The DMZ

jrg

2:41 AM

@ScottPack RE: tweet. looking for a log management system that is better than grep.

Splunk = expensive. logstash = overhead. graylog = unknown to me. papertrail = somewhere in the middle between all of them.

tylerl

4:19 AM

@jrg perl

(duh)

WAAY better than grep

tylerl

5:20 AM

How long ago did the @Simon and donuts thing start? What was the origin of that meme?

Rоry McCune

6:14 AM

@tylerl according to search @Simon first used it in this room in November 2013

before his arrival there were only ~15 mentions of incorrectly spelled doughnuts, now there's 7 pages of the stuff!

Terry Chia

6:34 AM

Hey @jrg are you around?

Terry Chia

6:44 AM

Anyone happen to know a Ubuntu package maintainer?

Iszi

7:04 AM

It must be way too late. "Package maintainer" sounds like a euphemism for something, and I have the sudden urge to fit it into a "your mom" joke.

Tinned_Tuna

7:16 AM

@Iszi "Your mom manages my package just fine"

2

Rоry McCune

9:26 AM

@avid if you're still looking to get a oneplusone phone you could look at this dailytech.com/OnePlus+to+Open+Preorders+on+October+27/…

myself I've decided that iPhone 6 will do me :)

Terry Chia

@RоryMcCune Coming over to hipster-land are we? ;)

Adnan

My friend today started lurking around SE chat rooms. He asked my about the purpose of the stars. After several seconds of laughing, I told him that, in theory, the star wall is for people who don't lurk for a long time to find relevant important news, discussion points, and other interesting things regarding the site to which the room is related.

I felt bad for lying to the poor guy.

Rоry McCune

@TerryChia currently running a 4S.. I like iPhones, they work and do what I want them to without a lot of faff, and they get patched :)

Terry Chia

@RоryMcCune Ah, I always assumed you were using a WP8 device for some reason.

Rоry McCune

@Adnan well our top pinned result is actually vaguely infosec related...

Terry Chia

9:30 AM

@RоryMcCune Hmm, you are right. We need to get rid of it...

Rоry McCune

@TerryChia tried one out for a while. It was ok but TBH I prefer iOS. I have had an iPad since the one, so always using it anyway

also have my new iPad Air 2 on order :)

Terry Chia

@RоryMcCune Nice. :)

I'm sorely tempted by the new iMac but I hate all-in-ones.

Rоry McCune

@TerryChia delete the record of the Bears achievement.... not me !

@TerryChia yeah that's not one I'd be too interested in, although would be interested to hear how well that 5K screen works and what Graphics card they're using to drive it...

Terry Chia

@RоryMcCune It's an AMD card.

It's cheap as hell for a 5k screen though, that's why it's tempting.

Rоry McCune

@TerryChia sure, though to drive that panel at 60+fps it'll need to be quite beefy..

Terry Chia

9:33 AM

@RоryMcCune Nah, current gen GPUs can drive a 5k screen pretty well. It's the DP/HDMI cable that's the bandwidth bottleneck.

I presume Apple has non-standard hacks around that for the iMac since it's an all-in-one.

HamZa

9:45 AM

^ wooot, when I tried opening security.stackexchange.com/questions/71143/…

ManishEarth

@Lighty Don't the inbuilt FF devtools have that too?

Adnan

@HamZa Are you sure? virustotal.com/en/url/…

HamZa

@Adnan yes as it happened just now on my own computer. Note the method that was used "heuristic analysis"

Adnan

@HamZa Does it block access to other URLs from security.stackexchange.com?

HamZa

@Adnan nope, it's the first time. I guess it triggered an "alarm" because of the keyword "paypal", "email", "phone" in some way

Adnan

9:55 AM

Very interesting

Have you reported that it's a mistake?

HamZa

yes

Terry Chia

@HamZa Or maybe we are all scammers actually trying to phish you. ;)

HamZa

@TerryChia haha, I'm waiting

3

Q: Is it possible to clone an RFID/NFC card using a simple RFID reader, for future reuse and impersonation?

RFID/NFC technology is used in credit cards and many other personal identification applications. Is it possible/how easy is it to clone a card using a simple RFID reader? In other words, can the retrieved information be reused in the future by the attacker?

^ my guess is yes but I don't have any source to back it up

Adnan

10:14 AM

@HamZa 0b4af6cdc2f0c5998459-c0245c5c937c5dedcca3f1764ecc9b2f.r43.cf2.r…

TL;DR In some cases of poor implementations, it's possible. However, new crypto NFC cards cannot be cloned

HamZa

10:55 AM

@Adnan thanks

Rory Alsop

11:46 AM

@RоryMcCune the oneplus gets patched frequently. Think I have had 3 updates that looked interesting

raz

@RoryAlsop I want a 1+ :(

Rory Alsop

@raz I'm very impressed with it

battery life is awesome

It also appears to cope very well with heavy rain

raz

@RoryAlsop Was that a feature you were looking at when buying?

Rоry McCune

@RoryAlsop cool! it's good to see an Android manufacturer take that seriously, the key however is, how long will they provide patches for. With the rumoured 2+ out next year, you'd hope they'll commit to updates for the 1+ for at least 3+ years...

Rory Alsop

@raz sure. It wasn't just because it was a shiny and cheap :-)

oh, maybe

To be honest, it was battery, screen and processor that won

Rоry McCune

11:55 AM

@RoryAlsop androidvulnerabilities.org doesn't make great reading for android in general...

raz

@RоryMcCune Because iPhone has no vulnerabilities >.>

Rory Alsop

@RоryMcCune I know. I have all the android phones (Two Galaxy S4s, one S3 and two HTCs) in our house on cyanogen, and updated very frequently.

@raz different vulnerabilities

different environment

different threat model

raz

@RoryAlsop Kinda my point

Rоry McCune

@raz oh not at all, all software has vulns, it's how the vendors react that's important

the problem with Android is that fixing vulns is Google + handset manu + carrier

and their incentives to fix are not all the same

Rory Alsop

@RоryMcCune and carrier is usually the weakest link

raz

11:58 AM

Vendors generally react pretty quickly. Samsung was quite good at sending out patches.

Rоry McCune

@raz really, can you find Samsung Galaxy phone support lifecycles publicly now?

raz

@RoryAlsop Yeah the carrier's are the weakest link

Rоry McCune

last time I looked hardly any android manufacturers provided that

actually none that I found bar google but hey I might've missed one

also handet manufacturers have an incentive to push you to the new shiney and stop supporting the old less shiney as that's how they make money

raz

true

Rory Alsop

@RоryMcCune Cyanogen has sorted things pretty well now, in that you don't even need to be a techie to use it. Grab cyanogen from play store, and it updates automagically

raz

12:01 PM

But if someone is targeting my phone, then I've done something wrong in life.

Rоry McCune

@RoryAlsop ooh so they sorted the cyanogen in the play store thing cool!

@raz more worryingly as people move more of financial life to mobile devices is targeted malware that compromises phones as it provides access to browser info. plus common 2nd factor channels (e.g. SMS)

raz

@RоryMcCune I've pretty much just given up on security. If something happens, it happens. I do my best, but I'm gonna buy the phone I like.

HamZa

That's why I don't do any banking on my mobile phone. I didn't even install the banking app of my bank.

I did install Avast. Not sure if it's effective though. Just trying to make it difficult for malware authors

jrg

12:18 PM

@terry package maintainer for what?

@TerryChia any particular package?

Adnan

If any of you is into CSS stuff css-tricks.com/examples/ShapesOfCSS

Arperum

@Adnan It started slightly meh, but there are a couple pretty nice tricks.

Adnan

Yup. I especially liked the infinity and Facebook

Terry Chia

12:56 PM

@jrg Was wondering if you know anyone I can bug to get this fixed: bugs.launchpad.net/ubuntu/+source/libscrypt/+bug/1313311

Debian already has a patch out.

@RоryMcCune Are we doing the monthly rage against how Android security fixes are completely retarded?

jrg

@TerryChia I can tell you where I would start looking.

#ubuntu-hardened on freenode

I would start by raising a fuss there.

Actually...

that's in the universe repo.

let me check something

Terry Chia

@jrg Hehe. Was wondering if you know anyone on Ask Ubuntu that's a package maintainer before I do that.

The IRC rage is definitely the last resort. :)

jrg

#ubuntu-motu < ask nicely.

I will ask someone if they are still a master of the universe or not.

Terry Chia

@jrg Will do, cheers! :)

jrg

but I doubt they are.

@TerryChia and i'm idling there, so feel free to poke me if you want me to read whatever they say or chime in.

The other thing to do would be to check and see if Unicorn has that bug or not.

Terry Chia

1:05 PM

@jrg Aye, I joined the channel. I'll go take a shower before I start asking.

jrg

Because if unicorn doesn't have it, then it's a "Can you backport this fix?" type of issue, not a "can you fix this?"

and they will probably be slightly more open to backporting than fixing.

Terry Chia

@jrg Doesn't look like it from the changelog. changelogs.ubuntu.com/changelogs/pool/universe/libs/libscrypt/…

jrg

@TerryChia fun!

Simon

1:20 PM

@tylerl I'd say it blew up during the summer and the origin would be some British guy on YT calling his teammates "you donuts" when he's pissed off.

TildalWave

afternoon gents

Simon

0

Q: Does Google catches and keeps users typing patterns

Does Google catches and keeps users typing patterns for identifying purposes? for example when I'm logged in my Google account and Searching for things Google records my "Typing Pattern" like typing speed and ... and makes an unique signature for me and then Identify me when I'm using Google fro...

privacy google

God damn man...

Arperum

@Simon Conspiracy theory FTW!

Simon

Seriously, sigh.

raz

@Simon Yeah I flagged that one

Terry Chia

1:24 PM

@jrg I hate software. :(

Arperum

@TerryChia Don't worry! Software hates you too!

Terry Chia

@Arperum No arguments there.

raz

In Soviet Russia, software program you!

Adnan

There is absolutely no way this would work accurately. — Simon 11 mins ago

There are absolutely many ways to make this work.

What was that thing somebody posted here (maybe @Xander) about identifying writing pattern to de-anonymize data?

Couple that with some JavaScript in the browser (to detect mouse movement, and typing speed), and you get something neat

or was it @Scott who posted it?

I don't remember

Terry Chia

@Adnan @TildalWave and I were discussing typing patterns for authentication the other day; the consensus was that it wasn't very practical.

TildalWave

1:39 PM

@TerryChia not practical at all but I'm still having great fun with it :P

Adnan

@TerryChia As the only factor for authentication, I completely agree.

But I can see it being used adjacent to some other forms of authentication

TildalWave

Nobody picked up on TWSS alert?

Adnan

@TildalWave We're mature adults now

Heheheheahaha

TildalWave

well I'm playing with implementing sense of rhythm as an authentication factor so definitely not mature

Simon

@Adnan How on earth would you accurately identify someone by his typing habits?

Unless you believe that each individual has its own way of typing which can be identified (you'd have to show me some proof), this would never work.

Xander

1:55 PM

@Adnan That was me.

bits.blogs.nytimes.com/2012/01/03/…

Also this paper: randomwalker.info/publications/author-identification-draft.pdf

It's called stylometry.

Simon

Let's develop an authentication system based off our typing.

Xander

@Simon It's been done. schneier.com/blog/archives/2005/11/authenticating.html

Simon

Well then, I stand corrected.

Adnan

2:13 PM

@Xander Perfect! Thanks a lot!

Rоry McCune

fun times here today, plenty of powercuts to go around

still UPS is working ok so servers get to go down gracefully

Adnan

@RоryMcCune Any reason?

TildalWave

@Simon you mean like with usernames and passwords? :)

Simon

@TildalWave lulz you donut.

TildalWave

2:34 PM

If a moon-synchronous orbit is impossible, the moon is a lie? — oerkelens 1 hour ago

like I said, they're always C# devs

Arperum

@TildalWave Shouldn't that be "There are always C# devs"? Or am I misunderstanding?

TildalWave

@Arperum I meant that each time I'd check who's trolling on space.se I'd see c# as the top tag on the user's SO profile

Arperum

@TildalWave In that case you did the correct thing and I did the misunderstanding.

Rоry McCune

@Adnan well it's v. stormy which is the most likely reason. Apparently there was a big problem with the network which is now <fingers crossed> resolved

Tinned_Tuna

2:52 PM

@RoryAlsop could be worse, a digger could go through your backhaul, and then the redundant links could fail due to some form of cascade, and an entire county could be without connectivity for a very big ISP.

Uh @RоryMcCune... ^

Rоry McCune

3:23 PM

@Tinned_Tuna yeah sorry I have anti-amiguous Rory pinging protection on... last year I did have a tree take my Phone line into a river. ADSL kept working surprisingly well untill it moved and snapped the line

only too BT 6 months to do the permanent repair (luckily their jury-rigged, "throw the line over a tree" method worked well in the interim)

Tinned_Tuna

haha

sounds like you called for a BT Engineer and got MacGuyver.

Rоry McCune

@Tinned_Tuna weirdly all the engineers seemed to know about the "hammer trick" which is how they get lines across rivers when they're sent out on their own...

Terry Chia

3:44 PM

@RоryMcCune "hammer trick" hehe.

tylerl

This is a very big deal: Google 2-factor supports challenge-response security tokens

I've been using this for a while. It's solid.

The idea is that it's 100% phishing-impossible.

Terry Chia

@tylerl Yeah, FIDO is pretty awesome. I hope more sites adopt it soon.

Rоry McCune

@tylerl ooh cool, good idea to add something not reliant on mobile phones methinks..

Terry Chia

@RоryMcCune FIDO is a protocol, you can implement it on phones, hardware tokens, in software etc.

Rоry McCune

@TerryChia ahh, I did not know that (keeping up to date everywhere is tricky these days!) d'ya have a link for the spec?

Terry Chia

3:51 PM

Wait no, FIDO is the organization behind it. The spec is called U2F.

Simon

QOTW!!!!!!!!!!!!!!!!!!!!!!!!!!!!

Terry Chia

@RоryMcCune fidoalliance.org/specifications

Rоry McCune

@TerryChia ta :)

Simon

Fido Solutions

Fido Solutions is a Canadian cellular telephone service provider owned by Rogers Communications. It used to be owned by Microcell Telecommunications. Although Fido's parent company, Rogers Communications, also operates another wireless brand named Rogers Wireless, customer service call centres, network servers and CEO. Fido pioneered the concept of providing unlimited service in select Canadian cities. Fido was the first carrier in Canada to launch a GSM-based network and the first wireless service provider in North America to offer General Packet Radio Service (GPRS) on its network. == History... ==

Rоry McCune

ahh I was wondering if it was like yubikey and I see they have a device which supports the protocol

Tinned_Tuna

3:53 PM

Yea, I saw that! I was kinda excited to go read the FIDO specs and see how they hold up. The web presence is banding a lot of terms about in a very marketing-heavy style, but they have links to the actual spec.

Terry Chia

@RоryMcCune Many big names behind it so I have decent hopes for it.

Simon

Google are copycats, tsk tsk.

Tinned_Tuna

@Ter

Simon

@ry

Rоry McCune

@dough

Terry Chia

3:54 PM

@Tinned_Tuna It's pretty solid from my rather minimal knowledge of crypto.

Rоry McCune

@nut

6

Simon

@RоryMcCune 10/10 would read again.

Terry Chia

@RоryMcCune Star-worthy.

Tinned_Tuna

derp, sorry. @TerryChia I don't think that's going to save it. It could be design-by-committee madness

Terry Chia

@Tinned_Tuna The crypto behind it is solid, it doesn't look difficult to implement and they have an actual spec plus products out. Pretty well done job so far imo.

It's a damn solid improvement over TOTP.

Tinned_Tuna

3:57 PM

perhaps I should read the specs and blog about it

Terry Chia

@Tinned_Tuna How hipster of you.

Tinned_Tuna

@TerryChia indeed, I am so hipster it's not even funny. Nothing like having so much hip I can't see my feet.

I'll probably have to read the spec at some point to integrate it into our product anyways...

Adnan

4:14 PM

Has anybody heard of the new embargoed key-recovery attack (2^64) against AES-256?

Terry Chia

@Adnan Wut seriously?? First I have heard of this.

Thomas Pornin

@Adnan Technically, if it is embargoed, you should not have heard about it...

Terry Chia

@ThomasPornin Says the guy who spoiled POODLE for Google.

Adnan

@TerryChia Hussh.. ruined my plan to have @Thomas discover such attack

Terry Chia

@Adnan PFFFFFFFFFFFFT!

AJ Henderson

4:38 PM

@Adnan 2^64 is too ambitious

you need to start with something easier like a simple unspecified key reduction

Terry Chia

@AJHenderson If that thing exists it's probably the crypto vulnerability of the decade.

AJ Henderson

@TerryChia more than the decade

that'd be the crypto vulnerability of the century

Thomas Pornin

@AJHenderson ... so far.

Terry Chia

@AJHenderson Well, this century is just starting...

AJ Henderson

I just meant of the last 100 years

Thomas Pornin

4:40 PM

The century is still young !

AJ Henderson

not 2000-2100

Thomas Pornin

3DES uses a 168-bit key but suffers from a meet-in-the-middle attack that can be used to reduce the strength to 2^112. It is not inconceivable that a similar structural flaw would affect any other algorithm, e.g. AES

Though, of course, none is known right now.

AJ Henderson

yes, but reducing 256 to 64 would be extreme

Tinned_Tuna

There are folks who're convinced that there will be a serious (as in, akin to DES's linear cryptanalysis) break of AES in the next 5 years or so. I don't take them all that seriously.

AJ Henderson

@Tinned_Tuna anyone that isn't coming out of the NSA conspiracy theory camp?

Thomas Pornin

4:45 PM

@Tinned_Tuna Yet the number of systems which were actually broken because of DES linear cryptanalysis is exactly zero.

Tinned_Tuna

@AJHenderson I'd have to double check, in all likely hood, I think they're just more confident of the ability of the researchers around at the moment and scared by the apparent simplicity of AES

AJ Henderson

which got awfully inflamed by snowden, but lets be honest, nothing he revealed was really a surprise to any serious IT Security type, more just a confirmation of means and methods we already expected as likely/possible

Thomas Pornin

Because 2^43 known plaintext/ciphertext blocks is still a huge, impractical number.

Tinned_Tuna

@ThomasPornin although, taking the techniques of linear & diff to other ciphers was surprisingly fruitful, if I recall?

Terry Chia

@Tinned_Tuna Simplicity isn't a bad thing in crypto algorithms.

Thomas Pornin

4:47 PM

@Tinned_Tuna Not exactly. Differential cryptanalysis turned out to be a useful framework for breaking MD5.

AJ Henderson

@Tinned_Tuna interestingly, most of the fears I've ever heard about AES revolve around the mysterious nature of the s-boxes

rather than the simplicity

Thomas Pornin

And it "damaged" (academically) a few encryption algorithms, although rarely lethally.

Tinned_Tuna

@AJHenderson the AES SBoxes aren't mysterious, the design criteria is public

Thomas Pornin

@Tinned_Tuna Yes, but for someone with a poor grasp of mathematics they are mysterious.

Terry Chia

@AJHenderson That reminds me, I saw a vendor marketing a product at a recent con that customizes the AES s-boxes and store them in a hardware device. I was laughing pretty hard.

AJ Henderson

4:48 PM

@Tinned_Tuna I forget the arguments because I didn't pay them much attention

Tinned_Tuna

@ThomasPornin most crypto is mysterious to those with a poor grasp of maths

Thomas Pornin

Most conspiracy theorists think in terms of: "I don't know this information because they hide it from me"; instead of: "I don't know this information because I am a complete doughnut".

2

Simon

@ThomasPornin Hey, well done.

Terry Chia

@Simon He spelled doughnut right.

Simon

@TerryChia He's an ex-Euro, he's a lost cause.

Thomas Pornin

4:50 PM

Meanwhile, after 24h, the "PKI from NSA" answer has reptrained and accumulated 74 upvotes.

AJ Henderson

I believe it had something to do with the way they are being selected potentially leading to encryption with an achilies heel, but I never paid that much attention to what the arguments were because I thought they were silly

Terry Chia

@ThomasPornin Anything with "NSA" and "crypto" in it pretty much attracts idiots who know nothing about the topic nowadays.

Tinned_Tuna

@AJHenderson that was the fears with the DES SBoxes, but it turned out they actually strengthed the SBoxes against differential cryptanalysis

AJ Henderson

@Tinned_Tuna oh, was that DES, never mind then, I guess I shouldn't try pulling 7 year old paranoia theories out of the recesses of my memory

Tinned_Tuna

@AJHenderson lol.

Thomas Pornin

4:53 PM

@Tinned_Tuna According to Don Coppersmith, the smart guy at IBM (including Coppersmith) had actually strengthened the boxes all by themselves, and the NSA merely verified that fact.

Which would mean that differential cryptanalysis had already been discovered twice before Biham and Shamir published it in 1987.

Adnan

Yaaay! I started something that actually turned into a discussion about security.

Simon

@Adnan It's boring.

Terry Chia

@Simon That's because you don't understand any of it.

Simon

@TerryChia That is a known fact.

AJ Henderson

the thing that people always forget about the NSA is that while they may make back room deals to get access to things through covert methods, at the end of the day, if they compromised major protocols intentionally in a way that could be exploited and it got used against US corporate interests, they would be screwed 6 ways to sunday

and they know it

Tinned_Tuna

5:14 PM

@ThomasPornin oo, nice :-) I was also under the impression that the NSA requested/required the key length be shortened?

jrg

@TerryChia why, what did they say?

Thomas Pornin

5:38 PM

@Tinned_Tuna Yes, they also asked for the key length to be reduced from 64 to 56 bits.

Which was obviously in order to be able to break it brutally, in case of emergency.

Tinned_Tuna

6:04 PM

heh, "emergency"

raz

@ThomasPornin As South Park's 9/11 Conspiracy Episode stated: 25% of the population is dumb enough to believe it, so why not start it?

AJ Henderson

6:26 PM

@raz that reminds me I never got around to watching that episode

the really scary part is that only 20% of the population actually decides anything

roughly 40% vote D and 40% vote R regardless of anything else

Adnan

Guys, anybody uses Microsoft RDP here?

AJ Henderson

as in remote desktop?

Adnan

Yup

AJ Henderson

yes

why?

are we trying to have Thomas find another vulnerability

Adnan

I'm trying to connect to a server, but it's giving me
"The number of connections to this computer is limited and all connections are in use..."

AJ Henderson

6:28 PM

ah

Adnan

There was some trick to kick the other users

I don't remember it

and I cannot find it

I remember it was something you do with the command line

AJ Henderson

is it setup as an admin RDP or a TS RDP?

Adnan

@AJHenderson Admin RDP

AJ Henderson

is it on the local network or remote access?

ie, can you RPC to it

Adnan

@AJHenderson I can

AJ Henderson

6:30 PM

you can use RPC to kick one of the sessions

Adnan

@AJHenderson See?

That's what I don't remember how to do

AJ Henderson

you need the server admin tools installed

Adnan

Hmmm.. I've done it before, so I assume they are

AJ Henderson

and you use MMC to connect to the RDP settings of the machine

let me get the exact snap-in name for you

hmm, I never installed them on my computer at this job... go figure

let me check on my server, that will have it

(you might also be able to do it by specifying to log in to the console, but I don't remember if that boots someone or not)

"Remote Desktop Services Manager"

is the snap in you need for MMC

it should give you a list of all connected clients

you can message or boot as needed

provided you have admin access to the box

Adnan

@AJHenderson Yup, got admin access

Trying...

@AJHenderson Can't find that snap-in

AJ Henderson

6:40 PM

microsoft.com/en-us/download/details.aspx?id=7887

Adnan

@AJHenderson I have them

AJ Henderson

it should be there then, does it not show up under snapins when you launch MMC?

Adnan

Using MMC, I'm now controlling a few things (like users, groups, blah blah)

Xander

@Adnan run mstsc /admin

Adnan

I've already connected to the box using net use

@Xander Tried it. Didn't work (found it on SU)

I don't know what's happening!

AJ Henderson

6:42 PM

/admin just puts a ts box in admin mode

Xander

@Adnan Hmm. That used to be the trick.

raz

@AJHenderson It's a pretty hilarious episode

Adnan

I'm trying to reset session /server:

but I don't know the session number, and the query session is giving me access denied

AJ Henderson

what OS are you running locally?

Adnan

Windows 7

and the remote is Windows 7

Xander

6:46 PM

@Adnan Are you local admin on the remote?

Adnan

@Xander Yes

I usually have remote access and I fully manage the box

AJ Henderson

you could try psloggedon maybe

I don't remember what that tells you about the remote users

it might give you the session id

Adnan

Fuck it! I net use connected to it and then shutdown /m its ass.

Simon

rip

Adnan

OH NO!

FUCK FUCK FUCK

I forgot /r

AJ Henderson

6:51 PM

rut row

so how far away is that box?

Adnan

@AJHenderson 9km

AJ Henderson

well that's unfortunate

particularly if it is up or down

Adnan

not that far, but I don't have a car and it's -2C

I'm not an expert on this, so correct me if I'm wrong. If I VPN to the same network, would it be possible to Wake-On-LAN?

AJ Henderson

@Adnan if you have wake on lan configured on the box

Adnan

@AJHenderson It is

AJ Henderson

6:55 PM

but BIOS has to be setup for it so that the network card is kept powered

and listening

then yes, you should be able to WOL it

if you know the mac address

Adnan

Jesus. According to this, it's painful

5

Q: Can Wake on LAN work on VPN connection?

Is it true that we can’t allow any machine to sleep that may need to be accessed var a VPN connection? (I am asking this on server fault as it is as much about VPN servers as about the end user PCs sleeping)

vpn wake-on-lan

AJ Henderson

I use my router at home for doing WOL

Adnan

Some routing, and some configurations on the VPN gateway

AJ Henderson

<3 DD-WRT

Simon

@Adnan The fastest will probably end up being to physically turn it on.

Adnan

6:59 PM

@Simon Ahh :(

Yup. I'll do that

AJ Henderson

is it actually a home computer?

Thomas Pornin

7:13 PM

@Adnan To active WoL, you need the target ethernet card (physical) to see a packet that contains the magic sequence.

Since the target machine is off, it won't respond to the ARP protocol, so you have to use some sort of broadcast packet.

I.e. the ethernet frame must be "broadcast".

This is relatively easy if you have access to another machine on the same LAN.

If you don't then it depends on whether the various routers will accept to propagate an IP packet that contains a "broadcast" UDP or ICMP (the packet types that, at the ethernet level, turn into a "broadcast frame").

Luc

@ThomasPornin Any comments to this? security.stackexchange.com/questions/71187/… Because you have the top answer (and accepted) so it's unlikely any other post will ever get on top... If I'm not making some mistake in my comment, it might be a good idea to change your answer.

At the very least so it favors the mktemp solution instead of some hexadecimal output.

Thomas Pornin

7:30 PM

@Luc Hexadecimal means 16 distinct characters. Same-case letters means 26 distinct characters. The difference is not huge.

With 26 possible letters, you need a bit more than 27 characters to encode 128 bits of entropy (so, really, 28 characters). With 16 signs, you need 32 characters.

The difference between 28 and 32, in terms of ease of remembering and typing, is not huge enough to warrant modifications.

The point of the exercise, as I see it, was to make a one-liner that works everywhere and fits in one line.

Hence my insistence of using only commands from coreutils, called from bash.

The exercise is indeed a bit pointless, but hey, that's the Internet.

Luc

I think the question is good and not pointless, in fact I generate passwords like this regularly (well, using pwgen instead of some coreutils oneliner)

and nobody is going to remember a 32-character or 28-character password anyway, not if they're not words and not edward snowden himself

so if we're going to use max 12-character passwords, better use the available character set

Thomas Pornin

The OP asked for a password with 128 bits of entropy (and that's overkill).

Luc

true, that part is a bit overkill

what I meant by same-case characters is that hex is not easier to remember than same-case alphanumerics, so we might as well use the latter because it increases security at zero extra cost. Maybe mixed-case and special characters also make no difference to memorize (it's all random anyway), but I'm not sure. At the very least we could use a reasonable character set instead of hexadecimals.

AJ Henderson

@Adnan - it looks like at some point they made the admin tools disabled by default, so first you have to run that hotfix, then you have to actually enable it from Windows Features

then they should show up in MMC

Luc

7:53 PM

@ThomasPornin So basically your reasoning is that the OP asked an impractical question so you give an impractical answer? (because you can't tell me that 32 random characters is practical to remember)

Thomas Pornin

@Luc Yes, that is what happens when I answer with Bear #1. Tom Leek would have insulted the OP over a hundred lines of various curses.

HamZa

@Adnan lolwut is it already that cold there? It's starting to become 10C here and people are finding it "cold"

Adnan

@ThomasPornin Oooohh! God damn it! How did that slip my mind?!

I do have access to another machine on the same LAN

It actually has a small WOL application specifically for that purpose

I feel stupid right now

Xander

@Luc The OP asked for a readable password, not a memorable password.

Luc

@Xander Fair enough, but readers are going to come here who will simply want to generate a secure password. Don't we educate users anymore on what is useful and what is not?

Thomas Pornin

7:59 PM

@Xander Yes. I actually work with readable passwords myself; this is part of procedures where the passwords are huge, split into several parts, and kept in sealed envelopes.

Nobody remembers these passwords, that are used only once every three years or so.

Transcript for