The DMZ

« first day (912 days earlier) ← previous day next day → last day (3958 days later) »

12:03 AM

It is pretty relevant as ssl slows a network down aswell as it raises exceptions in some browsers. In firefox a totally legitimate thwate certificate is shown as a certificate for an "unknown company". Without the certificate it wouldn't have even shown the message. People are more likely to not visit the site after that message than having been presented with no message at all. As even ssl-protected sites can be easily observed with Firesheep I see almost no use in using this protection at all. — Zurechtweiser 6 mins ago

This guy is bound and determined to convince the world that SSL is unnecessary overkill.

CodesInChaos

and then there are the guys who think that NSA can break everything except OTP

but consider generating the OTP with a csprng...

Iszi

12:20 AM

@AviD @RoryAlsop @JeffFerland Do you guys want to pop something similar to this on our Meta?

Q: What should be our Off-Topic reasons?

Changes are coming to the Question Closing system. The existing Vote To Close reasons are being overhauled. We've already seen some of these changes in the Duplicate Question area. That link above has a full rundown of the changes, and I recommend reading it, but this question is for one speci...

Gilles

@Iszi I don't see why, we don't have any common non-intuitive excluded topic here

it's expected that many sites don't need custom reasons

Iszi

@Gilles So, under the new system, we'll have to do manual entry every time we close as OT?

Gilles

@Iszi ??? No, it's optional

Iszi

I expect they will (or at least should) impose a minimum length for free-form off-topic reasons, to ensure that the user does get feedback as to why the question is off-topic. That is the whole reason for this overhaul after all.

Xander

@Gilles @Iszi I'd say the one we see regularly is the TL - "Please decrypt this / Tell me which algorithm/function this ciphertext/hash was generated with."

1 hour later…

Iszi

1:41 AM

Ack. I hate to turn down @troyhunt, but isn't this more of an Super User question?

Q: Is there any way to get Chrome 27 to trust a self-signed cert?

I'm running latest gen Chrome (27) and preparing a demo that requires using a self-signed cert to support HTTPS on a local IIS website. The cert has been created with the correct common name for the website (good little guide here) and then added to the trusted root certs on the local machine. I...

certificates chrome

7 hours later…

Lucas Kauffman

8:26 AM

Sup bronies

Guys is a question about resources for fuzzing lists on topic?

TildalWave

9:17 AM

@LucasKauffman lol @ bronies :) goedemorgen!

@LucasKauffman say what? you mean prebuilt fuzzer lists that you could include in yours? we had similar questions before for password dictionaries, nobody seems to have been bothered by them:

Q: Where can I find good dictionaries for dictionary attacks?

I’m wondering where I can find good collections of dictionaries which can be used for dictionary attacks? I've found some through Google, but I’m interested in hearing about where you get your dictionaries from.

passwords attacks authentication brute-force

Terry Chia

@TildalWave That's pretty long ago. I think we strongly discourage list questions now.

TildalWave

one example, there are others

@TerryChia oh, didn't know :(

Terry Chia

@TildalWave Unlike @ScottPack, we have standards now.

TildalWave

9:34 AM

@ManishEarth Ha! I would really like to downvote that question, but I haven't enough rep on mSO to do so. Serves them right, and their "downvotes here are different than on other SE sites and it's all for your own good" reasoning :)))

The guy is still suspended for 4 more days on Sec.SE

Terry Chia

9:52 AM

@D3C4FF Were you the one looking for a tool to parse comments in HTML code a while back?

CodesInChaos

10:30 AM

@TildalWave I think I should update my list of stackexchange user email addresses so I can troll people like him :)

combine that with the classical IP viewer images and he'll get really paranoid

5 hours later…

copy

4:00 PM

Never heard of that provider name

CodesInChaos

in my experience it works for most people

but perhaps their database is a bit old. Those signatures where popular 10 years ago

Simon

4:46 PM

Ahoy

1 hour later…

Lucas Kauffman

5:50 PM

@Adnan can America hax you? They have super compiuter they crack RSA yes?

love those questions

Adnan

6:17 PM

@LucasKauffman Why do you love these question? Do you use to collect information about what people think of the intelligence agencies? ANSWER ME, NSA AGENT!!

@Lucas Also, no word from PasswordBox yet?

Lucas Kauffman

@Adnan suddenly Adnan hears windows shatter as NSA agents raid his house

let me check my account

nope

no response

ah need to go for dinner

brb

Adnan

@LucasKauffman tyt

Ahh! Look at me! Talking in young people's language

CodesInChaos

@LucasKauffman For RSA 1024 we can't exclude that possibility

I don't think it's likely, but for somebody like the NSA that should be at the edge of feasability

Lucas Kauffman

7:20 PM

Agreed they do seem to have shitloads of money and it would not surprise me that they use their intelligence as advantage to gain more funds ( eg insider trading)

Adnan

@LucasKauffman But, you know, I'm most concerned about the 0day thing. They don't need to brute-froce or use social engineering or whatever. They'd just type my Internet-facing machine's IP and they're in.

Lucas Kauffman

7:47 PM

@Adnan well yea, but that's already been known since the first analysis of Stuxnet

CodesInChaos

8:40 PM

Is this question on topic here, or is it just not constructive?

A: 448-bit Blowfish, considering the 64-bit blocksize, is it secure at all for large files/volumes? (Crashplan)

A distinguisher is a pretty weak attack. It doesn't allow an attacker to decrypt the data, it only allows them to figure out that is is encrypted data, not random data. The impact of 64 bit blocks depends a lot on the chosen mode. With single-use keys in CTR mode the problems are minor. There ...

Xander

@CodesInChaos Yeah, I'd say it's on-topic here. I was just reading a question yesterday about the security implications of block sizes.

CodesInChaos

it's a bit ranty and smells non constructive. So I'm not 100% sure.

Xander

@CodesInChaos After re-reading it, I'd say the first two paragraphs are on topic. The rest is, as you say, rant.

2 hours later…

Adnan

10:19 PM

@MarkY. Hello

I was writing you an answer for your question.

It was a bit long, though. Allow me to summarize it: Someone will capture your authentication handshake and attempt an offline attack. Have your password strong enough, and the attack will be extremely infeasible.

copy

10:31 PM

Is it usually possible (I know that it's theoretically possible) to jump to kernel code without a mode switch and then run only unprivileged instructions?

In any existing OS

« first day (912 days earlier) ← previous day next day → last day (3958 days later) »

all rooms