Register a SA Forums Account here!
JOINING THE SA FORUMS WILL REMOVE THIS BIG AD, THE ANNOYING UNDERLINED ADS, AND STUPID INTERSTITIAL ADS!!!

You can: log in, read the tech support FAQ, or request your lost password. This dumb message (and those ads) will appear on every screen until you register! Get rid of this crap by registering your own SA Forums Account and joining roughly 150,000 Goons, for the one-time price of $9.95! We charge money because it costs us money per month for bills, and since we don't believe in showing ads to our users, we try to make the money back through forum registrations.
 
  • Locked thread
Winkle-Daddy
Mar 10, 2007
Op torpedo was a hilarious code name

Adbot
ADBOT LOVES YOU

Tayter Swift
Nov 18, 2002

Pillbug

more like kuru

Triglav
Jun 2, 2007

IT IS HARAAM TO SEND SMILEY FACES THROUGH THE INTERNET
yeah torpedo owned and was confusable enough. now that they stacking them up tho...

anthonypants
May 6, 2007

by Nyc_Tattoo
Dinosaur Gum

Rufus Ping posted:

It was operation pacifier (against playpen) fwiw
why can't they all be named operation torpedo

Sagebrush
Feb 26, 2012

Triglav posted:

imo beats the point of codenames if they have common correlated theme

in WW2, the germans had a radar system code-named "wotan" (Odin), after the one-eyed norse god. the british correctly concluded from this codename that it was a single-beam radar system (most of the other radar prototypes at the time required two separate beams) and were able to infer a tremendous amount of information about its functionality just from that fact. after that particular coup the british decided to start using randomly selected codenames like "blue silk" and "orange herald"

Winkle-Daddy posted:

Op torpedo was a hilarious code name

agreed, tho

ohgodwhat
Aug 6, 2005

Kind of like the NRO patches that gave away how some random space based sigint satellites worked and their orbits.

Shame Boy
Mar 2, 2010


quote:

We have also had help from a certain un-named ‘elite’ hacker who was able to hack in to our first prototype.

of course you did sweetie, now tell timmy it's time for him to go home you can play hacker again tomorrow okay

Raere
Dec 13, 2007

Raspberry Pi more like Raspberry Spi

pseudorandom name
May 6, 2007

Triglav posted:

imo beats the point of codenames if they have common correlated theme

I'd prefer Operation DICKPUNCH and SACKSTAB and NUTNOOSE

Deep Dish Fuckfest
Sep 6, 2006

Advanced
Computer Touching


Toilet Rascal
i was gonna make a joke about "operation drop kick" being a thing in dr. strangelove, but it turns out that it was apparently an actual operation where the us army chemical corps released a shitload of mosquitoes in an area to see if they would bite people. turns out that yes, they did

fishmech
Jul 16, 2006

by VideoGames
Salad Prong

ohgodwhat posted:

Kind of like the NRO patches that gave away how some random space based sigint satellites worked and their orbits.

or were the ones given away actually an obsolete set of satellites placed as decoys to cover up the true satellites the patch was referring to?

Lain Iwakura
Aug 5, 2004

The body exists only to verify one's own existence.

Taco Defender
https://securitysnakeoil.org
https://twitter.com/secsnakeoil

got tired of the bs and am going to work with a few others on this problem

BattleMaster
Aug 14, 2000

OSI bean dip posted:

https://securitysnakeoil.org
https://twitter.com/secsnakeoil

got tired of the bs and am going to work with a few others on this problem

good

surebet
Jan 10, 2013

avatar
specialist


Hed posted:

what class was this?

like... all of them, pretty much. The main issue was that we were a satellite campus and we had to provide our own laptops; on the main campus they had standardised and sterilised computer labs where we could've done the exams.

the really dumb part was that f1 was left available so you still had essentially a cheat sheet available, but they bricked vba which was super useful in a couple classes

we were running on this and it was overall a huge piece of poo poo:
http://www.softwaresecure.com/product/securexam-student/

Midjack
Dec 24, 2007



Triglav posted:

imo beats the point of codenames if they have common correlated theme

a lot of code names you read about for law enforcement and military operations are hand selected for media consumption. while the plans are still being worked on they often have nice randomly generated names like SWOLE FARTBUS and CLIPPER PIPELINE. you get the punchy names like ENDURING FREEDOM after all the alternatives have been considered and one is selected, then DUMPSTER FIRE becomes DESERT STORM

surebet
Jan 10, 2013

avatar
specialist


i don't care what swole fartbus is but i'm voting in favor of it

elite_garbage_man
Apr 3, 2010
I THINK THAT "PRIMA DONNA" IS "PRE-MADONNA". I MAY BE ILLITERATE.
I like how most of these lovely kick starters have a team full of idea guys/gals and only 1 coder. They could at least lie and have 1 person be the dedicated security expert. Sheesh.

e: if any of you are thinking of making a security device kickstarter, please hire me as the token sole coder. I took 1 class on crypto so I'm an expert now.

elite_garbage_man fucked around with this message at 04:12 on Jun 2, 2016

BattleMaster
Aug 14, 2000

elite_garbage_man posted:

I like how most of these lovely kick starters have a team full of idea guys/gals and only 1 coder. They could at least lie and have 1 person be the dedicated security expert. Sheesh.

e: if any of you are thinking of making a security device kickstarter, please hire me as the token sole coder. I took 1 class on crypto so I'm an expert now.

better than game kickstarters which are usually x artists, y idea guys, and 0 programmers

Sagebrush
Feb 26, 2012

BattleMaster posted:

better than game kickstarters which are usually x artists, y idea guys, and 0 programmers

"artists" who have never worked in game art asset creation and whose portfolio is entirely composed of recolored mario sprites and anime drawings on notebook paper

BattleMaster
Aug 14, 2000

Sagebrush posted:

"artists" who have never worked in game art asset creation and whose portfolio is entirely composed of recolored mario sprites and anime drawings on notebook paper

I've seen some projects with decent artists that just forget to budget for a programmer or expect one to work for free

doesn't matter because the game will amount to exactly as much

Suspicious Dish
Sep 24, 2011

2020 is the year of linux on the desktop, bro
Fun Shoe
and then you read poo poo like http://www.businessinsider.com/a-16-year-old-built-a-video-game-company-2016-5

"The recruiting ads said he was starting a new video game company and that people would be paid via revenue sharing."

Shame Boy
Mar 2, 2010

OSI bean dip posted:

https://securitysnakeoil.org
https://twitter.com/secsnakeoil

got tired of the bs and am going to work with a few others on this problem

make a kickstarter to fund your anti-kickstarters project




i am not kidding i legitimately want to see how kickstarter would react

Kuvo
Oct 27, 2008

Blame it on the misfortune of your bark!
Fun Shoe

OSI bean dip posted:

https://securitysnakeoil.org
https://twitter.com/secsnakeoil

got tired of the bs and am going to work with a few others on this problem

looking forward to the laffs

Lain Iwakura
Aug 5, 2004

The body exists only to verify one's own existence.

Taco Defender
here's the first official post:
https://securitysnakeoil.org/2016/06/02/kiri-is-nonsense-and-likely-stolen-code/

Parallel Paraplegic posted:

make a kickstarter to fund your anti-kickstarters project




i am not kidding i legitimately want to see how kickstarter would react

oh man i should do this

Tayter Swift
Nov 18, 2002

Pillbug
congrats on your foray into infosec anklebiter relevancy

Wheany
Mar 17, 2006

Spinyahahahahahahahahahahahaha!

Doctor Rope

A Man With A Plan posted:

thumb drives via carrier pigeons, man.

micro sd cards, man

Dex
May 26, 2006

Quintuple x!!!

Would not escrow again.

VERY MISLEADING!

spankmeister posted:

Lorenz was a cipher that was totally different from Enigma. Enigma worked on the regular alphabet, but Lorenz worked directly on 5-bit teletype signals. So it was a machine that you fed your plaintext into and out the other end came 5 bit baudot code that could go straight into the radio transmitter.

The way Lorenz worked was that it had a pseudo random number generator, implemented as 12 rotors, each had between 61 and 23 cams that could be set. So you can imagine the astronomical number of different ways these rotors could be set up.
The PRNG generated a keystream, which was XOR'ed with the plaintext. If the settings of the rotors and cams was exactly the same on both ends, the keystream was the same and xoring the ciphertext with the keystream would produce the plaintext again.

German operators would often get lazy and not change the rotors according to protocol, so they often reused their keys. Oftentimes they resent a message with the same key, but with slight differences in the message, like typos or abbreviations that were not present in the first message. This is called a depth.

When this happens, it can be decrypted as follows:
https://www.youtube.com/watch?v=yxx3Bkmv3ck

Now, once the message was zig-zag decrypted like that, the keystream was also known. This could be used to infer the operation of the PRNG. Most depths were short messages but the allies were lucky enough to get the depth that loving africa chaps was talking about. iirc it was 4000 characters, and when it needed to be resent, the operator had to type all of that in again, and when he did he got angry and lazy and made mistakes and abbreviated words. The crucial mistake they made was that they reset the machine back to the same settings as before, which was a huge no-no.

The allies decrypted the messages and because this depth was so long, the allies now had lots of key material.

now comes the brilliant part

The codebreakers, led by Bill Tutte, were able to completely reverse-engineer the operation of the PRNG, and even drew a diagram on how the rotors worked and were connected:


They never saw the machine until near the end of the war.

amazing, thanks

bicycle
Oct 23, 2013
KeePass 2 Update Check, vulnerable to a MitM

https://bogner.sh/2016/03/mitm-attack-against-keepass-2s-update-check/

quote:

8.2.2016 @ 15:45: Received response from Dominik Reichl: The vulnerability will not be fixed. The indirect costs of switching to HTTPS (like lost advertisement revenue) make it a inviable solution.

Thinking of ditching keepass just because of that quote alone tbh

spankmeister
Jun 15, 2008






bicycle posted:

KeePass 2 Update Check, vulnerable to a MitM

https://bogner.sh/2016/03/mitm-attack-against-keepass-2s-update-check/


Thinking of ditching keepass just because of that quote alone tbh

Wow what a moron.

DrPossum
May 15, 2004

i am not a surgeon
https://history.google.com/history/audio

here's the audio recordings of you that google lets you know it has

mine has a statement from me about when i discovered nicki minaj has her own line of moscato

spankmeister
Jun 15, 2008






DrPossum posted:

https://history.google.com/history/audio

here's the audio recordings of you that google lets you know it has

mine has a statement from me about when i discovered nicki minaj has her own line of moscato

mines empty

Su-Su-Sudoko
Oct 25, 2007

what stands in the way becomes the way

bicycle posted:

KeePass 2 Update Check, vulnerable to a MitM

https://bogner.sh/2016/03/mitm-attack-against-keepass-2s-update-check/


Thinking of ditching keepass just because of that quote alone tbh

hahah wow

BattleMaster
Aug 14, 2000

Mine's empty but the location history is frighteningly accurate and pretty fascinating

bobfather
Sep 20, 2001

I will analyze your nervous system for beer money
Just laff if you didn't disable all that poo poo years ago.

Too bad turning it off basically turns your Android phone into a Nokia from the mid 2000s though.

Wheany
Mar 17, 2006

Spinyahahahahahahahahahahahaha!

Doctor Rope

bicycle posted:

KeePass 2 Update Check, vulnerable to a MitM

https://bogner.sh/2016/03/mitm-attack-against-keepass-2s-update-check/


Thinking of ditching keepass just because of that quote alone tbh

has he considered the indirect costs (like lost advertisement revenue) of issuing a statement like "The indirect costs of switching to HTTPS (like lost advertisement revenue) make it a inviable solution."

Wheany
Mar 17, 2006

Spinyahahahahahahahahahahahaha!

Doctor Rope
because a twitter shitstorm seems to have started already

flakeloaf
Feb 26, 2003

Still better than android clock

BattleMaster posted:

Mine's empty but the location history is frighteningly accurate and pretty fascinating

the information is probably being collected anyway by cell towers and whatever, i'd might as well see some benefit from it

such are the burdens of carrying a transmitter that broadcasts a unique number everywhere i go

Captain Foo
May 11, 2004

we vibin'
we slidin'
we breathin'
we dyin'

Spankmeister thank u

also those guys (cryptanalysts) are loving wizards

Volmarias
Dec 31, 2002

EMAIL... THE INTERNET... SEARCH ENGINES...

DrPossum posted:

https://history.google.com/history/audio

here's the audio recordings of you that google lets you know it has

mine has a statement from me about when i discovered nicki minaj has her own line of moscato

Huh, mine is just a series of farts of incrementing intensity, duration, and pitch.

Weird.

Adbot
ADBOT LOVES YOU

Shame Boy
Mar 2, 2010

Captain Foo posted:

Spankmeister thank u

also those guys (cryptanalysts) are loving wizards

Turing was way into disney movies so he'd probably like being called a wizard :3:

i mean it's better than being called a commie fag by the country you helped save at least

  • Locked thread