Rory McCune

I can see a number of interesting use cases for things like explaining legacy code bases to help re-factoring and documentation chat bots to help users without asking them to wade through a load of web pages looking for things

@RoryAlsop whilst many companies are blocking the public chatGPT (for data privacy/security concerns) a load will be hitting up MS for subscriptions to their OpenAI service to work on projects, I'm sure.

@nobody fun fact, although I think it broke at some point, for a while I had a UTF-8 o character to avoid getting mis-pinged for people looking for @RoryAlsop

I don't think I can see anything like that, am not a mod :)

it's probably been a while, I'd guess :)

it's mainly an enterprise thing, although I've also heard of universities that use the same approach

it has advantages, e.g. not having another user data store to worry about for joiners/movers/leavers processes

as there's good support between the LDAP directory and the web server/app layer

I've seen AuthN integrated into LDAP loads of times. It's a common setup where Active Directory is in use and the app. runs on IIS

wooo room owner \o/

So getting a decent night's sleep is a good plan

Pentesting should be a 9-5 (or your national equivalent job). It can be a mentally challenging activity, which is best approached when rested.

if you're a tester in the UK I'd recommend taking the CREST exams as a lot of pentest companies rate them

well if you think of the CRT as an upgrade ofc :)

if you want to take the OSCP then you can do that and then upgrade to CRT

IIRC getting CRT includes the written exam part which is the CPSA

@J.J So it depends. If your goal is to get CREST qualified, you're probably just easier taking the CRT and don't bother with either CPSA or OSCP

minimum for chat

so apparently @AviD is clueless, but a more educated crypto.se says it's 20

good lord it's been many a long month since I've been pinged in here. I'm afraid I'll have to confess ignorance on that front and ask @AviD @RoryAlsop or one of the other mods to answer

Yeah things like that or the web spider that deleted a customer database 'cause there was a GET request for "delete record" are my favs :)

TBF in a well secured robust site it shouldn't cause too much trouble

well 2 things to watch, one is general load on the app (10,000's of requests quite quickly) and the other is, if you give it credentials to log in, it will (by default) try to fuzz every single parameter and form, so if you have any destructive functionality, that can end poorly

make sure you're happy with the level of load

well my recommendation would be to look at it in a dev/test environment in the first instance

I have heard acunetix referred to as crashunetix

ahh yeah I was thinking of automated scanners (acunetix, appscan, webinspect etc)

@TomK. Automated Web App Scanners are useful in their place but have a number of problems, like false positives and also the very very large number of requests they send to get a result. There's a place for them (if well managed) but I've got to say, most web application security testers I know do not use automated scanners as part of their work

@O'Niel hmm well I tried downloading that ISO, attached it to a VMWare Workstation machine and started, the website came up just fine on the IP address for the VM....

@O'Niel if you've not already, I'd suggest pentesterlab.com as a good place to look for test systems. Some of their stuff is pay for, but a fair amount is free

not much doing

quiet in here

and the security of their products will be ruined

You might have more luck with this on serverfaul as it's more a question of how Docker networking works, than a security issue :) Looks like ettercap is poisoning 172.17.0.1 though which is likely to cause problems as that's the default gateway for the docker0 network. you might want to try restricting it to just your "victim" container. Also FWIW ARP spoofing can be done without privileged as containers have CAP_NET_RAW by default with Docke, although ettercap may need more privs for some of its other capabilities.

ooh go on then. The irony is that I've made points about over-zealous moderation to the mods (in person and over chat) on a number of occasions but somehow I manage to deliver that message without being nasty to people... odd that.

@JᴀʏMᴇᴇ it's not that your opinion hit a nerve that makes you come off as a troll, it's the fact that you seem entirely unwilling to take any positive action in regards the issue and the fact you are using deliberately personal negative language in presenting your issue.

@JᴀʏMᴇᴇ well so far it looks like you're just trolling then. Which is a shame, as you had an opportunity to be the change you were attempting to suggest should happen but instead chose a purely negative path.

@JᴀʏMᴇᴇ you can have that opinion, of course, but I don't think you're expressing it in a constructive fashion. You would have been far better off demonstrating the possible positive actions (re-wording the original question) rather than taking this approach, I would suggest.

@JᴀʏMᴇᴇ this really isn't a place for trolling, all that's going to happen is that you're likely to get negative attention from the mods.

security.stackexchange.com/a/5752/37 or this one

skeptics.stackexchange.com/questions/13674/… bit late to this discussion but that link might prove illuminating

Whilst, as a customer, you're unlikely to be at financial risk from employee fraud as the bank would be obliged to refund any loss, it's fair to say that employee fraud is not unknown, so I wouldn't say that it was necessarily "safe" to do so.

Unfortunately phone banking is extremely common and predates Web banking (at least in the UK), so it needs some form of authentication. Some customers do not use the Internet at all and with the reduction in branches, this is an important channel for many banks.

@Jacco in that case how do you suggest banks authenticate users on the phone channel?

yeah the usuability aspect I'm not sure about and I'd be concerned to hear if the bank is constraining character choice to ease recognition, however with that said, voice recognition is a lot better than it used to be, so it's possible they can do this well...

@TheJulyPlot The bank has to authenticate customers somehow. Personally I've not experienced voice recognition from an organization,but it would seem to me that they'd need a good base sample from customers to do accurate detection and that it would be susceptible to things like having a cold, or a bad phone line, which could make it a frustrating experience for customers.

@jacco well it depends, do you count an IVR system (automated not human) as a person? and in that case do you differentiate it from a website? The problem is that you've got to authenticate the customer somehow on each channel. IVR is better than giving your password to a human operator. And the problem with the having multiple sets of creds (one for each channel) is that user's just forget the ones they don't use frequently

@DavidRicherby well that's a view for sure, my feeling is that the question is asking about the user's security. I feel it's possible to answer the question focusing on the user's security and pointing out that entropy is not likely to be the main determinant factor, which is why I felt an answer focusing on that aspect and not the security aspect wasn't a good approach.

@josef that's really easy. Most PINs are user controlled and changed, therefore an intelligent attacker will choose test the most chosen PIN first. PIN distribution where users can choose is not random across the available options, and the question explicitly mentions the user choosing the PIN.

To explain my downvote, I don't think that Entropy is that important to the security of 4 digit PINs, what's important is the lock out on the system and not using one of the most common PINs, so that an attacker is unlikely to guess your PIN before the lockout occurs.