« first day (599 days earlier)      last day (4334 days later) » 

sbi
1:00 PM
> "rm -rf /" -- Format's Last Theorem — David Brady
 
@RadekdaknokSlupik universal uniqueness -> replication/sharding/scaling :)
 
@Neil "Simplicity makes a simple interface" - doesn't that strike you as a tautology
 
> TimeStamp. This is a unix style timestamp. It is a signed int representing the number of seconds before or after January 1st 1970 (UTC).
Of course, everybody is going to add documents to the database before 1970…
 
sbi
@sehe No. Doing something in a simplistic way might lead to complexity.
 
1:04 PM
Could it be used to store for example a birthday, or is it strictly for recording file modification times?
 
@sehe Simple interface for me means easy to use, easy to interact with the program without knowing its interworkings.
If Simplicity were the same thing as a simple interface, we'd all be out of a job.
 
@Potatoswatter It's in the automatically generated ID of items you store.
For birthdays you would use a date, not an object ID.
 
crap, LinkedIn password hashes got leaked
 
@RadekdaknokSlupik Well, that's useless because the resolution only goes to seconds.
 
and that was one of the only sites where I still used my old, insecure password that also gets used on some other sites
 
1:06 PM
Sue LinkedIn.
 
LOL why are you looking at that? LinkedIn at some point solved a technical problem?
 
@KonradRudolph Did they say the type of hash?
 
@RadekdaknokSlupik For once, glad I don't write programs to be run in Unix
 
@Collin Salted SHA-1 … in other words, trivially crackable
 
@KonradRudolph Link or it didn't happen?
 
1:08 PM
@KonradRudolph doh
 
:p
 
Oh. I need to chat less until I can read better. :v/
 
Password changed.
 
1:10 PM
@KonradRudolph Crackable like an egg boiled in salty water.. or something
 
@sehe Same here, I use a password manager anyway so I just give out randomly generated ASCII salad
what concerns me more is that there are a few other sites which still use this password, and I unfortunately don’t know which
I hope no important ones
 
sbi
@KonradRudolph Don't you think that you should be able to think of all the important ones?
 
@sbi Not sure
if I had, I would have changed the LinkedIn password before, no? – Not that I consider that website particularly important but it does show up in search results for my name and as such I’d like to keep it clean ;)
 
@KonradRudolph Don't know how accurate they are, but it looks like there's some twitter traffic saying their unsalted SHA-1 hashed passwords are in the list -- might just be making stuff up though
 
@KonradRudolph I have randomised passwords like that, but that is still alarmingly close to home - might be time to change it and then close
 
sbi
1:16 PM
hmmm, mijn sha1 hash zit inderdaad in de linkedin database. Dus het is toch heel erg echt.
Anyone translate that? @sehe? @Radek
(I grasp most of it, but am not really sure.)
 
Ooh, he's totally encrypted. They'll never get his password!
 
@sbi Hmmm, my SHA-1 hash is indeed present in the LinkedIn database. This is really bad.
 
sbi
@RadekdaknokSlupik Thanks! (I had failed towards the end of the message.)
 
Anyone use a password manager that can sync with an android phone?
 
sbi
@Collin Yep. There's an Android app for KeePass.
 
1:20 PM
@sbi I was looking at KeePass, it syncs with Dropbox, right?
 
@RadekdaknokSlupik Checking mine now …
 
"This is really bad." Actually: "So it in fact very real after all"
(the 'echt' dropped to the second line but alters meaning quite a bit)
 
People in other rooms really flag for no reason.
 
sbi
@Collin I dunno. What does that even mean, "syncing with Dropbox"?
I'm not that desperate yet to put my password DB onto Dropbox.
 
@sehe I thought there was a comma before "echt".
 
1:22 PM
@Collin Keepass, yes though I just copy the database using rsync->ssh. Dropbox would work but I shun it
 
TIL: I need glasses!
 
@sbi Precisely
 
@RadekdaknokSlupik where did you check it?
 
@awoodland That was a translation of a tweet
Ask the twitterer
 
@sehe That may work too -- I do enough with my phone that I'd like to have it on there as well
 
1:24 PM
read -s pw; echo -n $pw | openssl sha1
^ should work, no?
 
@Collin I have it in case of emergency. I do keep my 'handy' passwords in Opera's 'wand' database which is actually quite a stronghold (incomparable to shitty FFox or IE password stores
 
sbi
@Collin I have a copy of mine on my phone. Once in a while I'll copy a new version over. What's that "sync with Dropbox" mean, though? Do new versions of KeePass somehow interact with Drpbox?
 
I meant it would just keep the password db on dropbox and read that from the phone
 
@sbi No, phones can synch with dropbox using the dropbox app. If you open the database in the synched location, it will effeectively use the synched version
 
sbi
@Collin Yeah, you can do that, of course. However, what do you do if you forget your Dropbox PW? :)
 
1:27 PM
@sbi Exactly.. maybe I can get an SSH client and create some keys on the phone.. sync to my server instead
@sehe Yeah, the reviews confused me into thinking there was something fancy about it built in
 
sbi
@sehe Ah, that. Seems neat. I am not really trusting Dropbox, though. Currently I have two files (nothing important, though) at Wuala, because they encrypt locally, and only send encrypted stuff into the cloud.
 
@KonradRudolph How secure is read. How secure is the shell. I say, to many moving parts and to little guarantees. From a glance at man bash read specifically uses stdin which is more easily compromised than a virtual terminal
@sbi Precisely. They have already had a major fuckup with anyone's docs being public for a window of time
 
@sehe Not the point. This is on a local machine. I just wanted to hash my password without having it in the history
 
@sbi I should make my whole dropbox a TrueCrypt volume
 
@KonradRudolph Prepend a space and use HISTCONTROL=ignorespace
@Collin That's begging for whole-volume corruption? Apart from that it might not even work because TrueCrypt needs to memory map the file (with extra controls (no swap, e.g.))
 
1:30 PM
oh, I didn’t know that, neat
 
sbi
@Collin I had actually experimented with that. There's an Android app that can open TrueCrypt volumes with certain settings. AFAICR, the whole thing was a major PITA, though. I'm not even sure I got it to work, but if I did, it was way too complicated to be used for "what's that PW again?" situations, so I dropped the idea.
 
@sehe That's an interesting point.. I should experiment with it
 
sbi
@sehe You could always copy the file from/to dropbox. It's complicated, though.
 
@sbi Yeah, I guess I don't often sign up for new sites, so just periodically copying the database to the phone wouldn't be so bad
 
@sbi Yeah. Painful - no way to merge your changes unless you copy files outside of the truecrypt, partially refuting the point
 
sbi
1:33 PM
@sehe No, you got that wrong. You can copy a file that's a TrueCrypt container.
 
@Collin My 'site' passwords don't even go there. They're expendable. The important passwords go there. They are strong.
@sbi Well dropbox two-way synchs individual files so the remark was relevant when comparing functionality
 
sbi
@sehe And an individual file could well be a TrueCrypt volume in a file, no?
 
@sehe My bank is actually horrible, just an account number, pin, and a security question for new computers
I need to make the security questions random strings
 
@Collin What, you mean like "Barbeque Yukitan fishing?"
 
@sbi That's circling the issue. If you have multiple files in the truecrypt container (frequently the whole point, or a keepass db would be just fine) then you can no longer synch individual items, which cripples the experience: back to the old 'exclusive checkout' model of CVS/Sourcesafe
 
1:37 PM
My bank asks for account number, pin, and part of a pre-shared key. I don't keep the first two anywhere physical, only on my mind. I keep the pre-shared key safe at home.
 
@Collin No two factor?
 
not my day today
 
as good a time as any to activate Google’s 2FA
 
I slept like 3 hours last night and then had a job interview :(
 
1:38 PM
@sehe Not for this one. I have 2FA on Google activated though
 
I figure it didn't go to your satisfaction
 
sbi
@sehe Yeah, of course, you can no longer sync individual files, only the whole container.
 
@KonradRudolph already on.
 
@Collin That's bad.
 
I spent way too long doing the "test" they wanted me to do
 
1:38 PM
@sbi The point I was making
 
@Neil make the answers to them random :-P
 
just cause I forgot that the int to char conversion is not implicit
 
@TonyTheLion You took a nap?
 
@Node I didn’t bother so far, my Google account password is incredibly secure, and actually one that I know by heart
 
as in, you should use atoi or whatever
 
sbi
1:39 PM
@RMartinhoFernandes My Bank sends me an SMS with a TAN every time. The PIN I have stored in my head.
 
@sehe yea I wish
 
@sehe At least there's a capcha when you type in your account number to make it harder to script the guesses, but still
 
@sbi Same here. I used to have 'one-time' TAN lists, but then I took an arrow to the knee I opted for more mobility - in case, e.g. the house burnt down :)
 
> Implicitly-typed local variables cannot have multiple declarators
What arbitrary silliness.
 
@sbi mine uses secret answer and a security token
 
1:40 PM
ah :) false alarm, my password isn’t in the LinkedIn dump
 
@EtiennedeMartel What does that even mean. Oh, auto i=3, y=3.14; isn't legal
@KonradRudolph Linky?
 
sbi
@KonradRudolph Mhmm. How do you even know? I thought theirs were salted hashs? Do you know the salt?
 
@sehe In the HN article I sent you earlier ;)
 
@sehe It's in C#.
 
@sbi Ah, true. Apparently some were in there unsalted. But you are right, mine might still be in there
 
1:41 PM
You can't do var l = ..., r = ...;
 
shit, with 2FA Google services on the phone don’t work any more :(
 
@KonradRudolph you gotta log into your online account and create keys for the stuff on your phone
 
@KonradRudolph Huh? mine do
Ah yeah, you create app-specific passwords for certain things
 
@EtiennedeMartel the same idea
@Collin You can, at least
 
Yeah. I still think they could at least wait until they've parsed the whole line before they hand out divine judgment.
 
1:44 PM
@Collin Hmm. I’ve got a Google phone, yet I need to sign in using the web interface now
before I didn’t need to do that
 
@KonradRudolph Can't find it.
 
@KonradRudolph I have an HTC phone, I had to set up an app specific password in the Accounts and Sync area for google
 
@Collin Ah, ok
true, that works better
 
Not sure if that's android or HTC software
 
1:47 PM
@KonradRudolph erm Thanks. not sure where I missed. Grepped for hackernews/hn :)
 
@sbi Oh, I forgot that. I have that too. It's account number, pin, PSK, and an SMS token. I don't really use my bank a lot.
 
damn, Google 2FA might have been a bad idea
 
@KonradRudolph I really like Google's 2FA
 
cant get the app specififc tokens working?
 
@awoodland Well. The application-specific passwords seem not to work with a lot of applications
and I don’t always want to enter some stupid verification code for trusted applications
@Node Exactly
 
1:55 PM
it all just worked for me. although i was only using it with a couple apps
 
I've not found anything that the per app passwords don't work with
and I've got it with quite a few things
the only tedious bit is remembering to revoke the right ones
 
@awoodland Same here, I have sync on my phone, calendar sync on Fedora, chrome sync on fedora and windows...
 
I even contemplated adding the pam module into my pam stack on a few machines as a trial
 
ok, that’s it, I’ll deactivate 2FA again
 

« first day (599 days earlier)      last day (4334 days later) »