The DMZ

@TildalWave Hipster.

@ScottPack hehe... bottoms up! :)

Speaking of, i think may finish off this box of shiraz tonight.

@ScottPack Oh you're slow... wasn't it like... Wednesday of thereabout when you opened it?

@TildalWave Nah. A box usually lasts about a week in this house.

1:38 AM

@ScottPack not really sure how much a box holds down your parts of the woods... we're talking of 2 litres? (that's roughly 4 pints btw)

I'm contemplating opening some Scotch now... but nobody to join me, maybe a shot before bed time :)

Most boxes hold 3 litres, some 3.75 (4 bottles or 5).

I used up the last of my bourbon last weekend. Haven't picked anything else up.

@ScottPack Oh that's one motherload of sweetness then :) They're usually 2 or 2.5l here.

@TildalWave We can actually get pretty reasonable wine in boxes these days too. Nothing fantastic, but Yellow Tail grade is expected.

1:54 AM

@ScottPack You work in uni... what other exam fraud prevention methods/systems are there? I really wanted to reply to that question, and I think I covered it well enough why I think his ideas will fail, but I have this distinct feeling there's more to add to that later part with my suggestions how to go about it

que?

Q: Candidate authentication in large scale assessment

5

First of all, I'd like to apologize beforehand if the questions I am about to ask are not really suitable for this site. I could not think of any other category to post under. Right, here goes. We're building an offline assessment exam center as part of our internship. That's the company's lingo...

This question... it was bugging me since I read it

@ScottPack Yellow tail is actually darn fine for what it sells for IMHO

And it goes with BBQ

Some Chilean wines are also mighty fine for the asking price, I especially like some of their Sauvignons

Their reds are pretty good. As I recall I find their Pinot Grigio is a bit too sweet and the Riesling too bitter.

Which also work out to be my preferred.

Wow, that's a lot of text.

@TildalWave Believe it or not, I've not had to really deal with that stuff.

@ScottPack We have big wine tradition here also, but mostly quite heavy wines like Merlot and our local but similar variations of it - Refosco and especially Terrano (I used Italian names so you can at least partially read it like they're supposed to sound LOL)... anyway, they tend to be heavy, so I often buy easier wines from elewhere

@ScottPack I believe you, sure... and it's something that would rarely change anyway, so you would have one system that's been tested through a long period of time and since the uni is still there - it works ;)

Most of the time when I'm drinking wine it's relaxing in front of the TV. I need significantly less weight to a beverage when it's not competing.

2:03 AM

@ScottPack I only drink it socially and sometimes a glass next to a dish... but since I prefer reds, they're not really suitable for quantity abuse... not with my stomach LOL

@TildalWave Or the next morning. Nothing quite like a red to dry you out.

@ScottPack Last I was stupid enough to drown in red was thankfully in my student years, but I still vividly remember the thirst I had some mornings... I literally thought there's not enough of water coming through the pipes... not nice indeed. I only get wasted on rare occasions now anyway, but if I plan on drinking more than a few glasses, it'll be either beer, whiskey or bourbon... ha, that reminds me of one song actually

►

2:26 AM

oh great now I've ended up listening to redneck drinking anthems ... need to open a bottle then

Yeah, that was your first mistake

So I got tired of how loud the media center in our living room is.

I thought to myself, "Self, you have a G4 PPC MacMini sitting unused on the shelf downstairs. That thing's pretty quiet."

Bummer: XMBCBuntu doesn't have a PPC port.

However, Ubuntu does, and it shouldn't be that hard to build a minimal ubuntu install into a frontend.

2:48 AM

@ScottPack I just use headphones :P

Had some wireless ones before, but they didn't provide fidelity I was used to so I switched back to my Sennheisers... needless to say I'm now used to walking around freely and I pull the jack out of amp every 15 minutes LOL

My cat doesn't mind tho... has something shiny and moving to attack :)

4:18 AM

HOW LONG ARE PRIVATE KEYS? WEBSITE HOW LONG?

@Griffin about this 8===============================D Long.

4

40 digits?

@Griffin Why not 80?

Why not you tell me the average length? I mean for you it's small but I'm talking for normal people.

2

@D3C4FF Stop or you will get @Adnan excited.

2

4:21 AM

@Griffin I think your mistaking my sarcasm for answers.

2

@Griffin You didn't ask a question -that makes sense-.

Key size

In cryptography, key size or key length is the size measured in bits of the key used in a cryptographic algorithm (such as a cipher). An algorithm's key length is distinct from its cryptographic security, which is a logarithmic measure of the fastest known computational attack on the algorithm, also measured in bits. The security of an algorithm cannot exceed its key length (since any algorithm can be cracked by brute force), but it can be smaller. For example, Triple DES has a key size of 168 bits but provides at most 112 bits of security, since an attack of complexity 2112 is known. This...

@Griffin Heck, obligatory THAT"S WHAT SHE SAID!

I love being a she....

@TerryChia Hahaha

Well, now that i've made the first penis reference for today, I think its breakfast time!

2

mmmm.... sausages...

Interesting that you'd be talking of key sizes... I haven't seen The Bear around so I dared speculate on one question. I'll be probably butt raped for it in a few hours time by reindeer he sends after me, but hey what the hell, we only live once :)

@TildalWave YOLO BITCH!

4:36 AM

@TerryChia oy mind your keyboard! :P

@TerryChia you any good at crypto theory?

@TildalWave About the complete opposite of The Bear I'd say.

Q: Should cookies that contain non sensitive information be encrypted?

@TerryChia Good! Then you would have no idea how right or wrong I might be with my answer... go upvote! :)))

j/k, rather go answer this one:

0

I'm in the process of creating a website and uses cookies to track user login. The only bit of information I store in this cookie is the users username. Should I be encrypting the username even though it isn't sensitive information such as a password? I've noticed other sites which use cookies...

cookies

Don't forget to mention HttpOnly! ;)

daybreak here, time to hit the pillows before I melt on sunlight :) cheerio!

AviD

5:46 AM

@TildalWave Classic. reminded me of it too :-)

@Gilles re the CTF post - very nice. But - shouldnt those be blog posts? they're not really a non-narq q...

@D3C4FF I still need your help with the GPU OC... but it will have to wait.

For now - I'm off to da beach, b**ch! VACAY BABAY!!

2

6:20 AM

@AviD No worries, i'll be online and able to assist tomorrow onwards

@AviD Where you heading to?

MMavipc

@AviD west coast best coast

7:25 AM

@AviD You didn't bring your hardware to the beach? You lack dedication.

8:06 AM

@Ladadadada I got a reply on my email:

Hi Lucas,

Sorry for the delay in replying to you, I have only just got back from China.

Texts are 4-character alphanumeric and tied to a specific phone number.

In order to spoof access you would need to know both the phone and the pin for the particular door you're looking to open, and know the Lockitron door has SMS access enabled.

Keep in mind that brute forcing SMS messages isn't like brute forcing a password file - processing latency is 1-5 seconds and has to go through a number of intermediary services which log and have the potential to rate limit attempts.

@LucasKauffman Ah, that's much better.

@LucasKauffman Didn't know about the owner receiving an SMS. I wonder if everything is sent over the Wifi or if it has a GSM module in there as well.

@Ladadadada It's over wifi probably

The whole SMS thing is still a password sent in the clear, even if you have to know the correct source number and the PIN and everything gets logged.

@Ladadadada indeed so in the event you get to snif sms messages

you could get in

8:15 AM

I do find myself wondering if any potential thief would go to this effort when there are often much easier ways into a house.

I think it is more likely the thief would simply smash the door down than sniff sms messages.

@Ladadadada agreed, if you want to sniff text messages you need some really really good engineering and electronics skills

anyway Im off for a run :)

A guy broke in to my parents place by placing both hands on the kitchen window and pushing it up just high enough that it could slide past the latch.

No high-tech skills required. :-P

Q: Web & insecure HTTP - Using RSA for encrypting passwords on the client side

9:13 AM

This made me facepalm (hope I've interpreted it correctly)

0

I used client side password hashing in my register and login project. Its purpose is to prevent passive adversaries/eavesdroppers from discovering users' plaintext passwords when HTTP requests are in transit. But still an attacker can perform a brute-force attack against the hash; And i think m...

passwords javascript brute-force client-side rsa

Gilles

9:49 AM

@AviD feel free to make a blog post. I don't see why meta wouldn't be non-unsuitable for ctf reports

CodesInChaos

10:06 AM

@Gilles too many negatives

10:17 AM

@Gilles Meta is more of an internal entity, the blog is good for actually publishing stuff

Gilles

10:53 AM

@CodesInChaos I wasn't trying not to avoid mismatching AviD's style

@ManishEarth So? This is about Sec.SE's participation in a contest, how is it inappropriate for meta?

@Gilles non inappropriate

just imo makes more sense on a blog

Blog: supposed to be read by outsiders

Meta: Not

After all, if you can reach a wider audience with this, it's more publicity for you folks

Gilles

@ManishEarth if you want to make a blog post, feel free. CC BY-SA and all that

ah

I was basically saying that it makes more sense to just post directly on the blog

minor detail though :)

11:59 AM

@ManishEarth Oh my gawd.

facepalm

"I don't want to use HTTPS. But I'd like to do client side encryption. No, still don't want to use HTTPS."

@TerryChia I wonder what the words "client side" do to you folks when uttered in the same sentence as "encrypt"

@ManishEarth Depends. Pentester: "FUCK YES!" Security Engineer(or whatever defensive role): "Oh god no...."

@TerryChia ah lol

@ManishEarth Regarding your question about MITM. I don't think there are any technical challenges that will allow a passive-only MITM attack. Maybe someone will prove us wrong.

@TerryChia yeah, thought so

12:03 PM

There are some good reasons not to go active MITM though, such as being harder to detect.

If I can get the packets I can spoof 'em as well

@TerryChia of course

lol

Lol

for those who missed it: alhazred.net

@lynks Heh, I pinned that message on the other room. :)

@TerryChia ahh groovy thanks :) we can use it as a secse ctf thing at some point if you like.

12:12 PM

@lynks Haven't actually set it up yet on my system, but wouldn't it be difficult to use that online?

It appears to be more suitable to the "in the room" type CTF.

@TerryChia besides, aren't ctf problems supposed to be secret before the competition?

@TerryChia yep thats certainly how it was designed. I meant more as an individual task, like when people were working through io.sts on their own and sharing tips.

Did I just see Pornin get a downvote? O_0

who downvoted the bear

A: Are there any situations when one can only mount a passive MITM?

-1

Passive-only attack scenarios tend to be rather specialized. Mostly, they involve radio links; the attacker can play with a homemade reception antenna, but is not rich enough to build an emitter which can drown out the genuine signal. This rarely applies to the Internet; this is more relevant to ...

12:20 PM

some grotesque individual no doubt

Is the answer wrong?

I am O_0

if i was being picky, i might say the answer is a little hurried and lacking depth, but not worthy of a downvote

Q: Is there any malicious reason to block CRLs?

1:03 PM

0

I've noticed that in order to 'illegally' crack certain applications, it is necessary to patch the host file to stop communication. I've found that with several applications there are entries that don't match the rest. These entries seem to patch the certificate revocation lists (CRL) for Verisi...

certificate-revocation cracking

Anyone?

@D3C4FF Because they dislike Verisign. Obviously ;)

@TerryChia xD

Q: CTRL+ALT+DEL Login - Rationale behind it?

1:20 PM

0

Maybe a rather noobish question: Why on Windows systems (I have not seen it elsewhere, but contradict me if I'm wrong) CTRL+ALT+DEL is required at login, before the password can be typed in? From usability point of view it's a bad idea, adding an extra step in getting access. So does it improve s...

authentication windows password-management

Copy paste answers ftw!

In my defense, I can't close as dupe of a question on another site. ;)

@TildalWave That's not much helpful when the wife and I are sitting on the couch, or all three of us are watching a movie.

@lynks It is Sunday. I have better (and worse) things to do on a Sunday.

@TerryChia I've had it explained to me why it isn't really all that useful anymore. I just can't remember the reasons.

("Worse" means making about 40 slides to explain what a PKI is. "Better" means simply looking at my cat basking in the Sun rays on an ideally placed bed.)

@ThomasPornin Raw, medium or well done?

1:31 PM

@TerryChia Everything a cat does, it does it well. That's the definition of a cat.

MY EYES!

@TerryChia Could be worse. It be be Yvette's Bridal

And poop, it no longer exists.

TO THE TIME MACHINE!!

web.archive.org/web/20120305225639/http://…

@ScottPack Holy WTF!

yeah...

I absolutely suck at design and I can do a better job...

1:39 PM

@ScottPack HOLY SHIT DICKS

Apple pie. Please click here.

Link unrelated.

Death to all humans

.___.

Well, just broke 1.5k for the month. Wheeee~

1:51 PM

quality shot of @polynomial here webtrickery.com/2013_BSides_Teaser/scaled/…

12

@RoryMcCune Hahaha nice one!

That needs to be pinned.

Wait... Polynomial doesn't look like his avatar?

@AviD, @RoryAlsop.

@RoryMcCune Ah, forgot you were room owner. :P

@TerryChia yeah Scott added me in a moment of weakness and hasn't removed me yet :)

@RoryMcCune nice V as well

who is that with the cap?

1:54 PM

@RoryMcCune Well, remove him before he removes you!

@RoryAlsop not too sure who that dude is

@RoryMcCune fair enough :-) So many folks I totally failed to meet up with - my fault for failing to get back in time for afterparty tickets

@RoryAlsop there's more shots here webtrickery.com/2013_BSides_Teaser from (twitter) @W1bble

yay - I can see me in pic 1

I went outside to get decent signal

@RoryAlsop ah yeah the T-shirt is a give away

2:00 PM

@RoryMcCune Who are these people ? They look like computer geeks.

@ThomasPornin they're the kind of people who turn up to mid-week security conferences :)

@ThomasPornin hahaha

@RoryM - who's the zombie hunter girl?

that's another one for Claire's stats on women in Infosec

@RoryAlsop see there's another dunno from me exposing how few people I had time to meet at the con. We had 2 women in our workshop which isn't bad (relatively speaking for infosec) out of a attendance of 16

@RoryMcCune that's better than the con average - nice one!

So 1 in 8? I wonder what our numbers added for IT here. I suspects it's that or better.