« first day (1674 days earlier)      last day (1964 days later) » 
04:00 - 16:0016:00 - 23:00

4:03 AM
1 hour later…
5:11 AM
@Avi Somebody is trying to reach you parenting.stackexchange.com/questions/21217/…
5:44 AM
1 hour later…
7:11 AM
Hell guys :)
Ah ah, this joke's never gonna go old
2 hours later…
8:58 AM
@Adi hahahaha
1 hour later…
10:21 AM
@M'vy Old is relative. For example, relative to @RoryA, nothing will ever go old. :D
@Adi hmmpf
@RoryAlsop so have your kids discovered "memes of security stackexchange" yet?
to find our their old man has not one but two entries dedicated to him
@RоryMcCune erm....I don't know. They haven't mentioned it yet...
Hang on - two?
@RoryAlsop your age and rories
ah - yes, of course :-)
I forgot about my age
10:29 AM
@RoryAlsop s'ok easy to forget these things, at your age :op
10:48 AM
well that was one of the amusements of rural life.. just been mouse catching
the cats keep bringing them in at night to play with, and then losing them
only for the mice to pop back up at some point
11:10 AM
See your problem there is you have cats.
@RoryAlsop I wrote the age one IIRC?
Filled with dumb jokes @AviD came up with.
@RoryAlsop That's probably because you're old
11:49 AM
ah ah
12:00 PM
@LucasKauffman Dude these earphones rock
@raz I know right
@LucasKauffman The reviews were pretty spot on, highs lack a bit. But damn do they sound good.
12:18 PM
@raz I'm a Westone fan myself. :)
@raz the problem is that the cats do not follow through at the end of 'playing' with the mice
@TerryChia They never came up in my search for earphones
@RoryAlsop Exactly, because cats don't care. And when they get bored they walk away. Because cats are dumb.
@Xander dammit man, you make me sound like an autistic shrew
@raz no, because cats are really intelligent: a damaged toy may be fun to play with later, as it probably won't have crawled far
intelligent and cruel
@TerryChia I see this is because I was only looking at $100 range earphones
12:29 PM
When I have to use headphones: Sennheisers
@RoryAlsop Until cats prove that they can learn things other than where the litter box is... I'll stick with dags
@raz cats can - they just can't be bothered doing it for you :-)
@RoryAlsop I've found with Sennheisers their mid-price range earphones are ok, it's go big or go home with them.
@raz yep
@RoryAlsop If I went to my boss and was just like, "Meh, I could do it, but I can't be bothered." I feel like intelligence is not the word he would use to describe me.
12:32 PM
@raz Cats think nothing of our human ways. They go, "haha - you work! I get fed just by being cute and fluffy. Now let me go back to my meditation on the nature of string theory"
Where's that "This is not a question" reason when you need it...
Q: Is there any advantage in using LUKS + hardware encryption on SSD?

asdfI think there are none. They would be just slower and useless. They might protect you from basically the same threat model. Am I right or am I overlooking something?

I honestly don't know what to flag that for, but I know it should be flagged.
@raz have tried to improve it
marginal improvement
nice, seems new android can manage users
@AviD I do what I can. :-)
@M'vy What do you mean? Linkage?
12:43 PM
@raz Android 5 on my new phone has user profile
Meaning I can switch it to guest if I lend it
@M'vy 5.0.2?
Oh damn... there it is
That's awesome
Oh geez... switched to Guest
Took a hot second for it to set up, but that's kinda nifty. Good for kids who share a phone.
Damn that new phone is really big... maybe I should have check the specs firsts
@M'vy "That new phone"
12:51 PM
motorola nexus 6
160mm high :)
Damn that's a big phone
The OnePlus is pretty big, I know the OnePlus2 is going to be smaller. Likely a Galaxy S4ish size.
However it's pretty damn cool for reading or browsing theinternet
@M'vy And games!
@raz oooh yeah I should check that
probably could run hearthstone :)
@M'vy It says it's waterproof.... time for science!
12:56 PM
@raz well, don't be silly. My last one went in the washing machine
90 degrees, pre-wash program, dirty clothes program
not keen on testing that now :)
@M'vy Nonsense, it's for science! Video it, and tag Motorola. Bet you get a new phone out of it if it fails. Then it's a wash
He's back...
Q: Why isn't MSWindows product code kept secure?

UlkomaYesterday I have noticed MSWindows product code on KFC's machines is exposed to the public (photo below). It might be a mistake but it made me think of something a friend of mine told me once, how he used to go to Internet cafes and copy the product key either from the back of the machine or use...

1:11 PM
@raz Who is?
Oh... He is!
1:44 PM
I don't remember who he/she is, should I?
wasn't ever in DMZ as far as I can see
@TildalWave there's been mention in the last week
He's responsible for trolling questions such as:
Q: Can I fly with a gold bar?

UserCan I fly with a Good Delivery gold bar? I'll have the certificate that I have been given with it. I have looked on Google and found nothing that suggests it's a prohibited item on an aircraft. It's below the weight I am allowed to carry in person. I'll be taking it to Moscow, flying from Heathr...

Q: Can I pass through the airport security with a de-activated Bazooka?

UserMy flight is from Washington, D.C. (IAD) to London Heathrow , with British Airways. Important Details The Bazooka will be bought legally from a shop in Maryland British Airways' website explains in details the policy regarding decommissioned firearms. The Bazooka is de-activated. UK Violent C...

@raz my bazooka is always deactivated during airport security checks
I was never told I can't board with it tho :)
@TildalWave depends on who does the frisking
Well, never brought one. Does not fit hand luggage.
1:53 PM
@RoryAlsop has to be same gender and that just doesn't do it for me :P
@TildalWave me either, but I figured I shouldn't judge :-)
2:19 PM
@TildalWave Need to tell them, "I'll sign a waiver to allow him/her over there to frisk me ;)"
@AviD how does this edit get approved?? security.stackexchange.com/posts/94215/revisions
@raz Marian Paździoch reviewed this 15 mins ago: Approve
Author approved
I mean there's even stuff that can be fixed, but they didn't even try
@raz Well it's still improvement and author agrees so...
They're just all
@raz Wow. First time I've seen that meme. Girl looks downright demonic!
Get it off the screen!
Get it off!

Get it off!
2:26 PM
Hm. What's that line limit, there?
'Cause, seriously... it's still on my damn screen.
hahaha, apparently there is one...
The sky?
Yeah there is a char limit in messages
not sure how many
This is the song that doesn't end
@M'vy Thanks, that's better.
@M'vy Not talking about the character cap. Talking about the vertical height limit, after which the message becomes scrollable.
2:28 PM
@Iszi you haven't seen the Ehrmagerd girl before?
@Iszi oh
Funny... gpg --armor option does not work as last parameter
.ssh : drwxr-xr-x !??!?!
@RoryAlsop No. I think my first exposure to the term was something on SF&F related to STNG.
`$ gpg --armor
gpgv: invalid option "--armor"`
Ah, here it is.
Haven't found the SF&F Q yet though.
And there it is.
Q: Is this from an actual episode of ST:TNG?

Beofett Is this an actual, unaltered (aside from the text!) screenshot from a ST:TNG episode (or movie)? What is the explanation for Troi's face?

@Xander I'm back to being a regular pleb :'(
(internship over. got the option of coming back for a job next year)
2:37 PM
@raz well it does work, probably not standalone
gpg --armor --output mvy_arm_pub.gpg --export yves.stadler@gmail.com works
@ManishEarth Nice, where at?
@raz MS India
Not a bad gig
@M'vy is there any time when you don't want to use armor?
armor should be the default, gpg --binarycrap should exist instead
@ManishEarth not sure. Bulk transmission of keys accross server using scp?
2:40 PM
@M'vy how often does that happen :)
most regular gpg use is with text
yeah sure
bulk stuff is not something you do every day
@M'vy Honestly, how much does that save you?
Transmitting text is cheap. :P
@TerryChia Hey hey hey don't ask me, I've just been trying to guess a use case:)
I'm actually surprised that text is not the default for something this old
3:04 PM
@Amelia "hello sir, i have moneyz for you, i need a transaction fee of 400 u s dollarz" is an attack that (sadly) works regardless of an authentication scheme.
The user willingly sends the money to an attacker
Everyone, please welcome @MadaraUchiha and @Amelia - we were having a grand conversation in TL on security when @JeffFerland pointed out we should move it here
The trigger for said conversation is this meta post: meta.security.stackexchange.com/questions/1874/…
damn too many blues here
3:07 PM
I was only pointing out that my bank's password requirements were disgusting, then got roped in ಠ_ಠ
@RoryAlsop Oh great
And before anyone tries any knee jerk reactions to @MadaraUchiha's post, he is really interested in the objections to SQRL and wants to know why it is a bad idea
@raz I dont know, why you asking me?
If a social attacker wants to get me to do an action, they'll do it regardless of the authentication scheme
If a social attacker wants to get information out of it, I literally have no information to give out.
somebody approved it. its not wrong, just not that much better.
3:08 PM
Hello @Amelia @MadaraUchiha
I don't know the contents of my private key, and giving away the private key is an action I never have to do (as opposed to giving out my password), so requesting it from me will sound weird.
So again, I fail to see what kind of social attack works here
@MadaraUchiha At the same time, malware is just as horrifying
@Amelia all banks' are
Now instead of finding your key out as you authenticate, I just authenticate when you go to sleep, utterly ruin everything you love, burn it to the ground and then take a dump on it. For science.
@AviD Because you're the one who hoots and hollars at people when stupid things happen around here
3:11 PM
yesterday, by AviD
@Xander no no, I dont yell, I hoot. I'm a hooter.
@Amelia Malware is a different topic
And if you keep your private encrypted with a passphrase, I'm not aware of a malware that can get it.
@AviD :D
@raz heh okay yeah
Of course, social engineering vectors would work on the passphrase
although often its @Simon making the noise while the stupid things are happening
3:12 PM
But now you have to fool the user twice! Once to install a malware, and once to get them to type their passphrase in a context you like.
@AviD This is true, @Simon would agree with me.
^ as a reference :)
I think if you have something installed, typing in any context is sufficient to scrape from.
And if the user has been fooled twice, well. No social engineering prevention methods can stop a user's stupidity.
3:13 PM
@MadaraUchiha recently saw a wonderful piece of malware that successfully got victims to carry out 5 separate activities, all of which are stupid!!!
That's why social engineering attacks still work despite all prevention methods.
@MadaraUchiha not all...
get rid of all your customers = much safer :-)
@RoryAlsop Again, I'm still waiting to hear what kind of social engineering attack could get me to give you any sort of usable information
@MadaraUchiha to be perfectly honest, I dont remember the details of SQRL right now, and dont have time right now to review it. I just remember how cluelessly broken it was...
But moreover, the instigator of the idea is well known to be a security idiot and cause damage often.
@MadaraUchiha you seem to think a social engineering attack has to get you to give me something
3:14 PM
@MadaraUchiha you are not the target for that; you have more than half a brain.
It doesn't. If I can get you to do something, that can also be a win
@RoryAlsop There are two kinds of social engineering attacks
Listening to any ideas Gibson has on security is akin to asking Donald Trump for suggestions on unemployment.
One to get me to give you info, and one to get me to perform an action
@Amelia and that is mostly true - but some very smart people get fooled by clever soc eng attacks
3:15 PM
I forgot how pure gold this room was
I've not been here in over a year
@AviD I really don't know who Gibson is, and I really don't know what he said before
But I guess that makes me unbiased against him, so that's good.
@MadaraUchiha ahhhh - quite famous
we did have to make sure there was no bias
@Amelia And assuming I did
@Terry - I can't remember, did we have to tone down some of the comments?
I have a private key on my phone (one I'm not really aware of, because I have half a brain)
Attack me, like one of your french girls.
3:16 PM
@RoryAlsop "infamous"
@MadaraUchiha I'm surprised you say that as in the top answer to the original question right at the top of it is a link about Mr gibson...
hum, I fail to see how the authentication is done. At each login, the app generates a key-pair??
@M'vy Yes
Well, now I have thrown the grenade into the room, I must apologise - I must run. Luckily this room is full of people much smarter than me
And the site-specific public is deterministic
3:17 PM
And @Simon
So when I authenticate the first time, it also serves as registeration
catch you all later
@RoryAlsop slander and lies, I will not be called smart
The second time, the server already has the site-specific public stored, so it knows to associate me with a known account
@Amelia oh cool! didnt know there was a Freelancing.
3:19 PM
hum, what happens if you lose the key then?
@Amelia I said smarter than me :-)
e.g. losing the phone?
@raz I wouldn't dare to.
@RoryAlsop @Amelia he was obviously talking about @Simon.
@RoryAlsop I thought that wasn't very hard? :p
3:20 PM
@Amelia BOOM
@RoryAlsop Well no one can be older...
@Amelia I recommend you watch your Phrasing
Well, @RoryAlsop is getting old older than sin.
@AviD pls
3:20 PM
You keep saying that one can social engineer with SQRL, but you still haven't given me a workable example here :P
@Amelia @RoryAlsop can't get old. getting old means that the concept of time and aging applies to you. @RoryAlsop predates time, and thus it doesn't. He just is old
Hellooo, Madara Uchiha in the house?
What's going on? Does it take that many mods to handle me now?
Also your moderator elections are uhh... interesting. And terrifying. Mostly terrifying.
Well, as of my fast understanding of it, I see a potential failure in account recovery
3:22 PM
@Simon Yes
Hang on - I haven't left yet. Being old, it takes me a long time to get into my going home boots :-)
@Amelia llamas are mostly nice. Mostly
@RoryAlsop Mostly harmless
I'm voting for the Llamas with Hats guy
@raz oooh - good crossover
There is just no way to correctly authenticate a lost account, since: you don't have the public key anymore, or don't have the master password
3:23 PM
@Amelia heh
@Amelia NO, NO, NO. They've spent 2 weeks doing this here in the past.
And in the case the user know the master password, then revealing it allows anyone to generate the key-pair
right - I'm really going now. You can get back to slagging off my age. Just remember, I invented this universe....
3:24 PM
You're retrigger their craziness.
@AviD Look away, look away.
We're doomed.
@Simon quick throw some doughnuts at the tigger
3:25 PM
Or some baby hands.
@RоryMcCune It might indeed be time for the emergency dozen of donuts box.
@Amelia another person who has memorised/been scarred for live by CAARRRRL I see :op
anyway @MadaraUchiha, to the point of your meta post:
> 1. is misleading
2. ranks high on Google searches for SQRL
3. reduces the site's reputation with actual experts.
@MadaraUchiha I don't really recall the technical details of the protocol and I don't really care about it but I'll point out one obvious problem. You are entirely reliant on the "app" to do the right thing. Passwords have no such issues.
@TerryChia Passwords have all those issues
If you don't have a password manager, you have a lot of other problems
And if you do, you're reliant on it doing things right
3:28 PM
1. no, the original spec is what is misleading. it was reviewed several times over, by various experts - including a bona fide leading cryptographer. All shown that using SQRL is ridiculously incompetent.
2. Good - that is the point. Hopefully nobody will be negligent enough to actually use it.
3. No, the other way around.
Also, even if the protocol has no obvious flaws it has absolutely zero chance of catching on because it is designed by a single person with obvious reputation issues in the security community. It is therefore a waste of time to spend any effort on the topic.
@MadaraUchiha can't say that I agree with that. I can easily see what my password manager does as it's just copy/pasting text...
@RоryMcCune Hardly. If that's all it does, your password manager is doing it wrong.
ooh so the master key is backed up somewhere
@TerryChia agree about the waste of time, but it DOES have obvious flaws.
dont remember the details though.
3:30 PM
You're saying it as though the password manager is a glorified excel file with site -> password mapping
@AviD Link please?
If you want something with a good design and a hope of succeeding, look at fidoalliance.org.
@RоryMcCune A password manager does quite a bit more than that. Mine verifies code signatures of processes it pastes a password into.
@MadaraUchiha I disagree. I use a password manager that is a flat encrypted file and I copy/paste things into/out of it
ooh I'd have to digging. not the time for it now... though I'm sure (without rereading) the answers on the original question cover most of it.
@Amelia some password managers do, it's not a valid blanket statement
3:31 PM
@RоryMcCune no verification? :<
@RоryMcCune Great! So you know it's encrypted and that it does things right
@MadaraUchiha I know it's encrypted 'cause the file format it uses is a open and has been verified yep
But how is it different from looking into the SQRL client and seeing it does things right
@MadaraUchiha I don't have to do it, there's multiple implementations of the spec. which are cross-compatible
@RоryMcCune Waiting for your point here. How does that statement fail with open source SQRL clients?
3:32 PM
@MadaraUchiha No, with passwords you are absolutely not reliant on password managers for remembering secure passwords. It helps but it's not necessary.
@MadaraUchiha How are you planning to get your open source SQRL client on iOS again?
@MadaraUchiha I didn't make any point relating to that at all, I said I don't have to rely on My password manager to do any "magic" it's an encrypted repository of text
@TerryChia By putting it in the app store and releasing its source?
@TerryChia My password for my password manager itself is a diceware password with around 12-16 words in it that I had to memorise over the course of 2 months
@MadaraUchiha How does "releasing its source" help me to verify that it's indeed the same thing that you release on the app store?
@TerryChia How does anything help you do that?
I can say the same with binaries you download and install on your computer
3:34 PM
@MadaraUchiha It doesn't. Hence why relying on a "secure client" is a broken assumption from the start.
@MadaraUchiha Yes, but with PASSWORDS I don't have to rely on anything I install on my computer.
@TerryChia Until you have to remember 40 different passwords for 40 different services
You keep forgetting that the main reason why nothing has replaced passwords so far is because it's versatile.
Then your choices are a password manager, a predictable passowrd generation scheme (the site + my phone number), using the same password for everything, or a password manager.
well anyway, SQRT is > target the master key
@TerryChia There's nothing better that's as easy to implement. And even password implementation gets screwed up.
3:37 PM
@TerryChia No, the reason is that it's conceptually easy to understand and implement
If you want something to get adopted, make it so simple that your grandmother could implement it in software.
(Bonus points if your grandmother can code)
@Amelia It's simpler than OAuth
Simpler to implement that is
@MadaraUchiha well, of course it is, OAuth has all that pesky security mixed in.
And for social engineering, well you make a www.paypa1.com site, and present the real paypal QR code to the victim. Then it logs you in. Or am I missing something ?
Oh for the social part, you send a fake email asking the person to check his history
@MadaraUchiha You clearly do not want to accept my points so I'm done. Like I said I have no interest in debating a protocol that has a less than zero chance of seeing widespread adoption.
I object to removing my blog post. If you disagree, feel free to write up something of your own.
3:39 PM
@TerryChia the fact that it has zero chance of adoption is of much less interest than the reasons why it should not have a chance of adoption.
@Amelia Not just implement, but use as well. Single factor authentication using a password imposes fewer demands on application users than any other system.
@AviD Yeah, but the fact that it has zero chance of adoption means I can't be damned to go read the spec again to put together a coherent argument.
@TerryChia don't make it personal. Your blog post should remain for 2 reasons: It is correct, and the fact that it appears high in google results makes it more unlikely that somebody might make the mistake of using it.
The first person to make a proven-secure system that is hilariously easy to implement, and hilariously easy to use will get a yacht.
Any yacht. Even a 4 billion dollar one.
@M'vy Then it logs the www.paypa1.com application in to your www.paypal.com account.
3:41 PM
@TerryChia that claim would stand even if somebody came up with a genuinely wonderful solution.
@Xander yeah, my point exactly
@M'vy Ok, wasn't sure if you were stating or asking.
@Xander asking for confirmation I guess
I've just read the site for a small amount of time
@M'vy Then yes, confirmed. :-)
@Xander yeah that part of SQRL reminds me of those apps for picture authentication like Oracle was offering - "you dont even need SSL!"
3:43 PM
If we want to debate an actually good authentication alternative, look at fidoalliance.org.
@AviD Ha ha ha.
Maybe the QR code thing could be a "shortcut" authentification
@TerryChia Speaking of, that reminds me, I need to set up my Yubikey.
Scanning QRs is deadly annoying to me.
like you set up a real account, with fully fledged sec measures (login/pass/2FA/whatever)
3:44 PM
@M'vy not at all, how could QR be authentication?
and you generate a master key that you can later revoke
just cuz it doesnt "look" like a password?
@M'vy when people say key I assume we're talking some form of cryptography key.
In that, I find SQRL to be very disingenuous.
@AviD Well, at this point, it could generate the keypair instead of a so called "master key"
@M'vy how would that work in a browser, exactly?
@AviD You create your account. Request a new keypair. Put it on the phone.
Then for log in you use their actual system
3:47 PM
@M'vy wait, are you talking something like the [Google|MS] Authenticator app?
because yeah, that is a very good system.
but I thought we're talking about something else.
@AviD Well not exactly, because you still perfome signatures
yeah okay I think I may have gotten lost in this conversation.
anyways, I gots to log off for the weekend...
Basically, you associate a keypair to your account :)
and use that to sign the login challenge
You know what's also deadly annoying? Using a password manager, and then having to enter account creds on devices that don't support password managers or keyboards. Like entering my Netflix password onto a DVD player. Such a hassle.
The burdens I must bear, all in the name of security. I tell you what.
3:50 PM
@Xander well, you know:security - bears...
but one last word to @MadaraUchiha and @Amelia - there really are a ton of incredibly smart people here, who are very focused on precisely this type of thing. There are a lot of aspects to consider, a lot of threats and risks from different directions. Modeling all of these, in addition to usability aspects, is what they do best. It is tricky to avoid cargo culting it, when basing on so called "best practices" - thats why it is so much work to model each context specifically.
@AviD Oh, I'm aware. I was never in the SQRL debate, for the record :p
@Amelia I noticed, but you got dragged into this room for it, figured I'd give you a lice of pie.
@Amelia Yes you were. You know you were. STOP DENYING IT, I SAY!!!
security pie.
3:53 PM
@AviD Mmm...Lice pie.
@AviD that original sentence went weird in French :)
@M'vy damn I cant spell
swear it was not freudian
@AviD Well I won't throw you the first stone
anyway time to leave
04:00 - 16:0016:00 - 23:00

« first day (1674 days earlier)      last day (1964 days later) »