« first day (4534 days earlier)      last day (414 days later) » 

2:22 AM
Hi, anyone here that works with PyTorch?
 
2:39 AM
who works*
 
 
3 hours later…
6:00 AM
Depends on what you mean by "work with" but I guess I work with pytorch...
 
 
1 hour later…
7:09 AM
Is there any reason to use PyCharm's http-client-testing feature? What can it achieve (or achieve better) than regular pytest/unittest?
 
7:46 AM
@Riya that looks like a tool for "testing" in the sense of "testing/debugging during development", so the point is that it's faster than writing a full unit test that you aren't even sure yet will be needed. but you're using a framework that has a swagger-ui, didn't you? imo that's strictly better for dev-testing than this pycharm tool.
 
8:12 AM
@Arne Indeed, I m using Swagger. It's useful for manual tests, but I was wondering if http-client can be used for automating the process.
 
maybe, i didn't give it more than a cursory glance.
 
 
2 hours later…
10:00 AM
@Riya I'd be wary of any development framework tied to an IDE. On principle.
Unless it's a prototyping kind of thing that you never reuse anyway
 
if not use pytest, how to make sure your change not effect to someting else?
 
10:31 AM
Really, you would want your code backed by pytest. An alternative that I use for my vehicle routing library is that every feature is backed by a standalone example for every constraint that the library contains. The solver itself runs in Java so the examples in the python library run and check themselves for consistency in the answers they get back to make sure I've not broken any constraints. But this is an odd setup with multiple libraries communicating about heuristics so...
 
@EthanSN do you mean "not use pytest" as "use some other testing library" or "don't test at all"?
 
11:27 AM
Just had a scary realization about phishing. I would 100% fall for a phishing scam that pretends to be some kind of newsletter or random message with a "Click here to unsubscribe" link. Some annoying websites require you to log in to unsubscribe, and I would totally do that
 
They would have to masquerade as a site you've already signed up to? Is this in the event of a data breach and they have your email?
 
@Aran-Fey that's ... probably very good to be aware of, thanks
 
Educated guessing would also work in a lot of cases, I think. Pretend to be facebook or youtube or whatever. Most people have an account there
 
This sounds like the QR scam I thought of when I got my bank stuff stolen. Create a custom QR scanner app that everyone upvotes, but then just target a few specific venues where your app will actually redirect to a splashscreen you would expect, and you put all your details in. Something like that happened to me when I was trying to pay for my hotel parking; I only realised I'd put my bank details into something else once I clicked submit... and they did actually try withdraw funds later
 
Oh wow, that's clever
 
11:37 AM
As long as you let 99% of your QR codes act normally, your app will get good reviews. But if you select just a specific few to redirect to your own site that looks like what you expected, people will just enter their details
At least, that's how I imagine it happened. The QR code was on the reception desk of a big hotel chain, so I thought nothing of it. Until I was apparently then subscribed to some weird media site
 
sounds a bit like this xkcd.com/792
the google bit has aged poorly
 
I've started using randomly generated passwords for most websites. If you really want to collect reused passwords, you need to make something that doesn't have an integrated password manager. Force the suckers to type their password manually
Like games. China probably got a lot of passwords through Genshin Impact
I don't understand why the internet, which is - for good reason - obsessed with security, still sends plain text passwords to servers. There should be some kind of protocol for HTML forms where the browser pre-hashes the password before sending it. Every website would use slightly different parameters (different hash function, different salt, different number of rounds, etc), and bam, password reuse would be a non-issue
 
11:54 AM
How would you have any interoperability between browsers or browser versions?
If the browser needs to move from SHA-256 to SHA-512 because the former is compromised... well that'll be a barrel of fun!
On top of it being "fun" it would be totally impractical because then every browser would have to contact the service provider directly to inform them to change their backend services to accept the new hash, without any way for them to understand the integrity in the process of doing that
Every service provider that they hashed for
 
True, you could never update the algorithm or settings. But still, it would be strictly better than the current situation, wouldn't it? The worst case scenario would be that the hash function is cracked and becomes reversible, in which case... you'd be exactly where we are now
 
Doesn't that problem exist anyway? If a provider wants to change their hash used for stored password hashes, they still need to verify the password using the old method first.
 
I don't think we would? If the hash function is cracked, it doesn't mean that everyone everywhere is suddenly compromised. Companies can respond using their own resources on their own timescale to fix up their backend security. But if it's the browser doing the hashing, they have to respond immediately because at least one of the sites they hashed for is compromised
 
I'm not saying servers should stop hashing, I'm saying the clients should also do hashing
 
So, for the browser to respond, they now invalidated the login for 99.999% of sites at the point at which there is news that their hash is cracked, even though those services wouldn't be immediately vulnerable
 
12:09 PM
What exactly do you mean by "their hash is cracked"? That the hash function itself was cracked, or that a specific stored hash somewhere was reversed?
 
That their hash algo is cracked. If SHA256 is cracked tonight, the browser would have to act tonight because they were hashing on behalf of a million different servers, and at least 1 is now vulnerable. But each individual server isn't suddenly blown wide open. The burden for transitioning should be on the million service providers, not a single browser to manage it to make sure all the sites they serve are still accessible
 
I'm not entirely sure how in transit "hashed password with cracked hash" is any more vulnerable than "hashed password with hash==identity" we have today.
 
I'm not saying that it's more vulnerable, I'm trying to convey the logistical challenge
Let's assume everyone uses Chrome and it pre-hashes to SHA256 before it gives any web page the hashed password
So the server, whatever of the millions of online services there are, only receive the hash
Then SHA256 is found to be breached in a reasonable time. Everyone would demand that Chrome now uses a different hash mechanism. But, all of the backend servers never handled the hash, so now every login in invalidated because the SHA512 hash doesn't match what they have stored. They have no way to do any change mgmt because the common browser flipped their settings overnight
 
Right. The browser cannot under any circumstances change the hash function
Well, at least not without telling the server that the user wants to change their password
 
@Aran-Fey But I'm imagining how that kind of process could possibly play out. The browser can't possibly make sure that everyone adopts this new method
 
12:22 PM
It can't, really. But does it have to? Security would still be strictly better than it is right now
 
Strictly seems like a strong assertion. You'd have to know how many bad actors there are, which are scraping passwords out of people vs. the huge consequence of a hash algo being broken and 90% of your services being totally unaccessible because the companies couldn't react in time to your new hash algo
 
Let's say X is the password that the user types into the password box and Y is the password that the browser sends to the server. Currently, X is the same as Y. In our thought experiment, a cracked has function would allow attackers to deduce X from Y. It's effectively the same situation
The worst case scenario in the thought experiment is the same as our reality, no?
 
I'm still not seeing the difference between the hypothetical scenario and what we have right now that would motivate an immediate revocation of a used hash method.
We do in principle already send hashed passwords, and the hash method used is identity. That one is known to be broken for ages.
 
Haha. Wonder how they cracked that one. Must've been a real brain-teaser
 
@MisterMiyagi because MiyagiCorp has relinquished the decision over the hash technology used. So the browser, as now the single point of failure, has to act at the first sniff of an issue, and you all have to dance to its tune immediately or your customers can't log in
 
12:26 PM
It's not the single point of failure though
17 mins ago, by Aran-Fey
I'm not saying servers should stop hashing, I'm saying the clients should also do hashing
 
But you've got broken hash on your server
because it is hashed with old algorithm
 
Nothing would change about server-side security. They'd still use salts and peppers and saffron (I made that up, it's a joke) and hashes
 
While now browser sends you one hashed with new algorithm
 
@roganjosh But we do have that issue already (passwords in transit are readable) and no one acts immediately.
 
Let's take a step back a bit. What problem are we trying to solve here? Is it Man In the Middle attacks or are we trying to stop people storing passwords in plaintext?
 
12:30 PM
the problem of being able to make malicious server that exploits people reusing passwords
 
Because MITM is already solved by encryption, and every site that stores plaintext would be foobar'd when the browser inevitably has to change its hash function
Which I guess is a good thing
 
foobar'd?
 
There's a no swearing policy in the chatroom. Use your imagination :P
 
@roganjosh Password reuse. Currently, if you sign up to 5 different services with the same password, 5 different servers know your password. With the proposed browser-side hashing, each of those 5 services would receive a different password
As long as they use different settings (hash function, salt, etc) of course
 
Well, that's exactly how to get vendor lock-in, surely?
 
12:32 PM
the problem it causes is that any change on browser's side invalidates all the server side passwords
because any such hash is meaningless with a different hashing algorithm
 
Aaand, I probably overstep my understanding here, but now the browser would have to know the salt etc. so it absolutely would be a single point of failure? It's no different to what happened to LastPass?
 
The browser wouldn't store anything here.
 
Where does it pull the salt from?
 
The site determines the algo and salt, as far as I understood it.
 
Now that I think about it, this could be implemented completely client-side. No need to build a new protocol into HTML or anything
 
12:35 PM
I guess the issue is about enforcing it, not implementing it.
Because client-side hashing is a thing already
 
Ok, I think I follow now. But it would still be just defending against man in the middle at this point? The servers already define their own salt and algo and iterations etc
If I'm reusing my passwords, I don't see how I'm defended by the browser by MM's interpretation of the solution. It's exactly the same behaviour
 
Ik
But it's not really a MITM attack
 
Ok, so it kills bad actors. Perhaps I didn't view this as a whole
 
12:41 PM
Strictly speaking this only protects users from themselves. If you already use a unique password for every service, you get absolutely no benefits
 
Actually, I've been slow on the uptake. I understand now the application that Aran's describing. I still think all my logistical arguments stand, but I do see why this would be useful. I still think it's a utopian view of how it could be implemented practically
 
12:57 PM
I'm unsure about how practical it is, tbh. There are basically 2 ways you can go about it:
1. Do it completely client-side. The browser simply picks a random hash function/settings for each service. Problem 1: Correctly identifying the service. If a `<form>` sends the password to `server1.google.com`, is that equivalent to `server2.google.com`? Stuff like that. Problem 2: Changing the hash function is impossible or at least a logistical nightmare, since the browser would have to notify the server about the new password.
 
I think there is an upside in the suggestion but it does come crashing down when I run my own cost-benefit analysis. You only have to look at the prevalence of things like SQL Injection to realise that service providers don't play by basic rules :/
 
That's how I got this idea. "I don't trust servers, why on earth am I ok with sending them my plain text password?". Took me a while to realize that I could just use unique passwords and achieve the same thing
 
1:13 PM
I wonder whether you could get something even using something broken like MD5 and using the IP address as a salt. Then the backend service would have a repeatable way to handle change management if it had to change the IP address of its services, but you wouldn't be planting the same password hash in multiple databases
It'd be a hash of a broken hash, but it would never be plaintext outside of the browser
You'd still need something like a DNS I guess that tracked all the IP changes. Rabbit holes all the way down :/
 
Wouldn't you have to crack the hash each time ip changes?
 
That's the point. Hashes aren't meant to be cracked, so it would make such things harder, but perhaps introduce some form of repeatability to the service provider that is at the mercy of the hash algo
The server would be able to keep track of their own IP changes, so they have an exclusive list of various salts that have been used specific to them and it doesn't really matter that you'd used a broken hash mechanism like MD5 because they should, in theory, be using their own hash on top of it. So you could track their salts with something like a DNS
 
Using the IP for anything non-transient is usually a bad idea. At the very least, load balancing complicates this immensely.
 
At the conclusion of this, I think I'll just use ROT14. Nobody would suspect ROT14. It's too close to being in plain sight
 
a powerful password manager sounds like the most stable solution. did you say that you use that already, Aran?
 
1:26 PM
Does firefox count?
 
if you cross out "powerful", sure
 
I've only read the start of this conversation. But we don't exactly send passwords in plain text, they're protected by TLS en.wikipedia.org/wiki/Transport_Layer_Security
 
We've gone way beyond TLS
 
Perhaps we should be hashing TLS...
 
OK, I'll catch up.
 
1:31 PM
The TL;DR is that we don't trust the server. We don't want to send the same password to 5 different servers, because if even one of them leaks it, 5 of our accounts are compromised. So the idea was to hash the password before sending it to the server
 
Well, to be honest, I think we've just been reinventing browser based password managers. In a bad way.
 
Although MD5 & SHA-1 are now considered to be broken, they aren't totally useless. They should be avoided in new code because there are now much better alternatives. But if you use MD5 or SHA-1 in a proper HMAC, they're still relatively safe.
 
@MisterMiyagi Miyagium will never take off with that attitude
 
puts on Indiana Jones voice Well, actually I'm selling these fine JWTs...
 
It's all about NFTs
BLOCKCHAIN. My god, why did we forget about this? Blockchain will fix our browser security problems, I just know it!
 
1:37 PM
I've posted this password stategy here before, but I guess it doesn't hurt to repost it. ;) xanthir.com/b4g30 I can't remember exactly what it does,but I think it does a HMAC using SHA-1, client-side, in JavaScript.
 
@MisterMiyagi That's definitely the smart solution. But a potential advantage of my idea was that it could protect users from themselves, without them having to do anything special. Sally from accounting doesn't know she's not supposed to reuse passwords, so it would've been neat if her browser could "randomize" her passwords for her
 
> why did we forget about this
the hype-train moved on. you won't turn any heads nowadays unless your blockchain is powered by GPT
 
I desperately want to give a ChatGPT answer to you here but I've never been able to get through to using it, and I detest it enough to not get stuck in a queue
 
@Aran-Fey Honestly, it might be easier to have a plugin that straight out intercepts all password prompts. No "would you like to use a generated password?" but straight up "Thanks Salvator, we've set a password for you already. Now shoo."
 
the risky ones are malicious actors who won't play nice and label their password field as one
then again, once you have randomized passwords everywhere else, your value as a victim drops sharply. so maybe it doesn't matter any more if there are malicious actors out there
 
1:49 PM
@MisterMiyagi That's actually a really interesting idea. Don't even show the user any password inputs. Your browser takes care of everything. Make people forget that passwords even exist
 
1 hour ago, by roganjosh
Well, that's exactly how to get vendor lock-in, surely?
Good luck when Internet Explorer holds all your keys
 
I don't see the problem, to be honest? Firefox already holds all my keys
 
I guess that leaves vulnerability for local access by unauthorized people
 
And if they fold tomorrow?
 
Passwords -> Export
 
1:54 PM
Fair. I don't have a comeback for that
 
:D
tbh, I could see firefox introducing pw-skip tomorrow.
 
There would probably be some companies (like Microsoft) that would make it difficult to extract the passwords (probably under some pretense of security), but I guarantee that someone somewhere will figure out how to extract them anyway
 
wanna write an RFC that defines the "browser auto-password integration" standard? and hound microsoft until they adopt it?
 
I'd rather hound Mozilla :D
 
embracing the lock-in, i see
same as me
 
2:09 PM
Wait, you guys actually store credentials in your browser?
Isn't there, like, a system key store?
 
I don't think I'd want my passwords in a system keyring tbh. I know where my browser stores them, so it's easy to back up. But I have no clue how I'd make a backup of the system keyring
But I should probably set a master password in my browser at least
 
Ok, I've caught up. And had a brief look at the JavaScript source of the Xanthir password generator I linked above. Yes, it does do a SHA-1 HMAC.
Aran's proposal is essentially getting the browser to automatically do something very similar to the Xanthir scheme.
 
True, yeah
 
SHA-1 is "only" 160 bits, so it's faster to brute-force than SHA-256, but it still takes a long time to create a "birthday attack" collision with 160 bits. Even MD5, with a length of 128 bits is still considered safe in a HMAC.
The suggested way of using Xanthir's scheme is to use the site URL as the "site tag". You can easily add a salt to the site tag, but you'd have to remember it, or record it somewhere.
I'm not totally happy with the way he injects special characters into the password. But it's hard to come up with a secure method that always gives an acceptable number of special chars.
 
2:36 PM
u looks like I should read the transcript of the last discussion
@Arne what happened in March 1997?
@Arne also what evil is google doing? I mean I understand your perception, but I can't really pinpoint it, besides that they changes their motto :D
@MisterMiyagi xD Wow I was thinking this all along, happy you summarized it nicely :D
Ok, this read was worth it. I also use FF for all my online identities and I really hope google keeps them in business
@Arne This is just the natural endpoint of the current browser password manager approach, in the end you will simply be shown a list of accounts for a login prompt and you can just select one, similar to gmails login prompts on a device that has the logins saved, but just for every website out there, neat idea
 
 
3 hours later…
5:46 PM
hi all need help , ord 200 - after ency-> -56 ---then> 121 , i can get -56 by 200-256, now from this -56, need to see if i can get 121
 
Are you reverse engineering an encryption algorithm?
 
just implementing this AES/CBC/PKCS5Padding on payload, but encrypted string is different in orihgnal java code to python one, so now going on ord level
 
I think it would be more productive to show us the python and java code
 
6:08 PM
@Aran-Fey here is link to the code include python and java : ideone.com/qtekVs
output from aes encrypt is different from java one, few bytes are missing, maybe padding/unpadding, which i am unable to figure out
note : passkey should be SHA-256 hash of key and we key first 32 bit
 
6:27 PM
It's not loading for some reason
 
here is new link : ideone.com/kQ3Z5d, till generating the key is done right in python just encrypting paylaod is giving differnet
 
Does your key contain non-ascii characters? You're padding to a length of len(self.__key), but that's a string, and its length can change when encoded to bytes
 
@Aran-Fey all ascii only
 
Ok. That's still a bug though
 
@Aran-Fey okay, exisiting python buy or code bug? how to overcome this ?
 
6:42 PM
Well, I guess it's not necessarily a bug. I see you're hexlifying the password before passing it into the class. But if the class ever gets a non-ascii key, something will explode
I would strongly recommend writing your class to work with bytes. Once you have bytes working, you can add some convenience methods (or another class) that work with strings
 
okay, and one more thing regarding this pading (i am not into java though), so according to this code cass i should add padding to left with default value of '0' or it's byte right ?
 
The pycryptodome documentation is making me lose my mind, but I'm starting to suspect that you're not supposed to call encrypt() multiple times
If anyone can find the docs for that method, please let me know
Not like it's an important method or anything. Doesn't need to be easy to find
@sahasrara62 There's definitely something wrong with your PKCS5 padding. It should pad to a multiple of 8 bytes, but the number 8 doesn't appear anywhere in the code
You're padding to the length of the key, which is different from 8
 
7:26 PM
@Hakaishin the 1997 is just a joke, I think. it does sounds funny to me anyway. evil things google does: lots, but very on-topic is how they try to leverage their browser monopoly through chromium to force other browsers like firefox out of business. and tax evasion, i hate how it's such a common practice, in particular by those who could afford to just pay them.
 
@Aran-Fey no payload should be encrypted, i just need to encrypt the key once, and then encrypt payload and sent it as jws ,
@Aran-Fey will take a look into this, and will hardcode the block size, yeah, encryption should be once, my bad there
 
7:58 PM
Does anyone know if there's an API to retrieve the top most used tags on a stackexchange site?
 

« first day (4534 days earlier)      last day (414 days later) »