« first day    last day (1380 days later) » 

2:42 AM
cryptic ツ has made a change to the feeds posted into this room
posted on March 09, 2016 by Bruce Schneier

Yet another fraud discovered through data analysis. EDITED TO ADD (3/11): More....

posted on March 10, 2016 by Bruce Schneier

New credit card skimmers are hidden inside the card readers, making them impossible to spot. EDITED TO ADD (3/11): Brian Krebs on this from over a year ago....

posted on March 10, 2016 by Bruce Schneier

A Citizen Lab research study of Chinese attack and espionage tactics against Tibetan networks and users. This report describes the latest iteration in a long-running espionage campaign against the Tibetan community. We detail how the attackers continuously adapt their campaigns to their targets, shifting tactics from document-based malware to conventional phishing that draws on "inside" knowled

posted on March 11, 2016 by Bruce Schneier

Looks like tens of thousands of ISIS documents have been leaked. Where did they come from? We don't know: Documents listing the names of Islamic State fighters have been touted around the Middle East for months, dangled in front of media outlets for large sums of money. [...] Ramsay said he met the source of the documents in Turkey, an...

posted on March 11, 2016 by Bruce Schneier

Really great Tumblr feed. As usual, you can also use this squid post to talk about the security stories in the news that I haven't covered....

cryptic ツ has made a change to the feeds posted into this room
posted on January 01, 0001

Or: How I won the password hashing category for the Underhanded Crypto Contest at DEFCON 23.

posted on January 01, 0001

Salted Password Hashing with Argon2, Scrypt, Bcrypt, and PBKDF2

posted on January 01, 0001

A short meditation on the role of security engineering in software development

posted on January 01, 0001

How to authenticate a user on multiple domains without violating the Same Origin Policy.

posted on January 01, 0001

The answer to a very frequently asked question that most people in the industry know without needing to read this.

 
 
7 hours later…
9:22 AM
So hurtful you don't ask your sha1 question in here =o( @Wes lol
 
Wes
i know i'm an asshole. i just realized that too
i should've asked that here :B
 
You want to increase the length of the output string and the chars used for it.
You can sha1 the entire dictionary but it will always still have the same outcome of 40-char string a-f0-9 no matter how you do it. sha1 only has so many combinations no more no less.
Use sha256 or increase the entropy and use the full alphabet for example.
but, you can't change the chars for hashes though =o(
only increase length.
 
Wes
so what i'm actually doing is this. do you know how hash tables work?
 
Now if you are wanting to just generate a unique string to identify something and don't need to rely on the output of the file then you can make your own.
rainbow tables?
 
Wes
nope, hash tables
 
9:26 AM
you should ask the other room =oP
lol
 
Wes
lol
In computing, a hash table (hash map) is a data structure used to implement an associative array, a structure that can map keys to values. A hash table uses a hash function to compute an index into an array of buckets or slots, from which the desired value can be found. Ideally, the hash function will assign each key to a unique bucket, but it is possible that two keys will generate an identical hash causing both keys to point to the same bucket. Instead, most hash table designs assume that hash collisions—different keys that are assigned by the hash function to the same bucket—will occur and must...
basically each object has an hash code that is just an integer and collisions are resolved by comparing object's properties
basically you can always have the same hash code for everything, as objects would be compared for equality anyway by comparing for equality every single field they hold
 
Wes
that is a bit inconvenient as if misused can reduce performance by a lot
what i want to do is force users to generate an hash code that is almost guaranteed to be unique
and then simplify it to an int internally, for to implement the hash table
it is very unlikely that php can hold more than 1 million objects at the same time, so i was thinking that a 256 bits long hash code would be unique enough on that amount of objects
 
Where are your files coming from that you are hashing?
 
Wes
not actually using files
class A{
function __construct($v){$this->v = $v;}
function hash(){ return sha1(Foo::CLASS . "{" . $this->v . "}"); }
}
basically, i'm hashing the value representation of a class, for to use it for object comparison
(new A("A"))->hash() === (new A("B"))->hash()
anyway once i've finished it i will show you the actual code. hopefully soon
 
9:38 AM
and you want it to be unique with a determined length. Why not hash it then append a padded timestamp? That way if two hashes collide their appended timestamp should never match, but there is still an astronomical possibility a hash generated consecutively at same exact second colliding.
 
Wes
that's a great idea, and i could use a microtime
 
libraryofbabel.info is a great example of collisions. Everything we have said in this chat can be found in this library before it was even said.
^ that message too can be found just look it up
 
Wes
oh shit lol
that's awesome
 
All of our passwords and all passwords there ever will be can be found in it too >.<
Well not that version, but if you made it to use a larger charset it will
math is crazy
 
 
2 hours later…
11:38 AM
posted on March 13, 2016 by Bruce Schneier

This research shows the power of cell phone metadata. From an article by the author: Yemen has experienced an array of violent incidents and political turmoil in recent years, ranging from al Qaeda militant attacks to drone strikes, Arab Spring protests, and now Saudi Arabian air strikes. Call patterns can capture political or violent activities as they unravel in real...

 
 
5 hours later…
Wes
 
5:17 PM
> Let’s Encrypt currently limits certificate issuance to five certificates per week
I hit this limit when I was issuing certs for subdomains. I prefer not to share certs as it would create a single failure point in case a cert is compromised.
 
Wes
how do you compromise a cert?
 
@Wes if say the key was stolen
if I used the same cert for multiple domains (mutliple servers) it would compromise all of them
 
Wes
have a lot to learn :B
 
wildcards are nice if you have a ton of subdomains or want to use a catch-all redirection using HTTPS, but otherwise I create a separate cert for each, or once wildcards are allowed do a wildcard subdomain so *.subdomain.acme.com
using *.acme.com and using that same cert for each subdomain is like using the same password for all your accounts.
@Wes You know what HSTP and HPKP http headers are?
 
Wes
no idea
 
5:26 PM
nifty tool for detecting HTTP security headers: securityheaders.io/…
2
^ has info on each header
 
Wes
too many things to know
almost tempted to get a job somewhere else
like, a goat farm
 
I just want to quit and go grow weed.
 
Wes
ahaha
that's an option
nothing to see here
 
:29308630 that's why this chatroom is so important. It will teach you how to not get caught =oD
 
Wes
lol
still nothing to see here
 
5:37 PM
First 5 people to get their messages starred with useful content get admin status
just provide social security number and credit card info
 
Wes
lol
 
5:54 PM
room topic changed to Security / Privacy: General chatroom for information security offensive and defensive topics. Don't ask to ask, just ask! [crypto] [csp] [dnt] [hardening] [ids] [infosec] [owasp] [privacy] [secure-coding] [security] [sql-injection] [waf] [xss]
 

« first day    last day (1380 days later) »