Updates:
Added first challenge to prepare
We now have an IRC channel! Join us in #SecSE-CTF on Freenode: chat.freenode.net:6667
We have a CTFTime team, secse. Please join this.
We have a chat room on chat.se which will be closed during competitions to all but team members then re-opened when w...
I've written a presentation of the CTF team on the ctf tag wiki
someone approve my edit please
@LucasKauffman meta.security.stackexchange.com/questions/1117/… is the entry point for the Sec.SE CTF team, but it's full of history and not really readable for a newcomer, and it doesn't really explain how to join the team. Would you mind cleaning it up? Or I can do it if you prefer
I have a question about a encryption protocol, if it is good or not.
Bob and Alice communicate over an insecure channel( a possible attacker can listen). An expert suggests the following protocol to confirm that they have the same segret key without revealing this segret key to an opponent.
1) ...
There are 100 bytes with a CRC16. However I only know the first 50.
I want to change byte 5 from a known value X to another value Y, and fix up the CRC16 to be valid - without knowing bytes 50-100.
This is possible with the TCP checksum, because it's just addition. But CRC16 is a polynomial....
Today was the second time I came across an edit that was trying to remove/correct an OP's misconception. I'm sure this is has happened before and I'm sure it will happen again.
Here's an edit on the website-MAC-address question, and here's a suggested on the Dave-like question.
well this is interesting ^ google's sense of humor LOL
i guess that's the proper pronunciation if you're missing a few :))
@Adnan IMO OP's intended meaning should be preserved no matter what, while spelling, grammar, e.t.c. changes are made to it... I hate it also when the meaning changes all of a sudden and none of the previous answers make any sense because of it
Security is a complex endeavor, and knee-jerk reactions like “plaintext password? never” are just as bad as “passwords must contain special characters” or “my crypto's bigger than yours” or “if I can't understand it nobody can” if you don't consider the full context.
First, let's analyze the ass...
@Gilles This is exactly the answer I was hoping to find in that thread! Could you add to it the gist of what you later also say in comments? I think it's rather important and some might simply neglect to read comments as well, which would be a shame really
namely, the use of custom programmable HSMs that can handle such password verification as mentioned in the question... it's nothing too exotic nowadays any more but I've seen in other threads that mention HSMs that many didn't know some are offline programmable before they go online, making any such verification then relativelyeasy to implement
@Gilles It should suffice IMO... just mention it somewhere, I've actually been looking for it in your answer (kinda hardens against scenario #1 then) but only saw it later in comments... I don't think any real life examples are necessary, just the theoretical part where it prevents on site password leakage and similar... just so people get the idea there's other ways to store passwords than in their MySQL databases ;)
@TildalWave I know this is very much a TLDR answer. But the whole point is that you have to look at the scenario in detail before jumping to conclusions
NVM... much ado about nothing then... either I somehow missed it, or forgot about you mentioning it after reading comments also
@Gilles I only read TL;DR answers... shorter, and I fast-read them in a glimpse ;)
@Gilles Honestly, that's too often neglected also here in answers, and most are just the usual mantra of how to do things if you're an online e-commerce business, ad nauseum :)
@Gilles Well... true... tho that can be on an on and off basis really, I know that's the case with me. I joke about it with friends telling them I'm off for months long dive in my submarine when I'm on projects... of course, you then celebrate each resurfacing even more so than if you always were on shore ;)
oh, needless to say, I also tend to look like I just came from a few months voyage after I'm done with projects... not nice when you turn up yoghurt white on the beach in the middle of the summer and then lotus pink the next day LOL :)
Updates:
Added first challenge to prepare
We now have an IRC channel! Join us in #SecSE-CTF on Freenode: chat.freenode.net:6667
We have a CTFTime team, secse. Please join this.
We have a chat room on chat.se which will be closed during competitions to all but team members then re-opened when w...
I have a question about a encryption protocol, if it is good or not.
Bob and Alice communicate over an insecure channel( a possible attacker can listen). An expert suggests the following protocol to confirm that they have the same segret key without revealing this segret key to an opponent.
1) ...
There are 100 bytes with a CRC16. However I only know the first 50.
I want to change byte 5 from a known value X to another value Y, and fix up the CRC16 to be valid - without knowing bytes 50-100.
This is possible with the TCP checksum, because it's just addition. But CRC16 is a polynomial....
Today was the second time I came across an edit that was trying to remove/correct an OP's misconception. I'm sure this is has happened before and I'm sure it will happen again.
Here's an edit on the website-MAC-address question, and here's a suggested on the Dave-like question.
