-funky skateboard is not a car.

ManishEarth

@ScottPack I know :P

Polynomial

12:36 PM

@ThomasPornin I don't see why not. It's hardware, it's a module, and you can securely store content in it.

it's not really designed for high-end use, as I stated outright at the start.

Scott Pack

@ManishEarth I like the way mine turned out. It's from when I was using a sepia closeup of my eye. i.stack.imgur.com/Js1NC.jpg

Thomas Pornin

@Polynomial Securely... that's the point. A HSM worth its name would keep your secrets secret, even if the attacker steals the whole system (the HSM and the server and its database).

ManishEarth

@ScottPack ah

Polynomial

I don't see how that can be possible.

Thomas Pornin

@Polynomial Then don't call it "HSM".

Scott Pack

12:37 PM

@ManishEarth Subtle.

Polynomial

if you steal the HSM and whatever system talks to it, surely you're running into the same problem DRM does, no?

you have the data and the keys all in one place.

Thomas Pornin

@Polynomial That's what tamper resistance is about. Good HSM are supposed to implement active countermeasures. Someone who steals the whole system will be able to use the keys, but not the extract the keys.

This more or less supposes that the HSM has its own battery and commits suicide when "decapping" or whatever name you give it.

Polynomial

that's possible.

Tinned_Tuna

@ThomasPornin why not wait until the battery runs down then?

Thomas Pornin

In NIST parlance, that's the whole difference between FIPS 140-2 level 3 and FIPS 140-2 level 1

@Tinned_Tuna With a battery, the secret is kept in RAM; when the battery runs down, the RAM contents disappear.

Polynomial

12:40 PM

yup.

Thomas Pornin

Payment terminals do that, too.

Tinned_Tuna

except for cold-boot attacks?

(well, it's not a cold-boot, but the idea is the same)

Polynomial

@Tinned_Tuna to do a cold-boot attack you need to be able to directly freeze the chip, which you can't do since there's active anti-tamper

Thomas Pornin

@Tinned_Tuna The internal circuitry is also supposed to detect abnormal temperature conditions and actively destroy the data in that case.

Polynomial

^

I could do that too.

Tinned_Tuna

12:41 PM

I would've thought that due to shipping constraints (-40C in aircraft hold), you'd have a lot of leeway ?

Polynomial

@Tinned_Tuna -40C is nowhere near enough to cold-boot.

and usually they're not configured with a key when being shipped, so such countermeasures could be relaxed

Tinned_Tuna

Really? I'd heard of people using up-turned cans of compressed air (around -20C) and having notable results on standard RAM chips?

but then again, I have no sources to hand, so that could be me mis-remembering

Polynomial

at that temperature you're extending the life of data by seconds

e.g. 200ms -> 4s

maybe.

Thomas Pornin

@Tinned_Tuna I know a case where a HSM was blocked for 6 weeks in customs because of Chinese bureaucracy; when powered again, the HSM had died. It had to be reset, reloaded from a master HSM, and shipped again, this time labeled as a "network card" so that it goes through administration in less than a week.

Polynomial

heh

bureaucracy fail!

Tinned_Tuna

12:43 PM

@ThomasPornin due to lack of power, cold, or a combination of both?

Polynomial

@Tinned_Tuna probably both.

anyway, gotta go do stuff. laters :)

Tinned_Tuna

laters :-)

Thomas Pornin

12:54 PM

@Tinned_Tuna Lack of power, actually. When the power became low, the HSM voided its RAM, then shut down completely.

Tinned_Tuna

@ThomasPornin makes good sense :-)

Thomas Pornin

@Polynomial Instead of an Arduino, you may want to use a smart card.

E.g. this kind of token: gemalto.com/products/usb_shell_token_v2

They are cheap (20 EUR) and they are optimized for tamper resistance.

They are even FIPS 140-2 level 3 certified.

Plus, they embed a (small) CLR virtual machine, which means you can do some C# code which runs on them.

Tinned_Tuna

shop.kernelconcepts.de/index.php?cPath=1_26

Thomas Pornin

Finally, the hardware includes a crypto accelerator so it is rather fast at RSA (it can generate a new 2048-bit key pair in a few seconds, which is no small feat for that kind of hardware).

Tinned_Tuna

@ThomasPornin what's the entropy gathering like?

Thomas Pornin

1:00 PM

@Tinned_Tuna I don't know how it does it, but the internal RNG is part of what has been FIPS certified so it must be good enough to make NIST people happy.

Tinned_Tuna

small devices typically have problems with entropy generation

due to their state being entirely known at startup

Terry Chia

@ThomasPornin I think he is doing it "just for fun".

Thomas Pornin

@TerryChia I don't object the fun; I object with calling the result a "HSM". It's like saying that a simple MD5 on passwords is a "super cheap password hashing function" suitable for non-high-end systems.

TildalWave

1:31 PM

g'day all ;) interesting discussion I see ^

Scott Pack

G'day Bruce

TildalWave

1:48 PM

@ScottPack How's the weather like at you? It's so hot here the storm clouds are gathering already... from winter to summer in under a month, what the bleep? :O

Scott Pack

@TildalWave We had a longer spring, but today's turning out to be not too bad. The high today is 27, which is warmer than I like, but it's 10am and is about 20.

I've got the windows open, birds are chirping, fresh air smells wonderful.

I'm home today working on school stuff, so I imagine after lunch I'll go on the backporch.

It doesn't get full sun until around 5:30-6 so it's going to be too cool out there to comfortably sit.

TildalWave

@ScottPack I checked on Google fast and it says up to 28 degrees C for you and clear skies till the weekend... similar than here only we'll obviously already have electrical storms later in the days, like in early summer times. It's wacky, I dunno why I bother having transitional period clothes any more LOL

Scott Pack

Thomas Pornin

@TildalWave In Québec, transition from winter to summer is known to be fast; under 8 days this year

We have very short springs.

Scott Pack

@TildalWave We had pretty good rain Sunday and Monday.

Rory McCune

1:59 PM

out weather has been mega-wacky lately. Late april and we've been having hail showers!

lynks

potentially dumb question: say I have a java server application, is there any reason why using screen to run it continuously is bad in a production environment?

Thomas Pornin

@lynks Control is rather crude: only one admin at a time

Scott Pack

Typically we have very short springs. Last year was brutal. We normally only have a few days, no more than a week, in the mid 30s. Last summer we had several weeks where it didn't get below 35 and most days in the upper 30s.

Thomas Pornin

also, if the admin grabs the screen and his network connection dies, then the application stops

Scott Pack

Considering how humid it tends to be in the summer that just gets brutal when even the overnight temperatures are 23 or higher.

lynks

2:01 PM

@ThomasPornin I thought screen stayed up and detaches? I often just close a terminal emulator locally and the screen session stays just fine.

TildalWave

@ThomasPornin Seems we're getting them shorter and shorter here too. I love spring time, that's why I'm complaining. It's a bit strange tho for the Alps area, actually glad that it didn't cause more problems with snow melting so fast.

Thomas Pornin

@lynks Mmh... I have known screen sessions which were less reliable. Maybe the code has been improved over the years.

Scott Pack

For your purposes, @lynks, screen should be pretty reliable. Your best bet would be to daemonize it somehow, though.

Write an init script and let the services system handle it.

TildalWave

@RoryMcCune oh that too... my mom is trying to maintain a garden too... not nice if that happens

lynks

@ScottPack ahh yes, I should probably look into that /etc/init.d stuff

Scott Pack

2:03 PM

@TildalWave Yeah, the lady's garden can get awful messy to handle if it stays too moist for too long.

5

@lynks What distro are you running on?

Terry Chia

@ScottPack hehe

lynks

@ScottPack debian

Scott Pack

@lynks I don't know anything about managing services for debian. Does it still use sysV init scripts? I know many things are moving towards systemd or upstart. I don't know enough about either of them.

Antony Vennard

@lynks If you're on debian and you do have upstart, then you'll find config files in /etc/init and documentation everywhere for writing them. To manage, type start <name> or stop <name> and so on. If you're using sysv scripts, /etc/init.d/shellscript start simply copy an existing shell script.

Systemd uses systemctl start name.type as its syntax and config files live in /lib/systemd/system on fedora and are symlinked to their targets.

I think debian still uses chkconfig to enable services by default.

Scott Pack

/me seriously needs to read up on systemd

Just make sure you properly fill out the chkconfig header on the init script.

lynks

2:09 PM

@AntonyVennard I'll have to read up., but I have always controlled daemons using /etc/inid.d/apache2 stop (rightly or wrongly)

Antony Vennard

@lynks it's probably sysv scripts then. That actually still works for some things on ubuntu, though, which uses upstart.

lynks

i think i just gave myself another days work to do...

Scott Pack

Yay

Antony Vennard

3:23 PM

@lynks Sorry ;)

lynks

for anyone who has to make presentations: prezi.com i find the infinite-zoom feature really cool.

Rory McCune

@lynks I'm a great fan of Prezi used it for a couple of conf. presentations and it always seems to go down well..

lynks

A wild TOTP question appears. @ThomasPornin uses MasterBall.

Terry Chia

3:39 PM

@lynks Have not tried Prezi, but I am currently using rvl.io

Huh, apparently the Related questions list at the side of each question shows migrated questions as well.

Confused me for a moment.

lynks

@TerryChia you have an ear in the middle of your gravitar?

Terry Chia

@lynks Yes. :P

lynks

@TerryChia that really confused me for a second :P

Terry Chia

Apr 28 at 15:21, by ManishEarth

@Adnan your right ear looks pointy/elfin in the grav

Go from there.

lynks

heh

Terry Chia

3:50 PM

Any of you guys caught Iron Man 3 yet?

ManishEarth

gonna see it soon

Terry Chia

Someone should show Lt. Colonel James Rhodes this particular question. /slight spoiler

361

Q: XKCD #936: Short complex password, or long dictionary passphrase?

How accurate is this XKCD comic from August 10, 2011? XKCD 936: Password Strength I've always been an advocate of long rather than complex passwords, but most security people (at least the ones that I've talked to) are against me on that one. However, XKCD's analysis seems spot on to me. Am...

cryptography passwords entropy

lynks

ooooh downloading at 80MB/s is fun, thats what...640mbps :0

CodesInChaos

wtf hax

Terry Chia

@CodesInChaos O_O

lynks

3:56 PM

@CodesInChaos wgetting a googleapps.com file from an aws node :)

lynks

6:30 PM

WTF, steam locomotive is installed on our production server... : /

Gilles

@lynks backup power supply?

lynks

@Gilles cyberciti.biz/tips/…

Scott Pack

/me sighs

The worst is attempting to debug a regex that you are highly confident in, a tester displays is correct, but still fails to match.

TildalWave

6:50 PM

Anyone else finds SE a bit unresponsive today?

Xander

@ScottPack Anything goofy about the source data you're trying to find the match in? Something that's not outwardly visible but that could be causing the miss, like homoglyphs, or non-printable characters?

Lucas Kauffman

7:14 PM

anyone aware of a simple encryption algorithm (but stronger than rot13) which is not really secure but just helps obfuscating code?

Gilles

@LucasKauffman use a real encryption algorithm with the key computed in many steps over the normal course of the code

that makes it hard to deobfuscate without executing the code, but is easy to counter with a debugger (extract the key at the point of descriptions)

for better anti-RE tips:

Lucas Kauffman

@Gilles It's for AV evasion

(doing a course on shellcode)

might use DES or 3DES hen

*then

Gilles

@LucasKauffman why not AES?

Lucas Kauffman

@Gilles Isn't AES really hard to implement in assembly

wait

I don't need to write it myself

Gilles

7:30 PM

@LucasKauffman gcc -S

Polynomial

BUFFALO SOLDIER!

weird question

anyone happen to know of any "industrial" grade microSD cards?

something that can operate at unusual temperatures and run for extremely long times

high number of writes, extreme number of reads

lynks

@Polynomial you might struggle, high density flash isn't exactly super stable at the best of times.

TildalWave

@Gilles Where do you get all these nice Jin's PNGs from? If you have some location to share, it would come handy to others too I believe ;)

Polynomial

@lynks I'll probably build some kind of parity table if I can't get a microSD that does it for me.

should extend the lifetime somewhat

lynks

@Polynomial you could raid 1 a bunch of them :P

Polynomial

7:38 PM

haha

it's going into an Arduino, and I only have one microSD slot

Rory McCune

Just had a moment when coding of "oh that worked first time... unexpected" :P

Polynomial

I can handle 25% space reduction on 16GB, and all the data will be integrity checked using HMAC-SHA1

so fingers crossed it'll be alright

Gilles

@TildalWave what nice “Jin's PNGs”?? I don't have any PNGs

Polynomial

but I'd rather not implement all the extra parity junk.

lynks

@RoryMcCune I just spent half an hour trying to figure why a database driver wouldnt load when I had mispelled 'postgres' in the connection url...

Gilles

7:40 PM

@TildalWave I posted http://reverseengineering.stackexchange.com/, it one-boxes

Thomas Pornin

@Adnan: you appear to have weird misconceptions about how HTTP proxies work. I suggest you reconsider.

TildalWave

@Gilles Oh, didn't realize sorry

Rory McCune

@lynks that kind of typo is the worst, 'cause your mind just starts skipping it..

lynks

@RoryMcCune so universal balance is restored

Polynomial

I'm already using half of my code storage space for libs and the base handler code.

without even having any real functionality

lynks

7:41 PM

@RoryMcCune yeah and the error message you get from JDBC suggests it cant load the driver, what it really means is it cant find one that matches the url structure :(

Rory McCune

@lynks heh yeah. I'm working on persisting Nessus results using ActiveRecord and associations, so was kind of surprised to have it work first time..

TildalWave

hey @Adnan you don't have a day off work today?

Adnan

@TildalWave Yes, I've just come back from Helsinki, wild 2 days!

@ThomasPornin Thanks for letting me know. It pains me to say this, but I think you're wrong.

@ThomasPornin HTTP proxies (the ones you put in your browser's settings) are very different from web proxies.

Thomas Pornin

@Adnan Ooh, terminology issue. I see.

Adnan

@ThomasPornin Here's an example of a web proxy hidemyass.com/proxy

@ThomasPornin AKA, application-level proxy.

TildalWave

7:44 PM

@Adnan Nice :) Wild in what sense? We want all the dirty details!! :P

Thomas Pornin

@Adnan Since the original poster used "Web proxy" along with "VPN" and "SOCKS", I believe that he means "HTTP proxy" when he writes "Web proxy" -- and all other answers to the question assume the same.

Adnan

@TildalWave Oh! Yesterday I went to Helsinki for the student party! Thousands gathered in the main square and I think it's the only day in which you can approach all the finns.

Thomas Pornin

If you want to make a distinction with other vocabulary conventions, making it more explicit in your answer might help.

Adnan

@ThomasPornin Very true. I'll address that in my answer.

Gilles

@Adnan “web proxy” = “HTTP proxy” or “HTTP proxy + CONNECT”

TildalWave

7:46 PM

@ThomasPornin Frankly I avoided voting on any new answers exactly because of that, didn't know who's in the right

Adnan

@Gilles What is this called then?

Gilles

If you're using a different meaning of “web proxy”, I suggest switching to a different word, because everybody else uses “web proxy” synonymously with “HTTP proxy”

Adnan

Ahh.. Jesus! Guys, I'm not new here. I have a fair idea how HTTP proxies work. I'm insulted that you'd assume I didn't know that.

TildalWave

Is it OK to ask OP what country he's from? I think that might clear a few issues, it's usually well know how they implement Internet censorship and how to bypass it

Gilles

@Adnan I don't know what the general category is called. It is logical to call this a “web proxy”, but a bad idea, because the term “web proxy” already has a different meaning

Thomas Pornin

7:48 PM

@Adnan Well, you just assumed (and declared) that all other answers were wrong. Seems fair, then.

Adnan

@ThomasPornin I specifically said "Regarding web proxies"

Thomas Pornin

@Gilles This is well and concisely said, and I concur.

Adnan

@Gilles Well, they are called web proxies. Just because you think it's a bad idea, the name isn't gonna change.

Scott Pack

@Xander As it turns out, I was fucking myself.

2

TildalWave

@ScottPack so that's what took you so long to reply? :)))

Scott Pack

7:50 PM

@Xander That log file reports MACs in lower case, my regex came from a script that parsed a file that reported them in upper case. The tester defaulted to insensitive. I wasn't looking at that matching sequence closely enough.

@TildalWave Actually, no, the UPS guy came so I went to go install my wiper blades.

lynks

@Adnan i think "please read more about web proxies" and "Please take a look at my answer and correct yours" didn't help your cause. Also, for what it's worth, to me 'web proxy' means 'something that can proxy a browser session' so either a protocol level proxy, or an entire application service would both count.

Xander

@ScottPack Ah! That'll do it.

Scott Pack

@Xander Yeah. I was pretty well not happy.

lynks

anyways, home time o/

Adnan

Let's go together and Google for "web proxy" and see what we'll get.

Gilles

7:53 PM

@Adnan it's obvious that the question isn't refering to that meaning anyway: both VPN and SOCKS servers involve using your browser normally and changing browser or OS settings, so the intended meaning of “web proxy” is also changing a browser or OS setting, not accessing a different website

Proxy server

In computer networks, a proxy server is a server (a computer system or an application) that acts as an intermediary for requests from clients seeking resources from other servers. A client connects to the proxy server, requesting some service, such as a file, connection, web page, or other resource available from a different server and the proxy server evaluates the request as a way to simplify and control its complexity. Today, most proxies are web proxies, facilitating access to content on the World Wide Web. Uses A proxy server has a variety of potential purposes, including: * To kee...

(first Google hit for me, also the first DDG hit)

Adnan

@Gilles Please continue looking in the results page. See that the majority of top results.

Please don't get me wrong. I'm not trying to provoke arguments. Look at most of my comments and messages here, most of the time I declare my ignorance on many subjects.

TildalWave

frankly, I have no idea how HideMyAss is supposed to work, could I bother one of you for a quick one-liner digest? (I'm baking bread and can't go reading longer texts... turns out bread bakes faster than I read LOL)

Adnan

Hey, I am probably wrong. But in my whole Internet life, I've always seen that there's those kind of proxies are called web proxies.

Thomas Pornin

@Adnan Well, technically, the way you wrote your comments seemed optimized to trigger arguments (and it did).

Adnan

@ThomasPornin Absolutely true. The wording of my comments was probably not appropriate.

Thomas Pornin

7:58 PM

@Adnan It was appropriate if you wanted War, not appropriate if you sought Peace. It's all relative to your objectives.

2

Gilles

@Adnan ok, so you're not the only one to call these services “web proxies”. But they aren't what the question is refering to (it's about “proxy servers”, and those aren't “proxy servers”, they're web servers offering proxy services)

Mentioning those services in an answer is a good idea

Adnan

@ThomasPornin Well, I never seek a comment war. I'm just here to learn and (with my limited knowledge) teach.

Gilles

Saying that the other answers are wrong is clearly wrong

Adnan

@Gilles True. I have edited that part out.

Transcript for