#cybersecurity | Python | Page 5

safe bear Sep 13, 2018, 12:46 AM

#

In URLs or other such links (e.g. anything used to identify a resource)? definitely

upbeat palm Sep 13, 2018, 12:50 AM

#

🤔

#

@safe bear To whom you're referring this?

safe bear Sep 13, 2018, 1:47 AM

#

@silent pier

#

"Reading through this about input sanitizing, how exactly can the use of those unicode characters with a visual or semantic similarity be a security risk?"

native edge Sep 13, 2018, 1:50 AM

#

For visual, maybe limit the amount of combination characters

#

You can easily make unicode characters that are as high as your screen

upbeat palm Sep 13, 2018, 3:37 AM

#

@safe bear Oh...Sorry for tagging then

silent pier Sep 13, 2018, 8:17 AM

#

I ended up white listing available characters with regex

#

So I dont "think" itll be an issue

thorn obsidian Sep 14, 2018, 8:39 AM

#

https://www.rfk.id.au/blog/entry/security-bugs-ssrf-via-request-splitting/
https://github.com/nodejs/node/issues/13296
nice find from someone in another server

GitHub

`http` silently corrupts the request URL when it contains non-Lati...

I experience the bug on Node commit 399cb25 Darwin Tephs-Mac-Pro.local 16.6.0 Darwin Kernel Version 16.6.0: Fri Apr 14 16:21:16 PDT 2017; root:xnu-3789.60.24~6/RELEASE_X86_64 x86_64 . Subsystem: ht...

#

read first URL first

upbeat palm Sep 14, 2018, 9:05 AM

#

Finally...

#

https://latesthackingnews.com/2018/09/14/new-ransomware-named-pylocky-discovered/

Latest Hacking News

Harikrishna Mekala

New Ransomware Named PyLocky Discovered - Latest Hacking News

Security experts at Trend Micro have found a new Ransomware strain named PyLocky which has been involved in attacks between July

lusty flare Sep 14, 2018, 10:01 AM

#

ooooooooffffffffffff

#

RCE for Alpine

#

https://justi.cz/security/2018/09/13/alpine-apk-rce.html

Remote Code Execution in Alpine Linux

tl;dr I found several bugs in apk, the default package manager for Alpine Linux. Alpine is a really lightweight distro that is very commonly used with Docker...

orchid notch Sep 14, 2018, 10:58 AM

#

That's a big oof for docker applications

lavish hull Sep 14, 2018, 2:29 PM

#

Is there a discord cyber security group anyone is familiar with ?

orchid notch Sep 14, 2018, 2:35 PM

#

I know about a few which degraded into shit holes or are dead now. Why do you mind?

#

@lavish hull

lavish hull Sep 14, 2018, 2:35 PM

#

Just because tbh

#

Always like seeing more stuff

#

Twitter and reddit aren't enough sometimes

silent pier Sep 14, 2018, 3:55 PM

#

Might be a bit off but is there any security benefits to having big unique but pseudo random IDs for all user entries in a db over just auto incrementing them

clever cobalt Sep 14, 2018, 4:09 PM

#

I mean.. probably not? The only situation I can think having incremental IDs would be "harmful" is if someone has a way of accessing the users by ID and therefore it'd be easy for them to scan through the data but then you have a bigger problem than that

#

I feel like all the issues I can think of presuppose a preexisting, much more severe security issue

silent pier Sep 14, 2018, 4:24 PM

#

Seems fair

#

I don't even need a row id thinking about it.. usernames are unique, else they can't use em

clever cobalt Sep 14, 2018, 4:28 PM

#

finger_gun

lusty flare Sep 14, 2018, 4:35 PM

#

front facing incrementals are bad

#

👌

covert nacelle Sep 14, 2018, 6:49 PM

#

@silent pier no tbh, because you will have to store other identifying data to actually know which user it is

#

So one way or another users can be identified if there's a db leak

silent pier Sep 14, 2018, 6:50 PM

#

How will i connect that identifier to the user then?

covert nacelle Sep 14, 2018, 6:54 PM

#

@silent pier unless you want nobody to be able to identify who the data belongs to, including you

#

There will always be some identifier that can be traced back to the user

silent pier Sep 14, 2018, 6:54 PM

#

Don't get me wrong, I see what you're getting at

#

but I dont see how to connect them, if the db is breached

covert nacelle Sep 14, 2018, 6:55 PM

#

So using randomized IDs just increases search time

#

Like, imagine i randomized somebodys id

#

I use their name and identifier instead

#

Like WrongEnd#3931

#

Now if they change that the data no longer connects to them so i have two options

#

Switch the old name to the new one

silent pier Sep 14, 2018, 6:56 PM

#

Oh I see

covert nacelle Sep 14, 2018, 6:56 PM

#

Or keep a running list of namechanges and a current name

silent pier Sep 14, 2018, 6:56 PM

#

If data is editable

#

In my case it's a very basic create user + pass situation which you log into

#

That user has access to a set of messages to read

#

and that's it

#

send messages

covert nacelle Sep 14, 2018, 6:57 PM

#

My point is no matter what you do they will be identifiable unless they are totally anonymous

silent pier Sep 14, 2018, 6:57 PM

#

Fairenough

covert nacelle Sep 14, 2018, 6:57 PM

#

User plus pass can be totally anonymous if you dont want to lock it to a certain set of accounts

silent pier Sep 14, 2018, 6:57 PM

#

I guess I could implement an unique ID just for the design to be more dynamic

covert nacelle Sep 14, 2018, 6:58 PM

#

Like even if you hashed their name n shit

#

If they know who they're looking for they can just hash the name themselves and search the db for that hash

silent pier Sep 14, 2018, 6:58 PM

#

I was thinking of using something close to discords snowflake before deciding to just use name+pass

simple orchid Sep 14, 2018, 6:59 PM

#

what if you encrypted all of the user's data with their password

#

so the server itself can only access it when they're logged in

silent pier Sep 14, 2018, 6:59 PM

#

Huh

#

thinkmon

covert nacelle Sep 14, 2018, 6:59 PM

#

It'd need to be reversible which automatically makes it crackable

simple orchid Sep 14, 2018, 6:59 PM

#

you couldn't let them reset though, all their data dies

covert nacelle Sep 14, 2018, 6:59 PM

#

It's a safer option but not a guarantee

#

Plus it would be hell on cpu to constantly encrypt and decrypt

simple orchid Sep 14, 2018, 7:00 PM

#

store all the data in local storage; signed by the server if you need the user to not be able to tamper with it

covert nacelle Sep 14, 2018, 7:00 PM

#

So it's not scalable for everyday access

simple orchid Sep 14, 2018, 7:00 PM

#

ultimately any solution depends on what the data is and how secure it needs to be

silent pier Sep 14, 2018, 7:00 PM

#

The application I'm creating doesn't need to be the most efficient, but be as secure as possible

#

for mostly the top OWASP breaches

simple orchid Sep 14, 2018, 7:01 PM

#

both solutions i mentioned have the weakness that the user can lose it and it can't be retrieved for them

covert nacelle Sep 14, 2018, 7:01 PM

#

A good draw for hashing is the computer can't hash quickly

orchid notch Sep 14, 2018, 7:01 PM

#

Speaking about CPU usage when en and decrypting huge chunks of data

covert nacelle Sep 14, 2018, 7:01 PM

#

So users cant hammer it with shitloads of requests until they get it

silent pier Sep 14, 2018, 7:01 PM

#

Yeah that is a good perk

orchid notch Sep 14, 2018, 7:02 PM

#

How does LUKS (Linux hard drive encryption ) handle decrypting terrabyte sized hard drives quite quickly

silent pier Sep 14, 2018, 7:02 PM

#

I was messing about with a custom script and a leaked hash set not long ago

#

got surprisingly a lot of them within a day

#

So limiting the amount of tries is part of my agenda

covert nacelle Sep 14, 2018, 7:02 PM

#

Generally you can get a good chunk by using a preset attack

silent pier Sep 14, 2018, 7:02 PM

#

(Given i wont leak the hashes)

covert nacelle Sep 14, 2018, 7:02 PM

#

Searching for uh

silent pier Sep 14, 2018, 7:03 PM

#

both dictionary and rainbow attacks crack quite a lot very fast.

covert nacelle Sep 14, 2018, 7:03 PM

#

Well, trying "password" will often reveal the hash contents to you

simple orchid Sep 14, 2018, 7:03 PM

#

make the salts longer

covert nacelle Sep 14, 2018, 7:03 PM

#

Because people are dumb and use password as their password

silent pier Sep 14, 2018, 7:03 PM

#

Oh bais

simple orchid Sep 14, 2018, 7:03 PM

#

incorporate the username as an additional salt

silent pier Sep 14, 2018, 7:03 PM

#

I forgot to salt my passwords

#

lol ty

simple orchid Sep 14, 2018, 7:04 PM

#

sure if there are only 4096 salts, you can generate all the hashes for "password" and search for them

#

but make the salts longer and it's exponentially more difficult

silent pier Sep 14, 2018, 7:04 PM

#

Ay

#

But if username can be edited, would using their username as a salt be.. smart?

simple orchid Sep 14, 2018, 7:04 PM

#

require them to enter their password to do that, and rehash it

silent pier Sep 14, 2018, 7:04 PM

#

I'd have to store their initial username on the side then

#

Hm

covert nacelle Sep 14, 2018, 7:05 PM

#

I would use their id as a hash

#

Or a salt rather

#

Since id is immutable

silent pier Sep 14, 2018, 7:05 PM

#

That's fair, it might turn out to be quite a big id as well

#

if i get my idea to work like I want it to

simple orchid Sep 14, 2018, 7:05 PM

#

or, yeah, just store the whole salt

#

it being open-ended how big a salt can be is the important part

silent pier Sep 14, 2018, 7:06 PM

#

Yup

#

But doing pass+salt+id -> hash might be even stronger?

#

Or is it being overkill at that point

#

store id like an id, salt on the side and hash as password

covert nacelle Sep 14, 2018, 7:08 PM

#

I mean you could combine salt plus id and hash that

#

And use that as a salt

silent pier Sep 14, 2018, 7:08 PM

#

Not make it intuitive what the salt is, but you know always expect an attacker to know your code

covert nacelle Sep 14, 2018, 7:08 PM

#

It's just a matter of how long do you want it to take and how intensive are you willing to handle

silent pier Sep 14, 2018, 7:09 PM

#

given it'll be a very small set of users just brute testing all salts available in a db leak wouldnt take long would it?

covert nacelle Sep 14, 2018, 7:09 PM

#

You could create hashes thousands of characters long but you don't because while it'd be fucking uncrackable, good luck accessing the data in a reasonable timeframe

#

Because you gotta make the hashes again to check equality

silent pier Sep 14, 2018, 7:10 PM

#

fair

#

Just trynna think about the most secure way to do it for a small set of users

simple orchid Sep 14, 2018, 7:11 PM

#

the biggest threat is password reuse anyway

#

and there's not much you can do about that

#

https://xkcd.com/792/

xkcd: Password Reuse

covert nacelle Sep 14, 2018, 7:11 PM

#

When momo, sharp and I did it we didn't do a lotta complex stuff

#

Check the register endpoint in auth on defiant sails codejam 2

#

We made a pretty standard authentication there that should be reasonably secure for small-scale

simple orchid Sep 14, 2018, 7:12 PM

#

(Like, the XKCD is about an evil website operator, but just another site's database which uses weaker security than yours being leaked is the more likely threat)

silent pier Sep 14, 2018, 7:14 PM

#

Yeah.. stupid users PunOko

#

Be more secure

thorn obsidian Sep 14, 2018, 10:21 PM

#

What languages should one learn after Python for Cybersec, Ethical Hacking and Cryptology

orchid notch Sep 14, 2018, 10:25 PM

#

you can learn C and more low level stuff in general

thorn obsidian Sep 14, 2018, 10:38 PM

#

Why low level stuff?

orchid notch Sep 14, 2018, 10:38 PM

#

because hacking is related to low level stuff

#

at least sometimes

upbeat palm Sep 15, 2018, 12:54 AM

#

+1

#

@thorn obsidian It depends what you want to do...like if you want to do web application penetration testing then you should learn JavaScript, HTML, CSS etc.

thorn obsidian Sep 15, 2018, 12:56 AM

#

I may also learn them

#

may do Python > C/C++ > JS > CSS > HTML

#

in that order

#

I guess

#

idk

#

I dont want to pentest websites etc

#

but idk, I am no expert in this field

#

I'd rather try breaching/pentesting systems

upbeat palm Sep 15, 2018, 12:57 AM

#

(That was a fastest response I've ever seen)
Learn C&C++ before js,html and others

safe bear Sep 15, 2018, 12:57 AM

#

Good source of the latest in cybersecurity: https://www.reddit.com/r/netsec/

/r/netsec - Information Security News & Discussion

A community for technical news and discussion of information security and closely related topics.

#

upbeat palm Sep 15, 2018, 12:58 AM

#

Assembly Language is also good

safe bear Sep 15, 2018, 12:58 AM

#

Speaking of what to learn: https://blog.ret2.io/2018/09/11/scalable-security-education/

Ret2 Systems Blog

Scaling up Binary Exploitation Education

The shortage of proficient cyber operators in a world now dependent on connectivity and information has left nations scrambling to build capabilities in a vo...

#

Yeah, learning C and knowing the basics of assembly is essential if you're doing any sort of binary reverse engineering or exploit development

upbeat palm Sep 15, 2018, 12:59 AM

#

Oh yeah, I almost forgot that
Thanks @safe bear

safe bear Sep 15, 2018, 12:59 AM

#

It's not terribly essential for network/protocol stuff though

#

C is still really useful for that though, since you often have to grok (read and interpret) network codes written in C

upbeat palm Sep 15, 2018, 12:59 AM

#

Binary exploitation resources are so low but it worth the time

safe bear Sep 15, 2018, 1:00 AM

#

If you want to learn do this: http://overthewire.org/wargames/bandit/

#

I learned a ton about Linux and exploitation by doing the Bandit series

lilac gulch Sep 15, 2018, 1:00 AM

#

where did "grok" come from?

safe bear Sep 15, 2018, 1:00 AM

#

@lilac gulch http://www.catb.org/jargon/html/G/grok.html

upbeat palm Sep 15, 2018, 1:01 AM

#

Lemme check,thanks for this wonderful resource
Have you ever tried reverse engineering?

safe bear Sep 15, 2018, 1:01 AM

#

Yes

upbeat palm Sep 15, 2018, 1:01 AM

#

IDA or other debuggers?

safe bear Sep 15, 2018, 1:01 AM

#

Nope

#

Well, I did use Ida once during a class

upbeat palm Sep 15, 2018, 1:02 AM

#

Then?

lilac gulch Sep 15, 2018, 1:02 AM

#

ah lol

safe bear Sep 15, 2018, 1:02 AM

#

Just by hand with gdb and nano lol

upbeat palm Sep 15, 2018, 1:03 AM

#

During a class, lucky you
My college professors don't even know what GDB is

#

GDB is good,gotta check Nano

safe bear Sep 15, 2018, 1:03 AM

#

Well a lot of that was doing the Bandit exercise I just linked

#

Nano is just a basic text editor

upbeat palm Sep 15, 2018, 1:04 AM

#

Oh...

safe bear Sep 15, 2018, 1:04 AM

#

Because I can never remember Vi's keybindings other than insert, write, and quit

upbeat palm Sep 15, 2018, 1:04 AM

#

If I may ask what's your age?

safe bear Sep 15, 2018, 1:04 AM

#

0ld

upbeat palm Sep 15, 2018, 1:05 AM

#

True...No one can expect paranoids
That's great...security engineer?

lilac gulch Sep 15, 2018, 1:05 AM

#

old bird here

#

He went crazy from trying to quit vim at the ripe old age of 24

upbeat palm Sep 15, 2018, 1:06 AM

#

lol

thorn obsidian Sep 15, 2018, 1:15 AM

#

📎 unknown.png

#

I already have a lot of stuff bookmarked

#

in my cybersec & pentesting folder

#

netsec and scaling are new

#

I am doing a small Python project

#

a GPA calculator

#

then will do some C then C++

safe bear Sep 15, 2018, 1:18 AM

#

I probably have well over 400 bookmarks at this point just for cybersecurity

thorn obsidian Sep 15, 2018, 1:20 AM

#

Damn

#

trying to do my Git in #tools-and-devops for Pycharm

#

if anyone can help btw

safe bear Sep 15, 2018, 1:21 AM

#

Please don't ask for help in other channels

thorn obsidian Sep 15, 2018, 1:21 AM

#

apologies

safe bear Sep 15, 2018, 1:21 AM

#

Just wait

upbeat palm Sep 15, 2018, 1:56 AM

#

https://github.com/gentilkiwi/mimikatz

GitHub

gentilkiwi/mimikatz

A little tool to play with Windows security. Contribute to gentilkiwi/mimikatz development by creating an account on GitHub.

safe bear Sep 15, 2018, 2:24 AM

#

Good ole' mimikatz

upbeat palm Sep 15, 2018, 4:12 AM

#

Yup

thorn obsidian Sep 15, 2018, 8:08 AM

#

https://github.com/jovanbulck/nemesis

GitHub

jovanbulck/nemesis

Nemesis: Studying microarchitectural timing leaks in rudimentary CPU interrupt logic - jovanbulck/nemesis

#

@simple orchid you and a few others had a convo about password re-use, there are actually things you can do to stop that

I'm a big fan of troy hunt, he has a system that allows you to automatically check passwords against pretty much every major database leak in the last 10 years, all anonymously and for free
https://haveibeenpwned.com/Passwords

Have I Been Pwned: Pwned Passwords

Have I Been Pwned allows you to search across multiple data breaches to see if your email address has been compromised.

#

https://www.troyhunt.com/introducing-306-million-freely-downloadable-pwned-passwords/

Troy Hunt

Introducing 306 Million Freely Downloadable Pwned Passwords

Edit 1: The following day, I loaded another set of passwords which has brought this up to 320M. More on why later on. Edit 2: The API model described below has subsequently been discontinued in favour of the k-anonymity model launched with V2. Last week I wrote about Password...

#

he operates an API that people can query, or you can check the DB locally

#

the amount of passwords is actually up to about 512m now

upbeat palm Sep 15, 2018, 8:15 AM

#

@thorn obsidian Thanks for post...seems quite informative

thorn obsidian Sep 15, 2018, 8:15 AM

#

np

#

the above system is actually used by big sites currently, like 1password and EVE Online

upbeat palm Sep 15, 2018, 8:18 AM

#

I have some experience with leaked databases

#

When I was on telegram there were channels who post premium accounts of users
They call it "hacking",lol

silent pier Sep 15, 2018, 8:44 AM

#

lol, my old password is breached

#

Good stuff

thorn obsidian Sep 15, 2018, 8:48 AM

#

he also operates https://haveibeenpwned.com/ which can be used to check for breach based on email

Have I Been Pwned: Check if your email has been compromised in a d...

Have I Been Pwned allows you to search across multiple data breaches to see if your email address has been compromised.

thorn obsidian Sep 15, 2018, 9:05 AM

#

https://www.extremetech.com/computing/276991-f-secure-says-almost-all-computers-are-vulnerable-to-new-cold-boot-attack

ExtremeTech

Ryan Whitwam

F-Secure Says Almost All Computers Are Vulnerable to New Cold Boot...

F-Secure's Olle Segerdahl and Pasi Saarinen found a way to rewrite the non-volatile memory chip that contains the security settings, thus disabling memory overwriting.

silent pier Sep 15, 2018, 1:53 PM

#

https://www.hackthebox.eu Anyone else trying their skills here?

Hack The Box

Hack The Box :: Penetration Testing Labs

An online platform to test and advance your skills in penetration testing and cyber security.

upbeat palm Sep 15, 2018, 3:16 PM

#

I want to but I can't
This is the best CTF portal
You should pin this @silent pier

silent pier Sep 15, 2018, 3:16 PM

#

I can't pin :P

#

I'm proud I managed to find the code

upbeat palm Sep 15, 2018, 3:17 PM

#

The invite code?

silent pier Sep 15, 2018, 3:17 PM

#

Other than that, going to leave the whole setting up a secure env etc to work with for later

#

Yeah

upbeat palm Sep 15, 2018, 3:17 PM

#

That require some basic JavaScript and HTML, I guess

silent pier Sep 15, 2018, 3:18 PM

#

and string manipulation / basic decoding

upbeat palm Sep 15, 2018, 3:18 PM

#

You should try, I was checking some CTF team and they are awesome
One is good at reverse engineering,other one was good at binary exploitation and vice versa

silent pier Sep 15, 2018, 3:19 PM

#

Can't say im an expert in either

#

But know a bit of each so far

upbeat palm Sep 15, 2018, 3:20 PM

#

Point is cyber security is just like programming that need logic and analytics skills
You did both...wow

orchid notch Sep 15, 2018, 3:20 PM

#

programming needs those two too

#

so cyber security is like programming 🤔

upbeat palm Sep 15, 2018, 3:22 PM

#

I was trying to decode a PDF file blackout text and redacted it got a flag...but can't progress further...

#

@orchid notch It involves programming...

orchid notch Sep 15, 2018, 3:22 PM

#

i read this book abouut cryptography from my library yesterday because i was bored

upbeat palm Sep 15, 2018, 3:22 PM

#

Which book?

orchid notch Sep 15, 2018, 3:22 PM

#

a third of it was about stenography

#

german my friend

#

german

#

they listed so many ways

#

its crazy

upbeat palm Sep 15, 2018, 3:23 PM

#

Oh... Sounds boring

orchid notch Sep 15, 2018, 3:23 PM

#

no

upbeat palm Sep 15, 2018, 3:24 PM

#

I'm just gonna read "Cryptography Engineering"

orchid notch Sep 15, 2018, 3:24 PM

#

they explained a stenography technique from the 16th century where people would write different letter styles in order to create a binary system

upbeat palm Sep 15, 2018, 3:24 PM

#

@orchid notch 🤔

#

History of Cryptography is kinda amazing to know about....

orchid notch Sep 15, 2018, 3:25 PM

#

so you would write an "a" in one style and another one in another style

#

and from that create a binary system

upbeat palm Sep 15, 2018, 3:25 PM

#

Just like knowing about analytical engine

orchid notch Sep 15, 2018, 3:25 PM

#

it gets even more crazy

#

eventually the distance between the letters with different styles (distance in other letters) would also matter for the meaning

upbeat palm Sep 15, 2018, 3:26 PM

#

The key?

orchid notch Sep 15, 2018, 3:26 PM

#

there is no key

#

its stenography

#

its hidden writing

#

stenography hides the existance of a message

upbeat palm Sep 15, 2018, 3:26 PM

#

😖

orchid notch Sep 15, 2018, 3:27 PM

#

lol

upbeat palm Sep 15, 2018, 3:27 PM

#

Try "Serious Cryptography"
You're interested in networking?

orchid notch Sep 15, 2018, 3:27 PM

#

¯_(ツ)_/¯

#

i guess im not bad with it

upbeat palm Sep 15, 2018, 3:28 PM

#

👌

orchid notch Sep 15, 2018, 3:29 PM

#

there are stenography techniques hiding the message in a binary system created from rhymes schemes in poems

upbeat palm Sep 15, 2018, 3:32 PM

#

That was so inconvenient

orchid notch Sep 15, 2018, 3:32 PM

#

huh?

upbeat palm Sep 15, 2018, 3:33 PM

#

I mean doing all that encryption/decryption by hands...real genius

orchid notch Sep 15, 2018, 3:33 PM

#

its technically not encryption

#

and the pre electronic stuff was kinda easy to do with some help devices

upbeat palm Sep 15, 2018, 3:34 PM

#

Oh...

orchid notch Sep 15, 2018, 3:34 PM

#

ByteCommander is typing

tight abyss Sep 15, 2018, 3:34 PM

#

*steganography

orchid notch Sep 15, 2018, 3:34 PM

#

sh

#

leave my mobiles autocorrection alone

tight abyss Sep 15, 2018, 3:35 PM

#

stenography is something different, my young friend

orchid notch Sep 15, 2018, 3:35 PM

#

its this weird keyboard thing right?

upbeat palm Sep 15, 2018, 3:35 PM

#

🤔

tight abyss Sep 15, 2018, 3:35 PM

#

what?

orchid notch Sep 15, 2018, 3:35 PM

#

stenography

#

steno typing

#

https://www.youtube.com/watch?v=RBBiri3CD6w

YouTube

Ted Morin

Coding in Stenography, Quick Demo

Here's a quick steno demo where I write a simple FizzBuzz in JavaScript using a generator function. FizzBuzz is a program that prints out the numbers 1 to 10...

▶ Play video

#

weird keyboard thing

tight abyss Sep 15, 2018, 3:36 PM

#

https://en.wikipedia.org/wiki/Shorthand

Shorthand

Shorthand is an abbreviated symbolic writing method that increases speed and brevity of writing as compared to longhand, a more common method of writing a language. The process of writing in shorthand is called stenography, from the Greek stenos (narrow) and graphein (to writ...

orchid notch Sep 15, 2018, 3:36 PM

#

yeah thats old stenography

#

nowdays we have keyboards for stenography

upbeat palm Sep 15, 2018, 3:37 PM

#

Most of the doctor here write like that,lol

silent pier Sep 15, 2018, 3:38 PM

#

waity what is that keyboard doing

orchid notch Sep 15, 2018, 3:38 PM

#

magic

silent pier Sep 15, 2018, 3:38 PM

#

Yes.

orchid notch Sep 15, 2018, 3:38 PM

#

its typing whole syllables instead of letters

upbeat palm Sep 15, 2018, 3:39 PM

#

If steganography is hiding of text,how someone gonna understand it then🤔

orchid notch Sep 15, 2018, 3:39 PM

#

by knowing how it was hidden

upbeat palm Sep 15, 2018, 3:40 PM

#

A mutual understanding of encryption algorithms

orchid notch Sep 15, 2018, 3:40 PM

#

again its not encryption

#

there is no key etc involved

upbeat palm Sep 15, 2018, 3:41 PM

#

I think I should check steganography on wikipedia

orchid notch Sep 15, 2018, 3:41 PM

#

modern steganography is all automated

#

there is for example hiding informations in pictures

#

not like the actual picture

#

but the file

upbeat palm Sep 15, 2018, 3:42 PM

#

Woah

orchid notch Sep 15, 2018, 3:42 PM

#

in fact there used to be methods of steganography for hiding messages inside pictures

#

for example morse codes using grass

upbeat palm Sep 15, 2018, 3:43 PM

#

That is advanced

orchid notch Sep 15, 2018, 3:43 PM

#

that is actually pretty old

upbeat palm Sep 15, 2018, 3:44 PM

#

You said it was boring but it kinda sounds interesting to me

orchid notch Sep 15, 2018, 3:44 PM

#

i said its boring?

#

you said its boring

#

i said no

#

📎 Semagramm.png

upbeat palm Sep 15, 2018, 3:46 PM

#

📎 Screenshot_20180915-2115252.png

orchid notch Sep 15, 2018, 3:46 PM

#

@upbeat palm thats the pic im talking about

#

no no

#

i was bored

#

so i read it

upbeat palm Sep 15, 2018, 3:46 PM

#

Lol

orchid notch Sep 15, 2018, 3:46 PM

#

the morse code

#

is in the grass on the left of the river

upbeat palm Sep 15, 2018, 3:47 PM

#

Sorry @orchid notch
Yeah, checking

orchid notch Sep 15, 2018, 3:47 PM

#

or

upbeat palm Sep 15, 2018, 3:47 PM

#

That's pretty hard to find

orchid notch Sep 15, 2018, 3:47 PM

#

check this

📎 Semagramm-Tree.png

#

the apples are the message

upbeat palm Sep 15, 2018, 3:48 PM

#

Roots are also looking like message

orchid notch Sep 15, 2018, 3:49 PM

#

nope

#

just the apples

upbeat palm Sep 15, 2018, 3:49 PM

#

This technique is awesome
I'm gonna research about them

orchid notch Sep 15, 2018, 3:50 PM

#

Sadly discord won't accept the solution pic

#

What you do is put an alphabet above the picture

#

With columns for every letter

upbeat palm Sep 15, 2018, 3:51 PM

#

Why discord...Why?

orchid notch Sep 15, 2018, 3:51 PM

#

And then the apples give a message

silent pier Sep 15, 2018, 3:51 PM

#

thonk

orchid notch Sep 15, 2018, 3:51 PM

#

I'll show you when FKIN DISCORD accepts my message

silent pier Sep 15, 2018, 3:51 PM

#

try cropping edges

upbeat palm Sep 15, 2018, 3:51 PM

#

Good idea

orchid notch Sep 15, 2018, 3:51 PM

#

It just says upload failed

#

Grrrr

silent pier Sep 15, 2018, 3:52 PM

#

Or send top half, then bottom half lul

orchid notch Sep 15, 2018, 3:52 PM

#

📎 Semagramm-Tree-Solution.png

#

there we go

#

thats the solution

#

it says
INDE HIC LONGAT IBI SINT TEMPORA PROSPERA FIAT

upbeat palm Sep 15, 2018, 3:52 PM

#

🙃

silent pier Sep 15, 2018, 3:52 PM

#

yes.

orchid notch Sep 15, 2018, 3:52 PM

#

yes that is latin

upbeat palm Sep 15, 2018, 3:53 PM

#

What else we can expect that's from 16th century
But this is simply amazing

#

From where you're getting these?

orchid notch Sep 15, 2018, 3:53 PM

#

that one was 17 century

#

i just googled some time for the book and found that some german guy published the pics

upbeat palm Sep 15, 2018, 3:54 PM

#

Oh...

#

Brb, going for dinner

orchid notch Sep 15, 2018, 3:55 PM

#

📎 Vigenere-Sky-300x216.png

#

thats also a hidden message

#

its by vigenere

#

but i didnt understand how it works

#

meh

#

the stars are the solution

#

open for suggestions

#

imagine somebody hiding an AES encrypted message in a picture

#

you would only see garbage once you found it and think you did something wrong

upbeat palm Sep 15, 2018, 4:18 PM

#

It's doesn't look like vigenere

#

@orchid notch That's the purpose of Cryptography

orchid notch Sep 15, 2018, 4:19 PM

#

no no

#

this is by vigenere

#

vigenere is a person

upbeat palm Sep 15, 2018, 4:20 PM

#

Oh... I thought you were talking about Vigenere cipher

orchid notch Sep 15, 2018, 4:20 PM

#

no i am talking about the picture

#

he made that

#

he even explained how it works in his books

#

but i dont speak french

upbeat palm Sep 15, 2018, 4:21 PM

#

Damn...so much valuable information,still a lot to discover

safe bear Sep 15, 2018, 4:43 PM

#

safe bear Sep 16, 2018, 1:22 AM

#

!reddit weekly netsec

past starBOT Sep 16, 2018, 1:22 AM

#

Here are this week's top r/netsec posts!

thorn obsidian Sep 16, 2018, 3:20 AM

#

oh supercar keyless entry attacks

#

nice

thorn obsidian Sep 16, 2018, 3:36 AM

#

https://twitter.com/k_sec/status/1040744605455532033

Kurt Baumgartner (@k_sec)

google custom-builds censorship, misinformation, and surveillance platform for China, leading several scientists to resign https://t.co/NusyoUUksr

thorn obsidian Sep 16, 2018, 6:26 AM

#

https://nmap.org/p60-12.html

==Phrack Inc.==

               Volume 0x0b, Issue 0x3c, Phile #0x0c of 0x10

|=----=[ Firewall spotting and networks analisys with a broken CRC ]=----=|
|=-----------------------------------------------------------------------=|
|=-----------------------------=[ Ed3f ]=--------------------------------=|```

upbeat palm Sep 16, 2018, 3:32 PM

#

thinkmon

safe bear Sep 16, 2018, 5:05 PM

#

Interesting

#

Pretty old though, since he's talking about a patch to Nmap 3.1

thorn obsidian Sep 16, 2018, 5:25 PM

#

Trying to find project ideas in Python regarding CyberSec and Pentesting

#

can't think of projects

#

I only made Cryptography Collection and a GPA Calculator lmao

#

I thought of making a nmap "visualizer" but idk

#

like spews out premade commands/selections to make it easier to use nmap

#

but what else can I do?

silent pier Sep 16, 2018, 5:27 PM

#

https://www.hackthebox.eu/

Hack The Box

Hack The Box :: Penetration Testing Labs

An online platform to test and advance your skills in penetration testing and cyber security.

#

Doesn't require python to get it, but i'm sure you can find a usecase after wards Nsmug

clever cobalt Sep 16, 2018, 5:27 PM

#

man I got registered then I had no fudging clue what to do

#

😃

silent pier Sep 16, 2018, 5:27 PM

#

Same

#

:D

fervent patio Sep 16, 2018, 5:27 PM

#

same :D

silent pier Sep 16, 2018, 5:28 PM

#

I'd have to setup an vm first

#

before trying

orchid notch Sep 16, 2018, 5:36 PM

#

@thorn obsidian you still have dozens of crypto systems to add to cryco dont you

safe bear Sep 16, 2018, 5:36 PM

#

First step is web app exploitation so I haven't gotten past that yet feelssadman

thorn obsidian Sep 16, 2018, 5:37 PM

#

Aside that @orchid notch

#

I am looking at other projects to do aswell

#

Also I know about hack the box

#

I just dont wanna get into it without knowing jackshit

#

but in all honesty I dont know where to start learning

orchid notch Sep 16, 2018, 5:38 PM

#

you could learn about crypto analytics

safe bear Sep 16, 2018, 5:39 PM

#

Over the wire

#

See the pins

thorn obsidian Sep 16, 2018, 5:46 PM

#

@orchid notch suggestions on where to do that and such?

orchid notch Sep 16, 2018, 5:46 PM

#

uh

#

no

#

:P

#

books i guess

thorn obsidian Sep 16, 2018, 5:47 PM

#

but which books

#

🤔

clever cobalt Sep 16, 2018, 5:47 PM

#

Networking

#

all the networkings

safe bear Sep 16, 2018, 5:47 PM

#

Over the wire

clever cobalt Sep 16, 2018, 5:47 PM

#

You have to be able to recite the 7 OSI model layers in piglatin backwards before you can begin hackthebox

safe bear Sep 16, 2018, 5:48 PM

#

Lol dear lord no

#

You do need to know that for a Cisco certification though

#

PSA: 4 layer model is Shite and "tcp/ip" is stupid

#

Thank you

thorn obsidian Sep 16, 2018, 5:52 PM

#

also

#

hmmmmmmmmmmmmmm

#

📎 unknown.png

upbeat palm Sep 16, 2018, 5:56 PM

#

Computer Networking A Top Down approach is awesome read...

orchid notch Sep 16, 2018, 5:56 PM

#

(anyone else wondering why robin always ends his messages with ....?)

silent pier Sep 16, 2018, 5:58 PM

#

It's common, but not always GWcmeisterPeepoShrug

native edge Sep 16, 2018, 6:00 PM

#

He bound his enter key to type ...enter

orchid notch Sep 16, 2018, 6:00 PM

#

unlikely

safe bear Sep 16, 2018, 7:06 PM

#

Nix...

orchid notch Sep 16, 2018, 7:06 PM

#

KnownError......

safe bear Sep 16, 2018, 7:06 PM

#

NIX...

silent pier Sep 16, 2018, 7:06 PM

#

Floppy!

orchid notch Sep 16, 2018, 7:07 PM

#

KNOWNERROR....

safe bear Sep 16, 2018, 7:08 PM

#

Anywho, Kali is on Windows 10

silent pier Sep 16, 2018, 7:08 PM

#

What's a Kali

safe bear Sep 16, 2018, 7:08 PM

#

You need to be on the latest version to really make use of it though

orchid notch Sep 16, 2018, 7:08 PM

#

Oh kali you mean the phone app?

safe bear Sep 16, 2018, 7:08 PM

#

Kali Linux

orchid notch Sep 16, 2018, 7:08 PM

#

yes i know

safe bear Sep 16, 2018, 7:08 PM

#

It's a Linux distribution for penetration testing

orchid notch Sep 16, 2018, 7:09 PM

#

i know

silent pier Sep 16, 2018, 7:09 PM

#

right

orchid notch Sep 16, 2018, 7:09 PM

#

but ive seen people on discord servers naming it a phone app with hacking tools

safe bear Sep 16, 2018, 7:09 PM

#

I'm not talking to you Nix, but hey, whatever rocks your boat

silent pier Sep 16, 2018, 7:09 PM

#

floats your goat

safe bear Sep 16, 2018, 7:09 PM

#

There is a mobile version

orchid notch Sep 16, 2018, 7:09 PM

#

but its not an app

safe bear Sep 16, 2018, 7:09 PM

#

Kali NetHunter

orchid notch Sep 16, 2018, 7:09 PM

#

and i dont have a boat

#

or a goat

#

😦

#

floppy can you give me a goat or boat

silent pier Sep 16, 2018, 7:10 PM

#

I can provide half n half

orchid notch Sep 16, 2018, 7:10 PM

#

hm

#

ill take both

silent pier Sep 16, 2018, 7:10 PM

#

Half goat, half boat

orchid notch Sep 16, 2018, 7:10 PM

#

yup

silent pier Sep 16, 2018, 7:11 PM

#

Sadly there were no images on google of a half n half goat/boat

#

📎 1d3b22d2f6a4745d13e7bdd4e0ff90b4--so-funny-funny-pics.png

#

So this will have to do

orchid notch Sep 16, 2018, 7:11 PM

#

😭

safe bear Sep 16, 2018, 7:11 PM

#

(off-topic guys)

silent pier Sep 16, 2018, 7:11 PM

#

Did you consider the safety of that goat?

#

I'm done

native edge Sep 16, 2018, 7:12 PM

#

Kali 😂
I

#

I've been asked by multiple people how to do stuff like play games on kali

safe bear Sep 16, 2018, 7:12 PM

#

Haha

#

Does it even have games?

#

It had better

#

Often times you're Internet-isolated

#

And what do you do when you're tired, bored, and waiting for results?

orchid notch Sep 16, 2018, 7:13 PM

#

start the terminal train

#

choop choooop

native edge Sep 16, 2018, 7:15 PM

#

omz or bust

orchid notch Sep 16, 2018, 7:15 PM

#

📎 unknown.png

native edge Sep 16, 2018, 7:18 PM

#

📎 unknown.png

#

Real security research stuff

orchid notch Sep 16, 2018, 7:19 PM

#

terminal train is cooler

safe bear Sep 16, 2018, 7:23 PM

#

sudo updatedb

#

Is that strings on the left, and hexdump on the bottom right?

native edge Sep 16, 2018, 7:24 PM

#

idk, it's hollywood, these windows jump around and constantly run other basic programs

orchid notch Sep 16, 2018, 7:24 PM

#

also remember to print out your source code before compiling people

native edge Sep 16, 2018, 7:25 PM

#

what if i never want to compile people?

orchid notch Sep 16, 2018, 7:25 PM

#

well

#

just print your source code anways

#

always helpful

safe bear Sep 16, 2018, 7:38 PM

#

Charlie-uniform-november-india-bravo-delta-yankee-kilo lel

upbeat palm Sep 17, 2018, 12:55 AM

#

@orchid notch I won't from now.

#

Kali Nethunter is a custom ROM specifically for pentesting and it's only available for Google devices and OnePlus devices,tbh both smartphones are awesome.
Check it on XDA,it has some pretty good features

#

https://github.com/offensive-security/kali-nethunter

GitHub

offensive-security/kali-nethunter

The Kali NetHunter Project. Contribute to offensive-security/kali-nethunter development by creating an account on GitHub.

lusty flare Sep 17, 2018, 9:10 AM

#

https://www.theregister.co.uk/2018/09/17/gao_report_equifax_mega_breach/

Equifax IT staff had to rerun hackers' database queries to work ou...

And let security kit fail for 10 months due to bad cert

#

Ironically,  the security breach was only picked up when someone updated an expired certificate on a piece of kit that was supposed to be monitoring outbound encrypted traffic, and immediately noticed something was wrong. With that device effectively switched off for 10 months due to the expired certificate, “during that period, the attacker was able to run commands and remove stolen data over an encrypted connection without detection,” noted the auditors.```

#

oops.

native edge Sep 17, 2018, 9:11 AM

#

A year later and they've faced little consequence

lusty flare Sep 17, 2018, 9:12 AM

#

yeah

#

talk about toothless regulators

upbeat palm Sep 17, 2018, 4:09 PM

#

Why only this channel is so silent?

silent pier Sep 17, 2018, 4:15 PM

#

Not too many care 'bout dat s'cur'ty

upbeat palm Sep 17, 2018, 4:18 PM

#

But they should, nevermind
Thanks for just replying @silent pier

silent pier Sep 17, 2018, 4:19 PM

#

They should

#

but let's be honest

#

Making things is more fun than making sure it's safe

#

Even thought I have found some joy in thinking about security, sketching out my programs etc lately

silent pier Sep 17, 2018, 5:09 PM

#

Do user information databases keep username, password pair (with or without email), and verify logins with username + password hash. Or do they fetch said user by id

#

generated somehow

upbeat palm Sep 17, 2018, 5:18 PM

#

They store information in
randommail@gmail.com: Password Hash
I have seen some combos that were public obtained by SQLi Dumper afaik

silent pier Sep 17, 2018, 5:19 PM

#

How would they get a users email with a username login then

#

Separate username to email table?

#

Which keeps track of current username of each email

#

but does username ever change thonk

#

What am i fighting again

upbeat palm Sep 17, 2018, 5:21 PM

#

There were two types of combos available in mail:pass and username:pass format

silent pier Sep 17, 2018, 5:21 PM

#

Guess im stuck on doing sql SELECT password, salt FROM users WHERE username = ?; or sql SELECT password, salt FROM users WHERE id = ?;

#

But i can't figure out a clever way to get id from a username login

#

I think I may the overthinking something that won't be an issue

upbeat palm Sep 17, 2018, 5:22 PM

#

They use some type of configuration file and a software (maybe Sentry MBA or something like that) to get desired results
Yup

#

No one going to attack your db particularly

silent pier Sep 17, 2018, 5:23 PM

#

cough you say that

#

But the point is to program something that is resistant to attacks

upbeat palm Sep 17, 2018, 5:24 PM

#

Nothing is perfectly secure
you're right

silent pier Sep 17, 2018, 5:24 PM

#

Oh i think i remember what the "concern" was

#

What if some random encoding is used to "equal" a username in the db, but it passes my validation and the insertion

#

I dont even know if that'spossible

upbeat palm Sep 17, 2018, 5:25 PM

#

I think you're very much concerned about your db security

silent pier Sep 17, 2018, 5:26 PM

#

Oh i know, ill just put the db on a flashdrive and disconnect it when im not monitoring it weSmart

upbeat palm Sep 17, 2018, 5:26 PM

#

If it's possible then it will be good...maybe, because hackers are kinda paranoids so they can find a way to hack it

#

finger_gun

silent pier Sep 17, 2018, 5:27 PM

#

The hacker is just my lecturer thinkies Do i really have to worry here is the question

upbeat palm Sep 17, 2018, 5:27 PM

#

You don't have to worry about it that much.

silent pier Sep 17, 2018, 5:27 PM

#

On a somewhat related topic

#

is there an easy way to detect unicode characters mentioned earlier

upbeat palm Sep 17, 2018, 5:29 PM

#

Actually I was reading a article on unicodes they are annoying.. I don't know about that maybe someone will help you with it
Sorry I was not much of a help :(

silent pier Sep 17, 2018, 5:29 PM

#

Nah man

#

Having feedback is just as much help

#

Let's me vent my thoughts

#

I could probably get the ord of them

#

Check their range to normal letters / symbols

upbeat palm Sep 17, 2018, 5:30 PM

#

Yeah..thats sounds a good idea

#

https://nedbatchelder.com/text/unipain.html

#

Even the title is pain

native edge Sep 17, 2018, 5:31 PM

#

@silent pier compare them to string.printable?

silent pier Sep 17, 2018, 5:31 PM

#

aH believed i watched that

native edge Sep 17, 2018, 5:32 PM

#

>>> string.printable
'0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ!"#$%&\'()*+,-./:;<=>?@[\\]^_`{|}~ \t\n\r\x0b\x0c'

silent pier Sep 17, 2018, 5:32 PM

#

cough Is that in java?

tight abyss Sep 17, 2018, 5:32 PM

#

you might want to use chardet to try detecting encodings

native edge Sep 17, 2018, 5:32 PM

#

thats python

silent pier Sep 17, 2018, 5:33 PM

#

Does it exist is java, is what i ment

#

I guess the ord solution is my best bet without diving too deep into foreign libraries

viral sentinel Sep 17, 2018, 11:16 PM

#

i wonder if this is random enought for use in generating a secret key

def rnd():
    rlist = []
    strs = ''.join(random.SystemRandom().choice(string.ascii_letters + string.digits + string.punctuation) for _ in range(500))
    rlist.append(strs)
    strs = ''.join(random.SystemRandom().choice(string.ascii_letters + string.digits + string.punctuation) for _ in range(500))
    rlist.append(strs)
    strs = ''.join(random.SystemRandom().choice(string.ascii_letters + string.digits + string.punctuation) for _ in range(500))
    rlist.append(strs)
    strss = random.choice(rlist)
    out = random.sample(strss, 120)
    output = ''.join(out)
    print(output)

orchid notch Sep 18, 2018, 12:55 AM

#

Wether this is random enough or not entirely depends on your operating system as it implements the SystemRandom function

viral sentinel Sep 18, 2018, 1:37 AM

#

i believe that it does have reasonably high entropy, ofc it is not used for any sort of nuclear launchcode level secrets

#

especially after i call the function many times and copy random pieces of string and stitche them together

upbeat palm Sep 18, 2018, 2:40 AM

#

+1

safe bear Sep 18, 2018, 2:41 AM

#

There is the secrets module in Python 3.6 that can handle this sort of operation

orchid notch Sep 18, 2018, 3:04 AM

#

Secrets in fact just uses SystemRandom()

upbeat palm Sep 18, 2018, 6:18 AM

#

Gonna check it out

#

I saw a team named Dragon Sector on ctftime and they are awesome...Binary exploitation, reverse engineering, Networking,web application hacking, Pentesting,2 of them are security engineer at Google

upbeat palm Sep 18, 2018, 9:57 AM

#

@orchid notch Do you have a team for CTFs?

orchid notch Sep 18, 2018, 10:21 AM

#

Nope

upbeat palm Sep 18, 2018, 11:02 AM

#

Do you play CTFs or not?

orchid notch Sep 18, 2018, 1:19 PM

#

No

upbeat palm Sep 18, 2018, 1:25 PM

#

Want to?

viral sentinel Sep 18, 2018, 2:09 PM

#

@upbeat palm CTF's are fun

upbeat palm Sep 18, 2018, 2:12 PM

#

Yeah, I'm searching for team

viral sentinel Sep 18, 2018, 8:14 PM

#

@upbeat palm what kind of ctf?

orchid notch Sep 18, 2018, 8:25 PM

#

Never thought about it

upbeat palm Sep 19, 2018, 12:36 AM

#

Okay

#

@viral sentinel kinds?

upbeat palm Sep 19, 2018, 12:47 PM

#

DES is so confusing, I mean 16 rounds of a encryption and with 48 bit keys and yet it's not secure as AES

orchid notch Sep 19, 2018, 12:48 PM

#

That is not really confusing

native edge Sep 19, 2018, 12:49 PM

#

DES was considered to be insecure when it was introduced

upbeat palm Sep 19, 2018, 12:49 PM

#

I mean the encryption process

orchid notch Sep 19, 2018, 12:49 PM

#

AES with 128 bit keys is from a brute force point of view harder to crack than RSA with 4096 bit

upbeat palm Sep 19, 2018, 12:49 PM

#

📎 feistel_structure.jpg

orchid notch Sep 19, 2018, 12:49 PM

#

It's just a feistl network

upbeat palm Sep 19, 2018, 12:50 PM

#

128 bit key use 10 rounds of encryption, right?

orchid notch Sep 19, 2018, 12:50 PM

#

Message is split into half one half gets encrypted using the round key and itself in a function the result of that is XORed with the other half

#

What's so confusing

#

Yeah 10 or 11 I don't remember exactly

upbeat palm Sep 19, 2018, 12:51 PM

#

It's insecure due to computational power of today's computer, I guess

#

128 bit key use 10 rounds and 192 bit use 12 rounds and 256 bit use 14 rounds, I think

#

@orchid notch You made it easy now

orchid notch Sep 19, 2018, 12:52 PM

#

Aha

upbeat palm Sep 19, 2018, 12:53 PM

#

AES is most secure encryption as of now?

orchid notch Sep 19, 2018, 12:58 PM

#

It is considered the standard symmetric algorithm

#

Be careful with "most secure"

upbeat palm Sep 19, 2018, 1:09 PM

#

Yeah

upbeat palm Sep 19, 2018, 1:25 PM

#

AES is can be bruteforced but not enough computational power

thorn obsidian Sep 20, 2018, 9:23 AM

#

A lot of the time key size isn't actually an indication of security, you need to understand the algorithm and what it's doing

#

on top of that there is a whole concept of "bits of security" versus keysize

#

it's complicated™

upbeat palm Sep 20, 2018, 9:41 AM

#

How it's encrypting is first priority and key is second priority? 🤔
Bits of ciphertext and bits of keys
Any resources where I can learn more about this?

orchid notch Sep 20, 2018, 10:15 AM

#

I already said that it depends completely on the algorithm how effective or ineffective a certain key length is. If it comes to the term security of an encryption algorithm you can't really say that one is better, there are three possible ways to get some encryption broken. there is brute force, that one entirely depends on how effective the algorithm uses n bytes of a key to encrypt something so it's computationally intensive to reverse. Then there is crypto analytic stuff, the efficiency of that one depends on the design of the algorithm so there might even be situations where brute force is better than cryp analysis. (For example doing the 24 alphabets on Cesar is easier than doing all that freuquency analysis stuff)
And the third method is a vulnerability either in the algorithm as a mathematical concept, for example that it is easier to brute force with certain methods than the creator thought, and then there are vulnerabilities in the implementations which can even allow to break AES like nothing if correctly exploited (and existing ofc)

upbeat palm Sep 20, 2018, 10:24 AM

#

Woah

#

AES is theoretically bruteforced as stated in Cryptography Engineering book

thorn obsidian Sep 20, 2018, 1:42 PM

#

everything is theoretically bruteforced

#

encryption isn't impossible to break it's just really really really hard

#

also newegg got hacked because their security wasn't quite as hard as AES
https://techcrunch.com/2018/09/19/newegg-credit-card-data-breach/

TechCrunch

Zack Whittaker

Hackers stole customer credit cards in Newegg data breach

Newegg is clearing up its website after a month-long data breach. Hackers injected 15 lines of card skimming code on the online retailer’s payments page which remained for more than a month between August 14 and September 18, Yonathan Klijnsma, a threat researcher at RiskIQ...

proper owl Sep 20, 2018, 1:45 PM

#

Im working on a desktop program that I want solid security with because of some sensitive user data involved. What is the ideal method to store both client-side info and server side info securely.

additionally, what do I need to buy/rent server-wise for the website/account creation/ storage?

thorn obsidian Sep 20, 2018, 1:59 PM

#

just use a normal server, most security is software based

#

as for storing data, depends on what it is and how it's used

#

for server side info encrypt it and make sure people can't just pull it out of a database or whatever randomly

#

but idk, depends a lot on what you're storing

upbeat palm Sep 20, 2018, 2:06 PM

#

Just 15 lines of code and for around a month,the IT department didn't know, that's strange

#

@thorn obsidian Do you play CTFs?

thorn obsidian Sep 20, 2018, 2:09 PM

#

sometimes

#

I prefer to break into real companies tbh :P

#

mostly because i'm lazy and CTFs are usually restricted to some super obscure problem that's never seen in the real world

upbeat palm Sep 20, 2018, 2:12 PM

#

Damn,that's a good reason

#

Would you suggest anyone to play them?

thorn obsidian Sep 20, 2018, 2:13 PM

#

sure

#

they're fun and they teach you lots of neat stuff

#

just not my thing

#

I actually don't mind https://hackthebox.eu/ but I haven't been playing it really

#

hacked like one box and got busy for 6 months doing other shit

upbeat palm Sep 20, 2018, 2:14 PM

#

Do you have a team?
Oh

thorn obsidian Sep 20, 2018, 2:14 PM

#

I don't have a team

#

I might join manyhatsclub but depends on when I pick it back up

#

planning on doing more bug bounties before then

upbeat palm Sep 20, 2018, 2:15 PM

#

A bug bounty hunter,wow
I want to be a security engineer

thorn obsidian Sep 20, 2018, 2:16 PM

#

nice
I'm not really a bounty hunter, I just started doing them

#

before that I was just breaking stuff and emailing people about problems

#

figure I might as well get payed for it too :P

upbeat palm Sep 20, 2018, 2:18 PM

#

If you're putting your time in finding bugs you deserve the prize
Reminds me of one of the joker quotes-"If you're good at something don't do it for free."
Did you learn all stuff on your own or college?

thorn obsidian Sep 20, 2018, 2:18 PM

#

on my own

#

and yea, guess so, it's more something I do on the side for fun so I never really bothered with the money

#

now trying to build a profile so I can show people I understand security lol

upbeat palm Sep 20, 2018, 2:20 PM

#

As far as I know you're the security expert here

thorn obsidian Sep 20, 2018, 2:20 PM

#

nah, @safe bear actually studied that stuff

#

I just screw around sometimes

upbeat palm Sep 20, 2018, 2:21 PM

#

Oh, KnownError is also a security engineer, I guess
Can you suggest me a good way to learn about Cryptography decryption?
I'm learning about them from 2 books

thorn obsidian Sep 20, 2018, 2:22 PM

#

I haven't looked that far into cryptography, but just try reading about algorithms like RSA

#

RSA is nice because it's quite simple and shows the basics of how most asymmetric encryption works

upbeat palm Sep 20, 2018, 2:25 PM

#

@orchid notch shared a document on RSA previous week, actually the thing is for becoming a security engineer I need to cover at least main topics like Cryptography, Penetration Testing, Network Packet Analysis, Forensics, Reverse engineering.
I don't want be a script kiddie

thorn obsidian Sep 20, 2018, 2:27 PM

#

don't worry about it, if you're studying you're doing fine

safe bear Sep 20, 2018, 2:28 PM

#

Crypto is important, but you're specializing or you're doing some kinds of RE you don't use it a whole lot.

thorn obsidian Sep 20, 2018, 2:29 PM

#

^
it's too complicated for mere mortals

#

only metally insane mathematicians study it

safe bear Sep 20, 2018, 2:29 PM

#

No, I wouldn't say that

#

It's really interesting

#

Just difficult if you don't have the maths background

thorn obsidian Sep 20, 2018, 2:30 PM

#

the basics are easy but have you ever tried to write something actually usable in the real world?

safe bear Sep 20, 2018, 2:30 PM

#

Yes

thorn obsidian Sep 20, 2018, 2:30 PM

#

like sure it will work until some asshole comes along and destroys it using CPU interrupts to read the cache data

safe bear Sep 20, 2018, 2:30 PM

#

Not from scratch

thorn obsidian Sep 20, 2018, 2:30 PM

#

lmao

safe bear Sep 20, 2018, 2:30 PM

#

Lol

thorn obsidian Sep 20, 2018, 2:31 PM

#

that's not even a joke

#

https://github.com/jovanbulck/nemesis

GitHub

jovanbulck/nemesis

Nemesis: Studying microarchitectural timing leaks in rudimentary CPU interrupt logic - jovanbulck/nemesis

safe bear Sep 20, 2018, 2:32 PM

#

I know

upbeat palm Sep 20, 2018, 2:37 PM

#

@thorn obsidian I'm studying and thank you for sharing great contents
Mathematics part of Cryptography is kinda difficult but interesting

thorn obsidian Sep 20, 2018, 2:37 PM

#

yea, I can't really understand most of the maths behind cryptography

#

not enough brain cells left for that

upbeat palm Sep 20, 2018, 2:39 PM

#

At start, I was also confused but after studying discrete mathematics and some Wikipedia articles it was easy

not enough brain cells left for that
🤔

#

@safe bear Are you a security engineer?

orchid notch Sep 20, 2018, 3:22 PM

#

Have I just been named mentally insane

thorn obsidian Sep 20, 2018, 3:32 PM

#

Anyone willing to help me find a good laptop in a few possible sites

#

I need it for Pentesting/Cybersec and writing TeX docs

#

I’ll run Kali on it

#

Possible sites of purchase are Amazon Turkey, Mediamarkt Turkey, Teknosa

#

I’ll provide the links etc and help with Turkish to English translation if anyone can help me

#

I got a tight budget so

orchid notch Sep 20, 2018, 3:37 PM

#

The Intel XPSes are quite nice

#

I've had my eyes on a version of the 13 or 15 one for some time 👀

zealous bobcat Sep 20, 2018, 3:59 PM

#

I want to get rid of my dell xps 13. I miss my old lenovos.

orchid notch Sep 20, 2018, 4:03 PM

#

I mean I've got some 10 year old latitude something from dell

#

And my desktop....

upbeat palm Sep 20, 2018, 4:04 PM

#

@thorn obsidian Look for a fast processor like i7 8th gen and 8GB DDR4 RAM because you need several VMs to perform vulnerability test and fast processor and RAM is first priority

thorn obsidian Sep 20, 2018, 4:05 PM

#

I'll share my store links

#

i am writing Algebra I notes on TeX so I am slightly over occupied

#

https://www.amazon.com.tr/b/ref=nav__co_laptop/260-6328206-9795526?ie=UTF8&node=12601898031

Amazon.com.tr: Dizüstü Bilgisayarlar: Bilgisayar

Bilgisayar Mağazasındaki geniş ürün yelpazesinden online Dizüstü Bilgisayarlar alışverişi.

#

All amazon Laptops

#

https://www.teknosa.com/kategori/bilgisayar/notebook/63

NOTEBOOK

En uygun NOTEBOOK fiyatları Teknosa'da. Güncel NOTEBOOK kampanyaları ve fırsatlarına göz atın, aradığınız ürünü uygun fiyata satın alın!

#

Teknosa laptops

#

https://www.mediamarkt.com.tr/tr/category/_taşınabilir-bilgisayarlar-504926.html

#

Mediamarkt

#

I'd like to not buy something too expensive if possible

#

max I can think is 6k liras

upbeat palm Sep 20, 2018, 4:08 PM

#

Lenovo E580 seems good

#

@thorn obsidian Just remember you need 4-5 things i.e. key features-
A fast processor
A good amount of RAM
1-2TB Hard drive @ 7200rpm
Long Battery life-to bring your laptop to completions

thorn obsidian Sep 20, 2018, 4:13 PM

#

I am unsure about the processors

#

and about finding the RPM of the HDD

#

on a laptop

#

I'll check that E580

upbeat palm Sep 20, 2018, 4:14 PM

#

Unsure about processors?
I prefer i7 8th gen or i5 8th gen (depends on your budget)

orchid notch Sep 20, 2018, 4:16 PM

#

Intel processors are a single security risk by design

#

The Intel ME will always have more rights than the current OS

upbeat palm Sep 20, 2018, 4:17 PM

#

Then Ryzen?

zealous bobcat Sep 20, 2018, 4:32 PM

#

I love my Ryzen 1700x, but I dont think they make laptop with those

lusty flare Sep 20, 2018, 5:50 PM

#

IME is fucking sketch

cerulean falcon Sep 20, 2018, 7:19 PM

#

Have you guys played with the Open Data of Rapid7 Labs? https://opendata.rapid7.com/

#

I feel like not many people have exploited that information publicly with a tool to gather information about a specific site yet, or at least not that I know.

thorn obsidian Sep 20, 2018, 8:34 PM

#

https://www.amazon.com.tr/Asus-UX410UQ-GV074T-Notebook-i7-7500U-GeForce/dp/B07BM92HJW/ref=sr_1_1?s=computers&ie=UTF8&qid=1537475627&sr=1-1 @upbeat palm

Asus UX410UQ-GV074T 14" Notebook, Intel Core i7-7500U, 8GB RAM, 1T...

Asus UX410UQ-GV074T 14" Notebook, Intel Core i7-7500U, 8GB RAM, 1TB HDD ve 256GB SSD, Nvidia GeForce 940MX 2GB, Windows 10: Amazon.com.tr

#

how is this

#

it has 8-10 hour battery life

#

2 cores tho

#

https://www.amazon.com.tr/LENOVO-IDEAPAD-80YL004LTX-7500U-WİNDOWS/dp/B07HHBY7PW/ref=sr_1_5?s=computers&ie=UTF8&qid=1537475702&sr=1-5

LENOVO IDEAPAD 520 80YL004LTX CORE İ7 7500U 16GB RAM 1TB HDD 4GB ...

LENOVO IDEAPAD 520 80YL004LTX CORE İ7 7500U 16GB RAM 1TB HDD 4GB EKRAN KARTI WİNDOWS 10 15.6 ınc: Amazon.com.tr: Teknorya

#

https://www.amazon.com.tr/dp/B07HJ9HRD3/ref=sr_1_4?s=computers&ie=UTF8&qid=1537475702&sr=1-4

LENOVO IDEAPAD 520 INTEL CORE İ7 7500U 12GB 1TB GT940MX FREEDOS 1...

LENOVO IDEAPAD 520 INTEL CORE İ7 7500U 12GB 1TB GT940MX FREEDOS 15.6" FHD 80YL00DTTX: Amazon.com.tr: Elmacık

velvet isle Sep 21, 2018, 12:16 AM

#

@cerulean falcon na never heard of it

#

I know rapid7 tho

#

They made burpsuite right ?

cerulean falcon Sep 21, 2018, 12:16 AM

#

Nope, they own metasploit.

#

Portswigger are the creators of burpsuite

#

But I'm interested in that open data, it has a lot of information.

#

They also have an API for developers, but you need to register first.

safe bear Sep 21, 2018, 1:11 AM

#

@upbeat palm no

upbeat palm Sep 21, 2018, 1:39 AM

#

@thorn obsidian Sorry,was tired and sleeping
Will check it out today

#

@safe bear 'Kay,sir.

safe bear Sep 21, 2018, 1:39 AM

#

Thanks

clever cobalt Sep 21, 2018, 1:52 AM

#

Known is Edward Snowden he's just shy

safe bear Sep 21, 2018, 1:55 AM

#

Yes I am in Russia

#

Showing my true American colors

upbeat palm Sep 21, 2018, 1:56 AM

#

biskthink

thorn obsidian Sep 21, 2018, 3:48 AM

#

@cerulean falcon i've seen one guy using the DNS lookups but no tools that i'm aware of make use of it

#

most of the time you can get more up to date SSL information by checking with SSL cert providers and stuff

#

so some tools do that instead

upbeat palm Sep 21, 2018, 5:14 AM

#

Oh

thorn obsidian Sep 21, 2018, 5:36 AM

#

but I can see how it might be neat

upbeat palm Sep 21, 2018, 5:59 AM

#

Some CTF write-ups are awesome

#

For bug bounty hunting one have to learn web application penetration testing, right? @thorn obsidian

thorn obsidian Sep 21, 2018, 6:00 AM

#

nope, companies will pay for security bugs in other services

#

lots of them need mobile testers right now since not many people seem to be doing that

#

web application bugs are just where most people get started

#

and websites are complex so there tends to be more bugs there

#

also it's user facing making the impact large, and making it easy for attackers to access and test

upbeat palm Sep 21, 2018, 6:04 AM

#

More code,more bug, I guess.

safe bear Sep 21, 2018, 5:40 PM

#

https://blog.cloudflare.com/cloudflare-onion-service/amp/

The Cloudflare Blog

Introducing the Cloudflare Onion Service

Two years ago this week Cloudflare introduced Opportunistic Encryption, a feature that provided additional security and performance benefits to websites that had not yet moved to HTTPS.

upbeat palm Sep 22, 2018, 12:28 AM

#

Cloudfare also provide DDoS protection, I guess.

upbeat palm Sep 22, 2018, 1:17 AM

#

http://users.telenet.be/d.rijmenants/en/onetimepad.htm

One-time-pad

Detailed history of one-time pad encryption, images of one-time pads, how they are used and practical examples.

#

This is the only cipher which is unbreakable as of now but very inconvenient.

safe bear Sep 22, 2018, 5:41 AM

#

If you want to keep up on security, I recommend subscribing to these email lists: SANS NewBites, Crypto-Gram by Bruce Schneier, and US-CERT weekly vulnerability summary.

silent pier Sep 22, 2018, 5:47 AM

#

I believe SANS hates me

#

Their email verification links to password reset, which asks for email which sends email verification email that links to password reset

#

and so on

#

https://i.imgur.com/CCvJ92d.gifv

Imgur

upbeat palm Sep 22, 2018, 5:53 AM

#

That's strange. 🤔

#

@safe bear Thanks for suggestions.Can you pin it?

safe bear Sep 22, 2018, 6:01 AM

#

Sure, good idea

#

Um, maybe try another browser @silent pier?

silent pier Sep 22, 2018, 6:01 AM

#

¯_(ツ)_/¯

#

Is it worth it

upbeat palm Sep 22, 2018, 6:03 AM

#

Can't say without using.

#

Thanks, KnownError.

safe bear Sep 22, 2018, 6:44 AM

#

Yes, it is

#

Here's a snippet from one of the bites

📎 sans.PNG

#

There's a summary and a few high quality sources, and sometimes various SANS instructors add their two cents as well

#

These are people who have decades of industry experience in cybersecurity

thorn obsidian Sep 22, 2018, 8:24 AM

#

@upbeat palm http://www.vatanbilgisayar.com/3000-5000-tl-arasi-5000-10000-tl-arasi/notebook/?opf=p22112982,p22112985,p22112989,p23501369&srt=UP

3000 - 4999 TL 5000 - 9999 TL NOTEBOOK FİYATLARI VE MODELLERİ - ...

3000 - 4999 TL 5000 - 9999 TL Notebook fiyatları, en uygun laptop modelleri ve distribütör firma garantili markalar sadece Vatan Bilgisayar'da. Apple, Asus, HP, Lenovo, Msi gibi bir çok marka Notebook modelleri için vatanbilgisayar.com'u ziyaret edin. Fırsatları kaçı...

#

Mind taking a look at this filtered laptop search

#

8-12-16-16(2x8gb) laptops

#

And between a moderable budget I set

#

Not sure what to look for as all are underclocked intel cpus

#

Will i5 even be good for pentesting etc?

upbeat palm Sep 22, 2018, 8:27 AM

#

http://www.vatanbilgisayar.com/hp-15-db0001nt-amd-a9-9425-3-1ghz-8gb-1tb-hdd-15-6-2gb-w10-notebook.html @Arszilla#2780

HP 15-DB0001NT Notebook Fiyatı - Vatan Bilgisayar

Hp 15-db0001nt notebook fiyatı, teknik özellikleri, modelleri. Hp 15-db0001nt notebook fiyatı kampanyalar ve uygun fiyat seçenekleri ile sadece Vatan Bilgisayar'da. Satın Al.

#

This one seems good.

#

You can use Ubuntu in beginning and after some experience move to Kali Linux.

thorn obsidian Sep 22, 2018, 8:28 AM

#

I am already using ubuntu

#

Only small issue with kali is that I may want to use it for casual work aswell

upbeat palm Sep 22, 2018, 8:29 AM

#

Then Kali Linux will be your best friend.

thorn obsidian Sep 22, 2018, 8:29 AM

#

Ie writing TeX

#

And working on my math papers

upbeat palm Sep 22, 2018, 8:29 AM

#

Kali Linux is not made for daily usage.

thorn obsidian Sep 22, 2018, 8:31 AM

#

I am well aware

#

I thought of doing a “build yourself kali” in ubuntu

#

Installing the tools etc

#

Ie aircrack etc

#

Btw is that the “best” laptop under 5k liras?

#

4/5k

upbeat palm Sep 22, 2018, 8:33 AM

#

As far as I know.
DDR4 8GB RAM,1TB Hard Disk etc.
It's best imo.

thorn obsidian Sep 22, 2018, 8:36 AM

#

What about http://www.vatanbilgisayar.com/acer-a515-amd-a10-9620p-2-5ghz-8gb-1tb-hdd-15-6-2gb-w10-notebook.html

ACER A515 AMD A10-9620P 2.5GHZ-8GB-1TB HDD-15.6"-2GB-W10 NOTEBOOK ...

ACER A515 AMD A10-9620P 2.5GHZ-8GB-1TB HDD-15.6"-2GB-W10 NOTEBOOK fiyatı, teknik özellikleri, modelleri, en ucuz fiyatlarla Vatan Bilgisayar'da

#

I used to have an HP Pavilion g6 1246-ee

#

That shit heated like hell

#

A9 CPU vs A10

#

Like does the cpu matter too much?

upbeat palm Sep 22, 2018, 8:38 AM

#

More or less,yeah.

#

If you can get them via store checkout them there before buying.

thorn obsidian Sep 22, 2018, 8:43 AM

#

?

#

What do you mean?

safe bear Sep 22, 2018, 8:43 AM

#

https://www.kali.org/tutorials/my-custom-kali-linux-distribution/

My Custom Kali Linux Distribution

We love it when community members come up with new ideas or interesting builds, and this one caught our attention. Jacek Kowalczyk hit us up on twitter with a really interesting story. His approach to tweaking Kali to be specific to his needs is exactly why this feature is so...

thorn obsidian Sep 22, 2018, 8:46 AM

#

I have that post pinned

#

I like GNOME shell

#

Issue is I cant change those shitty icons in Kali

#

They hurt my eyes

safe bear Sep 22, 2018, 8:54 AM

#

Which icons do you not like?

thorn obsidian Sep 22, 2018, 9:14 AM

#

Generally all

#

While using ubuntu Numix’s simplicity and color scheme was a bliss

thorn obsidian Sep 22, 2018, 9:33 AM

#

@upbeat palm https://support.hp.com/rs-en/document/c06047284

That laptop's RPM is 5400

HP Notebook - 15-db0001nt Product Specifications | HP® Customer S...

Looking for upgrade or update information? Trying to find the names of components or programs? This document contains the technical details for this product.

#

you suggested 7200

#

hmmm

#

but the battery life is approx 10h

upbeat palm Sep 22, 2018, 11:08 AM

#

10 hours is good,Linux consumes less battery as compared to Windows.

tight abyss Sep 22, 2018, 2:33 PM

#

10h would be GWcmeisterPeepoLove

#

I get 3-4h max on mine

#

also, what does this all have to do with #cybersecurity ?

thorn obsidian Sep 22, 2018, 2:38 PM

#

Pentesting

#

i am looking for a laptop for Pentesting, Cybesec and Cryptology

#

@upbeat palm That Acer is 4 cores but clocked lower, HP is 2 cores but clocked higher

#

http://www.cpu-world.com/Compare/10/AMD_A10-Series_for_Notebooks_A10-9620P_vs_AMD_A9-Series_for_Notebooks_A9-9425.html

#

https://www.acer.com/ac/en/GB/content/model/NX.GPYEK.003

Acer

Aspire 5 A515-41G

Discover more about Acer Aspire 5 A515-41G. Windows 10 Home - 39.6 cm (15.6") - 1920 x 1080 - AMD - Radeon RX 540 - AMD A10-9620P processor Quad-core 2.50 GHz - 39.6 cm (15.6") Full HD (1920 x 1080) 16:9 - AMD Radeon RX 540 with 2 GB Dedicated Memory - 8 GB, DDR4 SDRAM - 1 TB...

#

https://icecat.co.uk/p/hp/4ju39ea/notebooks-0192545984850-Notebook+-+15-db0001nt-57433650.html

Specs HP 15-db0001nt 3.1GHz A9-9425 AMD A 15.6" 1366 x 768pixels G...

PIM product data: HP 15-db0001nt 3.1GHz A9-9425 AMD A 15.6" 1366 x 768pixels Grey, Silver Notebook 4JU39EA Notebooks, compare, review, comparison, specifications, price, brochure, catalog, product information, content syndication, product info, product data, datasheet

#

cant decide which one is better

upbeat palm Sep 22, 2018, 2:39 PM

#

Hmm.. I'm confused too.

thorn obsidian Sep 22, 2018, 2:39 PM

#

as I am not sure if 2 extra cores is worth it

#

Advantages of AMD A9-9420
Less power hungry (10 vs 15 watts)
Virtualization (Hardware acceleration of virtual machines)
AMD-V (Virtualization hardware acceleration used in AMD CPUs. Speeds up work with virtual machines)

#

https://technical.city/en/cpu/A10-9620P-vs-A9-9420

A10-9620P vs A9-9420 [in 8 benchmarks]

Comparing performance of introduced in January 2017 AMD A10-9620P с introduced in on June 2016 AMD A9-9420 in games and benchmarks.

#

not sure

#

a9 is supposedly better for vms then

upbeat palm Sep 22, 2018, 2:41 PM

#

It does not. I mean you're not going to make another Anonymous group.So HP will be good.

thorn obsidian Sep 22, 2018, 2:41 PM

#

lmao

#

I dont think I'd run more than 1 vm simultaneously

#

but yea

upbeat palm Sep 22, 2018, 2:47 PM

#

A9 will be good.

thorn obsidian Sep 22, 2018, 5:27 PM

#

lmao

#

fuckin parent says if you want that laptop go fucking work: where-as she asked about the price in the morning and asked whether if I needed it a lot for uni etc/why I needed it

#

Yea, I'll find a work while I am a fulltime student 5 days a week, 9-5

#

fuckin wanker

#

I have a bit of money saved up but thats for economic crisis fund

pulsar crystal Sep 22, 2018, 5:29 PM

#

cool it here or heads will roll

thorn obsidian Sep 22, 2018, 5:29 PM

#

apologies

orchid notch Sep 22, 2018, 7:34 PM

#

https://www.nist.gov/news-events/news/2018/09/nists-encryption-standard-has-minimum-250-billion-economic-benefit

NIST

NIST’s Encryption Standard Has Minimum $250 Billion Economic Ben...

GAITHERSBURG, Md.—The U.S. Department of Commerce’s National Institute of Standards and Technology (NIST) has released...

safe bear Sep 22, 2018, 9:35 PM

#

They also did a similar thing for SHA-3, and are in the process of doing so for Quantum-safe algorithms

#

Yay NIST

upbeat palm Sep 23, 2018, 12:51 AM

#

Damn.

cedar pelican Sep 23, 2018, 12:07 PM

#

@safe bear can quantum-safe algorythims be produced by non-quantum computers?

#

Wait, so a large AES-encrypted key is already quantum-computer resistant? nice!

valid furnace Sep 23, 2018, 12:24 PM

#

@cedar pelican Yes.

#

quantum algorithms have been long designed and theoretically tested

#

https://en.wikipedia.org/wiki/Quantum_programming

Quantum programming

Quantum programming is the process of assembling sequences of instructions, called quantum programs, that are capable of running on a quantum computer. Quantum programming languages help express quantum algorithms using high-level constructs.

#

@cedar pelican people also programmed before computers existed. 😉

orchid notch Sep 23, 2018, 12:41 PM

#

a german group of cs scientists recently published an RFC on quantum resist asymmetriccal encryption

#

the challenge is not to have quantum resistent symmetrical keys, thats already possible, the challenge is to find trapdoor functions which are not solvable by quantum computers

#

https://tools.ietf.org/html/rfc8391

upbeat palm Sep 23, 2018, 12:45 PM

#

@orchid notch You tried it?

orchid notch Sep 23, 2018, 12:46 PM

#

Im not mentally insane

#

that rfc was composed by scientists and researches from universities and security companies which are really deep into that kind of stuff

upbeat palm Sep 23, 2018, 12:47 PM

#

That's what Xair said 2 days ago.
So you're not that much into cryptography.

orchid notch Sep 23, 2018, 12:47 PM

#

xair said what when where

#

@upbeat palm

upbeat palm Sep 23, 2018, 12:48 PM

#

Wait sending.

#

📎 Screenshot_20180923-1818372.png 📎 Screenshot_20180923-1818202.png

#

Kinda true.

orchid notch Sep 23, 2018, 12:51 PM

#

i mean quantum cryptography is just different from the curretn cryptographys math

upbeat palm Sep 23, 2018, 12:51 PM

#

Yup,Quantum cryptography is way too complicated for people like me.

orchid notch Sep 23, 2018, 12:51 PM

#

i mean i didnt even read that rfc

#

i just know a guy who works in the company which contributed to it

upbeat palm Sep 23, 2018, 12:52 PM

#

Wow.

#

I actually know someone who's way better in cryptography than me.

#

And that guy is one and only "Nix".

orchid notch Sep 23, 2018, 12:53 PM

#

if you knew the joke behind my name that sentence would be funny

upbeat palm Sep 23, 2018, 12:54 PM

#

What is it?

#

If you don't mind telling me.

orchid notch Sep 23, 2018, 12:55 PM

#

nix is how germans pronounce the german word for nothing

#

and that guy is "nothing"

upbeat palm Sep 23, 2018, 12:55 PM

#

yoj
Who named you this?

orchid notch Sep 23, 2018, 12:55 PM

#

me

upbeat palm Sep 23, 2018, 12:56 PM

#

Any specific reason?

orchid notch Sep 23, 2018, 12:56 PM

#

nope

#

well

#

Unix and linux are also summed up unter the name *Nix sometimes

upbeat palm Sep 23, 2018, 12:56 PM

#

Ooo

valid furnace Sep 23, 2018, 12:57 PM

#

@upbeat palm It's just another type of thinking that you're unfamiliar with for now

upbeat palm Sep 23, 2018, 12:57 PM

#

I was,but now I'm not.

valid furnace Sep 23, 2018, 12:58 PM

#

also, I call @orchid notch "Nit"

orchid notch Sep 23, 2018, 12:58 PM

#

you dont call me anything

#

ive never even talked to yu

valid furnace Sep 23, 2018, 12:58 PM

#

why is my linux machine talking to me

orchid notch Sep 23, 2018, 12:58 PM

#

I am not your linux machine

upbeat palm Sep 23, 2018, 12:58 PM

#

++

valid furnace Sep 23, 2018, 12:58 PM

#

oh god its sentient

orchid notch Sep 23, 2018, 12:58 PM

#

I am a Unix machine

#

obviously

#

smh

valid furnace Sep 23, 2018, 12:59 PM

#

oh god it identifies its ~~gender~~ , it's evolving too fast

#

yeah, I don't know anything about quantum

#

the only thing I remotely think about it, is maybe you can fight it by keeping a public key secret so a quantum computer wouldn't know what to break

#

get stuck in serial operations, ha

orchid notch Sep 23, 2018, 1:01 PM

#

keeping public keys secret is against the concept of a public key

upbeat palm Sep 23, 2018, 1:02 PM

#

Yup.

valid furnace Sep 23, 2018, 1:02 PM

#

sure, but maybe you can use that principle to shove a quantum computer to be bottlenecked in the serial realm

#

can't break what you can't see?

orchid notch Sep 23, 2018, 1:04 PM

#

if you operate by the principle of keeping the concept behind something secret or generally depend on them not getting your public key etc you violate kerckhoff's principle

valid furnace Sep 23, 2018, 1:04 PM

#

define!

orchid notch Sep 23, 2018, 1:04 PM

#

define what

valid furnace Sep 23, 2018, 1:05 PM

#

I agree though

#

I'm not sure if your failure to define kerckhoff's principle is a sign that you've evolved past google search engine's functions, or you fail it, or you're now too human to care to pass it.

#

anyway, gotta take off, thanks for the chat

orchid notch Sep 23, 2018, 1:07 PM

#

i asked you what to define

valid furnace Sep 23, 2018, 1:07 PM

#

be back tomorrow when nix has turned into skynet but 10x more powerful

orchid notch Sep 23, 2018, 1:07 PM

#

and you never answered

#

so

#

i will not turn into skynet

valid furnace Sep 23, 2018, 1:08 PM

#

friendly net?: D

orchid notch Sep 23, 2018, 1:08 PM

#

neither

valid furnace Sep 23, 2018, 1:08 PM

#

sorry if I interuptted your conversation though, didn't mean to be a dick

#

later

upbeat palm Sep 23, 2018, 1:28 PM

#

Kerckhoffs' principle: the security of the encryption scheme must depend only on the secrecy of the key Ke, and not on the secrecy of the algorithm.

#

If feistel cipher interchange each the L block for R block after each that means both R block and L block get encrypted 8 rounds, together 16 rounds and XORed after it,so this is the reason it's not considered as secure?

orchid notch Sep 23, 2018, 1:40 PM

#

feistl networks are not considred insecure

#

the problem with DES was from the beginning on that it was bruteforcable in theory because of its key size limit and it was just a matter of time until somebody built a machine which was able to do it

#

but there are still modern ish ciphers getting built with feistl networks

upbeat palm Sep 23, 2018, 2:14 PM

#

So feistel cipher was not insecure.Thank you.

orchid notch Sep 23, 2018, 2:17 PM

#

is not insecure

upbeat palm Sep 23, 2018, 4:26 PM

#

Yeah,that's what I mean.

safe bear Sep 23, 2018, 5:23 PM

#

https://www.kali.org/tutorials/making-your-own-kali-linux-metapackages/

Making your own Kali Linux Metapackages

One of the many useful things we can do with APT is create metapackages, which are effectively empty packages that declare a list of other packages as dependencies. Kali Linux includes metapackages for password cracking, software-defined radio, wireless, web applications, and...

thorn obsidian Sep 24, 2018, 9:34 AM

#

I can't find the talk for this, but it's preventing ROP on OpenBSD
https://www.openbsd.org/papers/eurobsdcon2018-rop.pdf

#

bought the number of ROP gadgets in the ARM64 release from 69k to just 46

#

also, appears to act as a more secure stack protector in a way

thorn obsidian Sep 24, 2018, 10:13 AM

#

https://arxiv.org/pdf/1808.07285.pdf
Tor flow correlation (deanonymisation) with deep learning
accuracy at about 96% with 900kb of data ^^

valid furnace Sep 24, 2018, 10:14 AM

#

nice

#

correlation attacks are a bitch

#

citing defcon talks

upbeat palm Sep 24, 2018, 10:23 AM

#

@thorn obsidian Keep posting wonderful article.
Which resource(s) do you use to stay up to date?🤔

thorn obsidian Sep 24, 2018, 10:24 AM

#

A few servers on discord have some nice security stuff that I follow, apart from that places like krebsonsecurity and troyhunt.com are good

#

I also sometimes look at bleepingcomputer

#

mostly I just rely on other people who have RSS feeds lol
I got that link from https://lobste.rs

upbeat palm Sep 24, 2018, 10:26 AM

#

Ethical playground?
Please share with me.🙏

valid furnace Sep 24, 2018, 10:47 AM

#

@thorn obsidian can you help me understand how to setup scalable SSH?

#

I hate the current x509 exclusion and self built ca stuff

thorn obsidian Sep 24, 2018, 10:49 AM

#

I hate it as well, it's a dumpster fire

#

but honestly I don't have to scale SSH so I have no idea

#

my usual work around is to build an automated system that generates keys and authorizes them for SSH

#

basically just ssh-copy-id for all the hosts that need to have authorization

#

you should look into how shit like kubernettes and ansible work though, they can be used to scale stuff like SSH

valid furnace Sep 24, 2018, 10:54 AM

#

@thorn obsidian

Ugh.

#

I'm thinking I'll build an application for scalable ssh, using a bastion host for authorization

#

The idea is you VPN/login to a network, login to a server with ldap + 2 factor

#

an external "security server" can sign you a 1 minute SSH key

#

so you run a command on the bastion host and get an ssh key to connect to remote hosts, done

thorn obsidian Sep 24, 2018, 10:55 AM

#

hmm, sounds pretty good as long as the bastion host can authenticate requests from other servers

#

so it doesn't just randomly sign shit

#

I mean hiding it behind a VPN works too

#

¯_(ツ)_/¯

#

but then why not just trust the people with VPN access

#

it's an extra step when you're already authenticated

#

oh wait you mean VPN into the thing, get an SSH key for remote hosts, then sign into them and push your perm key or whatever?

#

that sounds cool

valid furnace Sep 24, 2018, 11:26 AM

#

@thorn obsidian my thinking is x509 can be used to connect everyone to an internal production network, monitoring and such

#

but only give SSH access to people that need it

thorn obsidian Sep 24, 2018, 11:27 AM

#

I mean, it could be done I guess, but if it's just for servers why not go with kubernettes instead? it provides similar security but was designed for this

zinc mauve Sep 24, 2018, 11:27 AM

#

Quick question: When using flask for a website server, and there is a database, can a person access the python files or the database by a url?

thorn obsidian Sep 24, 2018, 11:27 AM

#

usually no, but depends on what your code does @zinc mauve

valid furnace Sep 24, 2018, 11:27 AM

#

only if you make it

zinc mauve Sep 24, 2018, 11:27 AM

#

I was using the flask tutorial at http://flask.pocoo.org/docs/1.0/tutorial/factory/

#

Because, if I make something like that (thinking of mail program), I don't want other people to be able to download the database and get everyone's data

thorn obsidian Sep 24, 2018, 11:33 AM

#

the tutorial doesn't do anything insecure that would allow you to get files from the system as far as I can see (I only looked quickly)

zinc mauve Sep 24, 2018, 11:34 AM

#

Okay. Because I'm planning on creating a mail program, and I'm gonna follow that tutorial very closely for it

#

Thanks

thorn obsidian Sep 24, 2018, 2:49 PM

#

https://securitytxt.org/

security.txt

A proposed standard which allows websites to define security policies.

valid furnace Sep 24, 2018, 4:22 PM

#

| And an employee should be able to safely access personal email, or porn, on work computers.

Lol. Now I know for certain that you've never worked in IT or security.
Watching porn on your work computer is probably one the single greatest security threats to which you can open your system.
GTFOH

holy hell I hate these people.

#

porn in and of itself is not a security concern.

thorn obsidian Sep 24, 2018, 4:24 PM

#

single greatest security threats
ask him if he's ever used SMB

#

lol

valid furnace Sep 24, 2018, 4:25 PM

#

right? talking on reddit makes me want to punch people in the face.

thorn obsidian Sep 24, 2018, 4:25 PM

#

ahahaha

#

no wonder, fuck reddit, one of the worst places on the internet

valid furnace Sep 24, 2018, 4:25 PM

#

they quote me fucking law, and in the technical wording of the text, they don't even realize it supports what I tell them.

#

For example, while businesses all over get away with monitoring employee activity,
It's technically illegal to monitor anything that's not directly related to representing the business on company equipment.

thorn obsidian Sep 24, 2018, 4:26 PM

#

yea

#

oh hey KDE just crashed, that can't be good

#

AHAHAHA

#

it crashed because systemd failed to rotate a log

#

fucking beautiful

valid furnace Sep 24, 2018, 4:27 PM

#

Sure, they can monitor email, sure, they can monitor AV.
email represents them, it has their name on it.
malware effects their internal security.

But, if I lend you my laptop, that doesn't entitle me to keylog your bank passwords, snapshot you topless at home and more.
You have a right to privacy that cannot be signed away globally.

thorn obsidian Sep 24, 2018, 4:28 PM

#

yea, people confuse shit like that all the time

#

they think terms of service is law etc

valid furnace Sep 24, 2018, 4:28 PM

#

don't even get me started!

#

the BASIS of all contract law (and I'm not even a lawyer), is that you trade something, for something, in "good faith"

#

hiding legal jargon deep in TOS, and tricking people into giving up "all their rights and ownerships" is entirely unenforcable, and in bad faith effectively invalidating the entire contract

#

yet these people will support it

#

@thorn obsidian
https://youtu.be/IDOTbh1P0R0?t=22

YouTube

Payten Inc.

The Matrix - "Most of these people are not ready to be unplugged"

This is a trailer taken from the film The Matrix where Morpheus explains what Morpheus: ************ "The Matrix is a system, Neo, and that system is our ene...

▶ Play video

#

shreds his reddit history

thorn obsidian Sep 24, 2018, 4:35 PM

#

lol

upbeat palm Sep 24, 2018, 4:37 PM

#

finger_gun_dank

thorn obsidian Sep 25, 2018, 8:57 AM

#

You have a right to privacy that cannot be signed away globally.

#

However if you agree to giveaway your privacy...

#

You agreeing with giving away your geo-location, your photoes and stuff you're typing in the search bar all the time.

#

There's no such thing as privacy.

#

And yeah. Above that there're ISPs and big corps who sells all sorts of information.

#

There's no such thing as privacy nowadays.

upbeat palm Sep 25, 2018, 9:02 AM

#

Yeah.

valid furnace Sep 25, 2018, 8:37 PM

#

Cisco has been including root backdoors to their IOS systems

#

release "exploit patches" to fix them

thorn obsidian Sep 25, 2018, 8:37 PM

#

lol

#

cisco can barely manage their shitty OS as it is

#

I doubt they bother putting backdoors into it

#

that would actually be too difficult to maintain

silent pier Sep 26, 2018, 11:12 AM

#

How should a token be handled in a simple client server connection to keep a client verified and logged in

#

I should generate a unique token and pass it to the client on login (I assume), how whats a good approach to storing said token server side

upbeat palm Sep 26, 2018, 11:16 AM

#

Idea is good.

#

You mean if a user wants to login he have to use the "unique" token or it's just one time until the IP gets change?

#

(That's sounds kinda complicated.)

silent pier Sep 26, 2018, 11:20 AM

#

Nono

#

They log in normally, and gets assigned a token for their session which they can they authenticate with later until it expires

#

So they can move around the program and I can verify its the correct client on every step

upbeat palm Sep 26, 2018, 11:21 AM

#

Oh.

#

It sounds like a good security measure.

#

But how you gonna implement it?

silent pier Sep 26, 2018, 11:26 AM

#

That's what im asking :p

#

I was thinking of just passing the token to the user and have them send that everytime the server requests a verification

#

And store it in a db like I treat passwords, but it sounds a bit too much?

upbeat palm Sep 26, 2018, 11:31 AM

#

Yup,wonder if I could help,but I'm not that much experienced.
It depends on content of your program.

silent pier Sep 26, 2018, 11:32 AM

#

Its just a simple client server socket thing

#

With a rather simple own protocol for logging in etc

upbeat palm Sep 26, 2018, 11:33 AM

#

Oh, KnownError or Xair will probably help you with this.

orchid notch Sep 26, 2018, 12:11 PM

#

I guess you can store it in some database system and have a date of creation along it too. Whenever the token is accessed/used you also checked wether it's expired yet or not and remove it if it's expired