« first day (1405 days earlier)      last day (3467 days later) » 
02:00 - 20:0020:00 - 22:00

2:41 AM
@ScottPack RE: tweet. looking for a log management system that is better than grep.
Splunk = expensive. logstash = overhead. graylog = unknown to me. papertrail = somewhere in the middle between all of them.
2 hours later…
4:19 AM
@jrg perl
WAAY better than grep
1 hour later…
5:20 AM
How long ago did the @Simon and thing start? What was the origin of that meme?
6:14 AM
@tylerl according to search @Simon first used it in this room in November 2013
before his arrival there were only ~15 mentions of incorrectly spelled doughnuts, now there's 7 pages of the stuff!
6:34 AM
Hey @jrg are you around?
6:44 AM
Anyone happen to know a Ubuntu package maintainer?
7:04 AM
It must be way too late. "Package maintainer" sounds like a euphemism for something, and I have the sudden urge to fit it into a "your mom" joke.
7:16 AM
@Iszi "Your mom manages my package just fine"
2 hours later…
9:26 AM
@avid if you're still looking to get a oneplusone phone you could look at this dailytech.com/OnePlus+to+Open+Preorders+on+October+27/…
myself I've decided that iPhone 6 will do me :)
@RоryMcCune Coming over to hipster-land are we? ;)
My friend today started lurking around SE chat rooms. He asked my about the purpose of the stars. After several seconds of laughing, I told him that, in theory, the star wall is for people who don't lurk for a long time to find relevant important news, discussion points, and other interesting things regarding the site to which the room is related.
I felt bad for lying to the poor guy.
@TerryChia currently running a 4S.. I like iPhones, they work and do what I want them to without a lot of faff, and they get patched :)
@RоryMcCune Ah, I always assumed you were using a WP8 device for some reason.
@Adnan well our top pinned result is actually vaguely infosec related...
9:30 AM
@RоryMcCune Hmm, you are right. We need to get rid of it...
@TerryChia tried one out for a while. It was ok but TBH I prefer iOS. I have had an iPad since the one, so always using it anyway
also have my new iPad Air 2 on order :)
@RоryMcCune Nice. :)
I'm sorely tempted by the new iMac but I hate all-in-ones.
@TerryChia delete the record of the Bears achievement.... not me !
@TerryChia yeah that's not one I'd be too interested in, although would be interested to hear how well that 5K screen works and what Graphics card they're using to drive it...
@RоryMcCune It's an AMD card.
It's cheap as hell for a 5k screen though, that's why it's tempting.
@TerryChia sure, though to drive that panel at 60+fps it'll need to be quite beefy..
9:33 AM
@RоryMcCune Nah, current gen GPUs can drive a 5k screen pretty well. It's the DP/HDMI cable that's the bandwidth bottleneck.
I presume Apple has non-standard hacks around that for the iMac since it's an all-in-one.
9:45 AM
@Lighty Don't the inbuilt FF devtools have that too?
@HamZa Are you sure? virustotal.com/en/url/…
@Adnan yes as it happened just now on my own computer. Note the method that was used "heuristic analysis"
@HamZa Does it block access to other URLs from security.stackexchange.com?
@Adnan nope, it's the first time. I guess it triggered an "alarm" because of the keyword "paypal", "email", "phone" in some way
9:55 AM
Very interesting
Have you reported that it's a mistake?
@HamZa Or maybe we are all scammers actually trying to phish you. ;)
@TerryChia haha, I'm waiting
Q: Is it possible to clone an RFID/NFC card using a simple RFID reader, for future reuse and impersonation?

SparklerRFID/NFC technology is used in credit cards and many other personal identification applications. Is it possible/how easy is it to clone a card using a simple RFID reader? In other words, can the retrieved information be reused in the future by the attacker?

^ my guess is yes but I don't have any source to back it up
10:14 AM
TL;DR In some cases of poor implementations, it's possible. However, new crypto NFC cards cannot be cloned
10:55 AM
@Adnan thanks
11:46 AM
@RоryMcCune the oneplus gets patched frequently. Think I have had 3 updates that looked interesting
@RoryAlsop I want a 1+ :(
@raz I'm very impressed with it
battery life is awesome
It also appears to cope very well with heavy rain
@RoryAlsop Was that a feature you were looking at when buying?
@RoryAlsop cool! it's good to see an Android manufacturer take that seriously, the key however is, how long will they provide patches for. With the rumoured 2+ out next year, you'd hope they'll commit to updates for the 1+ for at least 3+ years...
@raz sure. It wasn't just because it was a shiny and cheap :-)
oh, maybe
To be honest, it was battery, screen and processor that won
11:55 AM
@RoryAlsop androidvulnerabilities.org doesn't make great reading for android in general...
@RоryMcCune Because iPhone has no vulnerabilities >.>
@RоryMcCune I know. I have all the android phones (Two Galaxy S4s, one S3 and two HTCs) in our house on cyanogen, and updated very frequently.
@raz different vulnerabilities
different environment
different threat model
@RoryAlsop Kinda my point
@raz oh not at all, all software has vulns, it's how the vendors react that's important
the problem with Android is that fixing vulns is Google + handset manu + carrier
and their incentives to fix are not all the same
@RоryMcCune and carrier is usually the weakest link
11:58 AM
Vendors generally react pretty quickly. Samsung was quite good at sending out patches.
@raz really, can you find Samsung Galaxy phone support lifecycles publicly now?
@RoryAlsop Yeah the carrier's are the weakest link
last time I looked hardly any android manufacturers provided that
actually none that I found bar google but hey I might've missed one
also handet manufacturers have an incentive to push you to the new shiney and stop supporting the old less shiney as that's how they make money
@RоryMcCune Cyanogen has sorted things pretty well now, in that you don't even need to be a techie to use it. Grab cyanogen from play store, and it updates automagically
12:01 PM
But if someone is targeting my phone, then I've done something wrong in life.
@RoryAlsop ooh so they sorted the cyanogen in the play store thing cool!
@raz more worryingly as people move more of financial life to mobile devices is targeted malware that compromises phones as it provides access to browser info. plus common 2nd factor channels (e.g. SMS)
@RоryMcCune I've pretty much just given up on security. If something happens, it happens. I do my best, but I'm gonna buy the phone I like.
That's why I don't do any banking on my mobile phone. I didn't even install the banking app of my bank.
I did install Avast. Not sure if it's effective though. Just trying to make it difficult for malware authors
12:18 PM
@terry package maintainer for what?
@TerryChia any particular package?
If any of you is into CSS stuff css-tricks.com/examples/ShapesOfCSS
@Adnan It started slightly meh, but there are a couple pretty nice tricks.
Yup. I especially liked the infinity and Facebook
12:56 PM
@jrg Was wondering if you know anyone I can bug to get this fixed: bugs.launchpad.net/ubuntu/+source/libscrypt/+bug/1313311
Debian already has a patch out.
@RоryMcCune Are we doing the monthly rage against how Android security fixes are completely retarded?
@TerryChia I can tell you where I would start looking.
#ubuntu-hardened on freenode
I would start by raising a fuss there.
that's in the universe repo.
let me check something
@jrg Hehe. Was wondering if you know anyone on Ask Ubuntu that's a package maintainer before I do that.
The IRC rage is definitely the last resort. :)
#ubuntu-motu < ask nicely.
I will ask someone if they are still a master of the universe or not.
@jrg Will do, cheers! :)
but I doubt they are.
@TerryChia and i'm idling there, so feel free to poke me if you want me to read whatever they say or chime in.
The other thing to do would be to check and see if Unicorn has that bug or not.
1:05 PM
@jrg Aye, I joined the channel. I'll go take a shower before I start asking.
Because if unicorn doesn't have it, then it's a "Can you backport this fix?" type of issue, not a "can you fix this?"
and they will probably be slightly more open to backporting than fixing.
@TerryChia fun!
1:20 PM
@tylerl I'd say it blew up during the summer and the origin would be some British guy on YT calling his teammates "you donuts" when he's pissed off.
afternoon gents
Q: Does Google catches and keeps users typing patterns

farhang67Does Google catches and keeps users typing patterns for identifying purposes? for example when I'm logged in my Google account and Searching for things Google records my "Typing Pattern" like typing speed and ... and makes an unique signature for me and then Identify me when I'm using Google fro...

God damn man...
@Simon Conspiracy theory FTW!
Seriously, sigh.
@Simon Yeah I flagged that one
1:24 PM
@jrg I hate software. :(
@TerryChia Don't worry! Software hates you too!
@Arperum No arguments there.
In Soviet Russia, software program you!
There is absolutely no way this would work accurately. — Simon 11 mins ago
There are absolutely many ways to make this work.
What was that thing somebody posted here (maybe @Xander) about identifying writing pattern to de-anonymize data?
Couple that with some JavaScript in the browser (to detect mouse movement, and typing speed), and you get something neat
or was it @Scott who posted it?
I don't remember
@Adnan @TildalWave and I were discussing typing patterns for authentication the other day; the consensus was that it wasn't very practical.
1:39 PM
@TerryChia not practical at all but I'm still having great fun with it :P
@TerryChia As the only factor for authentication, I completely agree.
But I can see it being used adjacent to some other forms of authentication
Nobody picked up on TWSS alert?
@TildalWave We're mature adults now
well I'm playing with implementing sense of rhythm as an authentication factor so definitely not mature
@Adnan How on earth would you accurately identify someone by his typing habits?
Unless you believe that each individual has its own way of typing which can be identified (you'd have to show me some proof), this would never work.
Let's develop an authentication system based off our typing.
Well then, I stand corrected.
2:13 PM
@Xander Perfect! Thanks a lot!
fun times here today, plenty of powercuts to go around
still UPS is working ok so servers get to go down gracefully
@RоryMcCune Any reason?
@Simon you mean like with usernames and passwords? :)
@TildalWave lulz you donut.
2:34 PM
If a moon-synchronous orbit is impossible, the moon is a lie? — oerkelens 1 hour ago
like I said, they're always C# devs
@TildalWave Shouldn't that be "There are always C# devs"? Or am I misunderstanding?
@Arperum I meant that each time I'd check who's trolling on space.se I'd see c# as the top tag on the user's SO profile
@TildalWave In that case you did the correct thing and I did the misunderstanding.
@Adnan well it's v. stormy which is the most likely reason. Apparently there was a big problem with the network which is now <fingers crossed> resolved
2:52 PM
@RoryAlsop could be worse, a digger could go through your backhaul, and then the redundant links could fail due to some form of cascade, and an entire county could be without connectivity for a very big ISP.
Uh @RоryMcCune... ^
3:23 PM
@Tinned_Tuna yeah sorry I have anti-amiguous Rory pinging protection on... last year I did have a tree take my Phone line into a river. ADSL kept working surprisingly well untill it moved and snapped the line
only too BT 6 months to do the permanent repair (luckily their jury-rigged, "throw the line over a tree" method worked well in the interim)
sounds like you called for a BT Engineer and got MacGuyver.
@Tinned_Tuna weirdly all the engineers seemed to know about the "hammer trick" which is how they get lines across rivers when they're sent out on their own...
3:44 PM
@RоryMcCune "hammer trick" hehe.
I've been using this for a while. It's solid.
The idea is that it's 100% phishing-impossible.
@tylerl Yeah, FIDO is pretty awesome. I hope more sites adopt it soon.
@tylerl ooh cool, good idea to add something not reliant on mobile phones methinks..
@RоryMcCune FIDO is a protocol, you can implement it on phones, hardware tokens, in software etc.
@TerryChia ahh, I did not know that (keeping up to date everywhere is tricky these days!) d'ya have a link for the spec?
3:51 PM
Wait no, FIDO is the organization behind it. The spec is called U2F.
@TerryChia ta :)
Fido Solutions is a Canadian cellular telephone service provider owned by Rogers Communications. It used to be owned by Microcell Telecommunications. Although Fido's parent company, Rogers Communications, also operates another wireless brand named Rogers Wireless, customer service call centres, network servers and CEO. Fido pioneered the concept of providing unlimited service in select Canadian cities. Fido was the first carrier in Canada to launch a GSM-based network and the first wireless service provider in North America to offer General Packet Radio Service (GPRS) on its network. == History... ==
ahh I was wondering if it was like yubikey and I see they have a device which supports the protocol
3:53 PM
Yea, I saw that! I was kinda excited to go read the FIDO specs and see how they hold up. The web presence is banding a lot of terms about in a very marketing-heavy style, but they have links to the actual spec.
@RоryMcCune Many big names behind it so I have decent hopes for it.
Google are copycats, tsk tsk.
3:54 PM
@Tinned_Tuna It's pretty solid from my rather minimal knowledge of crypto.
@RоryMcCune 10/10 would read again.
@RоryMcCune Star-worthy.
derp, sorry. @TerryChia I don't think that's going to save it. It could be design-by-committee madness
@Tinned_Tuna The crypto behind it is solid, it doesn't look difficult to implement and they have an actual spec plus products out. Pretty well done job so far imo.
It's a damn solid improvement over TOTP.
3:57 PM
perhaps I should read the specs and blog about it
@Tinned_Tuna How hipster of you.
@TerryChia indeed, I am so hipster it's not even funny. Nothing like having so much hip I can't see my feet.
I'll probably have to read the spec at some point to integrate it into our product anyways...
4:14 PM
Has anybody heard of the new embargoed key-recovery attack (2^64) against AES-256?
@Adnan Wut seriously?? First I have heard of this.
@Adnan Technically, if it is embargoed, you should not have heard about it...
@ThomasPornin Says the guy who spoiled POODLE for Google.
@TerryChia Hussh.. ruined my plan to have @Thomas discover such attack
4:38 PM
@Adnan 2^64 is too ambitious
you need to start with something easier like a simple unspecified key reduction
@AJHenderson If that thing exists it's probably the crypto vulnerability of the decade.
@TerryChia more than the decade
that'd be the crypto vulnerability of the century
@AJHenderson ... so far.
@AJHenderson Well, this century is just starting...
I just meant of the last 100 years
4:40 PM
The century is still young !
not 2000-2100
3DES uses a 168-bit key but suffers from a meet-in-the-middle attack that can be used to reduce the strength to 2^112. It is not inconceivable that a similar structural flaw would affect any other algorithm, e.g. AES
Though, of course, none is known right now.
yes, but reducing 256 to 64 would be extreme
There are folks who're convinced that there will be a serious (as in, akin to DES's linear cryptanalysis) break of AES in the next 5 years or so. I don't take them all that seriously.
@Tinned_Tuna anyone that isn't coming out of the NSA conspiracy theory camp?
4:45 PM
@Tinned_Tuna Yet the number of systems which were actually broken because of DES linear cryptanalysis is exactly zero.
@AJHenderson I'd have to double check, in all likely hood, I think they're just more confident of the ability of the researchers around at the moment and scared by the apparent simplicity of AES
which got awfully inflamed by snowden, but lets be honest, nothing he revealed was really a surprise to any serious IT Security type, more just a confirmation of means and methods we already expected as likely/possible
Because 2^43 known plaintext/ciphertext blocks is still a huge, impractical number.
@ThomasPornin although, taking the techniques of linear & diff to other ciphers was surprisingly fruitful, if I recall?
@Tinned_Tuna Simplicity isn't a bad thing in crypto algorithms.
4:47 PM
@Tinned_Tuna Not exactly. Differential cryptanalysis turned out to be a useful framework for breaking MD5.
@Tinned_Tuna interestingly, most of the fears I've ever heard about AES revolve around the mysterious nature of the s-boxes
rather than the simplicity
And it "damaged" (academically) a few encryption algorithms, although rarely lethally.
@AJHenderson the AES SBoxes aren't mysterious, the design criteria is public
@Tinned_Tuna Yes, but for someone with a poor grasp of mathematics they are mysterious.
@AJHenderson That reminds me, I saw a vendor marketing a product at a recent con that customizes the AES s-boxes and store them in a hardware device. I was laughing pretty hard.
4:48 PM
@Tinned_Tuna I forget the arguments because I didn't pay them much attention
@ThomasPornin most crypto is mysterious to those with a poor grasp of maths
Most conspiracy theorists think in terms of: "I don't know this information because they hide it from me"; instead of: "I don't know this information because I am a complete doughnut".
@ThomasPornin Hey, well done.
@Simon He spelled doughnut right.
@TerryChia He's an ex-Euro, he's a lost cause.
4:50 PM
Meanwhile, after 24h, the "PKI from NSA" answer has reptrained and accumulated 74 upvotes.
I believe it had something to do with the way they are being selected potentially leading to encryption with an achilies heel, but I never paid that much attention to what the arguments were because I thought they were silly
@ThomasPornin Anything with "NSA" and "crypto" in it pretty much attracts idiots who know nothing about the topic nowadays.
@AJHenderson that was the fears with the DES SBoxes, but it turned out they actually strengthed the SBoxes against differential cryptanalysis
@Tinned_Tuna oh, was that DES, never mind then, I guess I shouldn't try pulling 7 year old paranoia theories out of the recesses of my memory
@AJHenderson lol.
4:53 PM
@Tinned_Tuna According to Don Coppersmith, the smart guy at IBM (including Coppersmith) had actually strengthened the boxes all by themselves, and the NSA merely verified that fact.
Which would mean that differential cryptanalysis had already been discovered twice before Biham and Shamir published it in 1987.
Yaaay! I started something that actually turned into a discussion about security.
@Adnan It's boring.
@Simon That's because you don't understand any of it.
@TerryChia That is a known fact.
the thing that people always forget about the NSA is that while they may make back room deals to get access to things through covert methods, at the end of the day, if they compromised major protocols intentionally in a way that could be exploited and it got used against US corporate interests, they would be screwed 6 ways to sunday
and they know it
5:14 PM
@ThomasPornin oo, nice :-) I was also under the impression that the NSA requested/required the key length be shortened?
@TerryChia why, what did they say?
5:38 PM
@Tinned_Tuna Yes, they also asked for the key length to be reduced from 64 to 56 bits.
Which was obviously in order to be able to break it brutally, in case of emergency.
6:04 PM
heh, "emergency"
@ThomasPornin As South Park's 9/11 Conspiracy Episode stated: 25% of the population is dumb enough to believe it, so why not start it?
6:26 PM
@raz that reminds me I never got around to watching that episode
the really scary part is that only 20% of the population actually decides anything
roughly 40% vote D and 40% vote R regardless of anything else
Guys, anybody uses Microsoft RDP here?
as in remote desktop?
are we trying to have Thomas find another vulnerability
I'm trying to connect to a server, but it's giving me
"The number of connections to this computer is limited and all connections are in use..."
6:28 PM
There was some trick to kick the other users
I don't remember it
and I cannot find it
I remember it was something you do with the command line
is it setup as an admin RDP or a TS RDP?
@AJHenderson Admin RDP
is it on the local network or remote access?
ie, can you RPC to it
@AJHenderson I can
6:30 PM
you can use RPC to kick one of the sessions
@AJHenderson See?
That's what I don't remember how to do
you need the server admin tools installed
Hmmm.. I've done it before, so I assume they are
and you use MMC to connect to the RDP settings of the machine
let me get the exact snap-in name for you
hmm, I never installed them on my computer at this job... go figure
let me check on my server, that will have it
(you might also be able to do it by specifying to log in to the console, but I don't remember if that boots someone or not)
"Remote Desktop Services Manager"
is the snap in you need for MMC
it should give you a list of all connected clients
you can message or boot as needed
provided you have admin access to the box
@AJHenderson Yup, got admin access
@AJHenderson Can't find that snap-in
@AJHenderson I have them
it should be there then, does it not show up under snapins when you launch MMC?
Using MMC, I'm now controlling a few things (like users, groups, blah blah)
@Adnan run mstsc /admin
I've already connected to the box using net use
@Xander Tried it. Didn't work (found it on SU)
I don't know what's happening!
6:42 PM
/admin just puts a ts box in admin mode
@Adnan Hmm. That used to be the trick.
@AJHenderson It's a pretty hilarious episode
I'm trying to reset session /server:
but I don't know the session number, and the query session is giving me access denied
what OS are you running locally?
Windows 7
and the remote is Windows 7
6:46 PM
@Adnan Are you local admin on the remote?
@Xander Yes
I usually have remote access and I fully manage the box
you could try psloggedon maybe
I don't remember what that tells you about the remote users
it might give you the session id
Fuck it! I net use connected to it and then shutdown /m its ass.
I forgot /r
6:51 PM
rut row
so how far away is that box?
@AJHenderson 9km
well that's unfortunate
particularly if it is up or down
not that far, but I don't have a car and it's -2C
I'm not an expert on this, so correct me if I'm wrong. If I VPN to the same network, would it be possible to Wake-On-LAN?
@Adnan if you have wake on lan configured on the box
@AJHenderson It is
6:55 PM
but BIOS has to be setup for it so that the network card is kept powered
and listening
then yes, you should be able to WOL it
if you know the mac address
Jesus. According to this, it's painful
Q: Can Wake on LAN work on VPN connection?

Ian RingroseIs it true that we can’t allow any machine to sleep that may need to be accessed var a VPN connection? (I am asking this on server fault as it is as much about VPN servers as about the end user PCs sleeping)

I use my router at home for doing WOL
Some routing, and some configurations on the VPN gateway
@Adnan The fastest will probably end up being to physically turn it on.
6:59 PM
@Simon Ahh :(
Yup. I'll do that
is it actually a home computer?
7:13 PM
@Adnan To active WoL, you need the target ethernet card (physical) to see a packet that contains the magic sequence.
Since the target machine is off, it won't respond to the ARP protocol, so you have to use some sort of broadcast packet.
I.e. the ethernet frame must be "broadcast".
This is relatively easy if you have access to another machine on the same LAN.
If you don't then it depends on whether the various routers will accept to propagate an IP packet that contains a "broadcast" UDP or ICMP (the packet types that, at the ethernet level, turn into a "broadcast frame").
@ThomasPornin Any comments to this? security.stackexchange.com/questions/71187/… Because you have the top answer (and accepted) so it's unlikely any other post will ever get on top... If I'm not making some mistake in my comment, it might be a good idea to change your answer.
At the very least so it favors the mktemp solution instead of some hexadecimal output.
7:30 PM
@Luc Hexadecimal means 16 distinct characters. Same-case letters means 26 distinct characters. The difference is not huge.
With 26 possible letters, you need a bit more than 27 characters to encode 128 bits of entropy (so, really, 28 characters). With 16 signs, you need 32 characters.
The difference between 28 and 32, in terms of ease of remembering and typing, is not huge enough to warrant modifications.
The point of the exercise, as I see it, was to make a one-liner that works everywhere and fits in one line.
Hence my insistence of using only commands from coreutils, called from bash.
The exercise is indeed a bit pointless, but hey, that's the Internet.
I think the question is good and not pointless, in fact I generate passwords like this regularly (well, using pwgen instead of some coreutils oneliner)
and nobody is going to remember a 32-character or 28-character password anyway, not if they're not words and not edward snowden himself
so if we're going to use max 12-character passwords, better use the available character set
The OP asked for a password with 128 bits of entropy (and that's overkill).
true, that part is a bit overkill
what I meant by same-case characters is that hex is not easier to remember than same-case alphanumerics, so we might as well use the latter because it increases security at zero extra cost. Maybe mixed-case and special characters also make no difference to memorize (it's all random anyway), but I'm not sure. At the very least we could use a reasonable character set instead of hexadecimals.
@Adnan - it looks like at some point they made the admin tools disabled by default, so first you have to run that hotfix, then you have to actually enable it from Windows Features
then they should show up in MMC
7:53 PM
@ThomasPornin So basically your reasoning is that the OP asked an impractical question so you give an impractical answer? (because you can't tell me that 32 random characters is practical to remember)
@Luc Yes, that is what happens when I answer with Bear #1. Tom Leek would have insulted the OP over a hundred lines of various curses.
@Adnan lolwut is it already that cold there? It's starting to become 10C here and people are finding it "cold"
@ThomasPornin Oooohh! God damn it! How did that slip my mind?!
I do have access to another machine on the same LAN
It actually has a small WOL application specifically for that purpose
I feel stupid right now
@Luc The OP asked for a readable password, not a memorable password.
@Xander Fair enough, but readers are going to come here who will simply want to generate a secure password. Don't we educate users anymore on what is useful and what is not?
7:59 PM
@Xander Yes. I actually work with readable passwords myself; this is part of procedures where the passwords are huge, split into several parts, and kept in sealed envelopes.
Nobody remembers these passwords, that are used only once every three years or so.
02:00 - 20:0020:00 - 22:00

« first day (1405 days earlier)      last day (3467 days later) »