Magnetic North posted:

Since you were talking password managers, and I asked in the android thread with no luck, I figured I'd ask here.

I use Password Safe. I started keeping my safe on my Android phone because I needed to access my passwords on multiple computers. I used to be able to just hook it up, use USB Mass Storage to access the phone like a drive, and open my safe. That doesn't work the same way with my new phone, since it uses MTP; Password Safe doesn't want to access it from the phone, possibly because it's a device and not a drive, so there is no path? I'm not honestly sure. I could copy it each time I wanted to use it, but the idea is to consolidate the location so I don't accidentally overwrite some new entry by mistake.

Is there a way to restore or replicate my old functionality with Password Safe? While I would like to avoid migrating, I will if I have to, and would appreciate any suggestions for what to migrate to. (I see mention of KeePass as an open source option, which I will look into.)

Magnetic North posted:

I guess I will mess with Drive to see if Password Safe will play nice with it.


I believe Password Safe encrypts by default? I mean, I don't see an option that says "encrypt vault" but Wikipedia says it encrypts.


I'm sorry, but I don't fully understand what this means.

PBS posted:

If you log into a website with a user id and an rsa token (generated on a laptop / mobile, using a pin), would the login to the website be considered 2fa?

It seems to meet the requirements. (something you have, something you know)

PBS posted:

So if your PIN is 123456, you input this into the SecureID token client and it will spit out something like 01923227.

Go back to the webpage, enter userid in userid field, enter 01923227 in the passcode field, hit login.

Dex posted:

his application isn't involved in this part of the chain, it's all rsa securid and their client software. i'd suggest reading their docs if you're curious about the how and why of it

deep impact on vhs posted:

can confirm that it's awful, we have one in place where i work now.

i hate it.

Rufus Ping posted:

That's cloudflare you idiot

OSI bean dip posted:

Not-quite-a-SIEM-but-almost-good-enough but Splunk has a cloud solution.

Powered Descent posted:

I don't know about easily, though of course only the spooks know for sure.

A method they've used in the past is that if you go to a site they control (be it a regular website or illegalsitethefedstotallydidnttakecontrolof.onion), and if you're using an older version of torbrowser, they can use an exploit in that browser to make it connect to somewhere in the clear (instead of via tor), thus revealing your actual IP. So of course it seems to me that the way to protect yourself from that (apart from being sure you have the latest version of everything) would be to have a physically separate tor router. Then the computer running your actual browser could be owned to hell and back and it wouldn't matter, the ONLY connection it has to the outside world is through tor and it has no way of even determining its own actual public IP. (Building a raspberry pi into an anonymizing middlebox is an easy and educational little project. Try it yourself.)

Cugel the Clever posted:

No--I entered my password on account creation and then it emailed it back to the address I provided. Isn't that particularly awful security policy?

Subjunctive posted:

It's much easier to get hostile content into a browser than into an app, and typically that hostile content operates in a more flexible environment (scripting, wide access to system APIs). Faked email, Twitter "viruses", compromised ad networks, takeover of non-https sites on public wifi, site hacking. Even if an app exposes a URL scheme, it tends to be quite narrow.

I think WebBT is fine and necessary, but it's definitely a different security landscape from BT-privileged apps.

stevewm posted:

Not big enough to need QSA, self reporting.

Strangely no one I have talked to has been particularly helpful on this. Even our own processor, they just refer me to the PCI website and won't answer any questions.

fyallm posted:

I want to learn how.

And I love Derby, I go every year, been to the past 4 I believe? I am about 2+ hours away, but I have a client that I usually try and go visit every few months there.

And management is paying for the bootcamp, exam and going to give me a raise.. I have put it off for as long as I possibly could :/

Mustache Ride posted:

Mostly consulting groups it seems. What a waste of time the past 2 interviews have been.

gallop w/a boner posted:

.

I've read various bits about PowerShell Empire and the different staging methods, such as DLL injection, but they all seem to rely on powershell.exe or at least some sort of executable running at some point.

Can someone help me understand this? My background is in general IT ops, so apologies if I have misunderstood anything.

Potato Salad posted:

h- wh- how

okay freggin how

B-Nasty posted:

Don't roll your own. Microsoft Identity has a hasher built in: Microsoft.AspNet.Identity.Core/PasswordHasher.cs. It uses PBKDF2 (1000 iterations) to generate a 128 bit salt and 256 bit key. It automatically adds a version number, appends those items together, and returns a nice Base64 string that you can store in the DB. It also has a VerifyHashedPassword method that does a constant-time comparison and (smartly) returns an enumeration of whether it passed or not.

The 1000 iterations is a bit low, but it shouldn't matter much for stronger passwords. The versioning they built in allows for MS to add additional algorithms and easily upgrade, though they haven't done it yet.

edit: They actually have updated it. Version 3 will use: PBKDF2 with HMAC-SHA256, 128-bit salt, 256-bit subkey, 10000 iterations.

Hollow Talk posted:

Eh, not really. It just means I can use the same function for checking hashed emails and hashed passwords, i.e. the difference between these two, which I suppose becomes moot if I don't bother to hash emails.

code:

;; User, input+salt
(struct scrypt-hash (user input salt) #:prefab)

;; User, email+salt, password+salt
(struct scrypt-full (user email password salt datetime) #:prefab)

;; Calculate scrypt hash+salt for input
(define (scrypt-input->hash input #:length [length 32] #:N [N 16] #:r [r 8] #:p [p 1])
  (let ([salt (crypto-random-bytes length)])
    (scrypt-hash null
		 (bytes->hex-string (scrypt input salt N r p length))
		 (bytes->hex-string salt))))

;; Check whether scrypt'ed input matches provided scrypt hash+salt
(define (scrypt-check-hash hash input #:length [length 32] #:N [N 16] #:r [r 8] #:p [p 1])
  (equal? (scrypt-hash-input hash)
	  (bytes->hex-string (scrypt input (hex-string->bytes (scrypt-hash-salt hash)) N r p length))))

I suppose that was the idea. But it seems it's unnecessary, so I will probably switch this to username (plain) + email (plain) + password (hash) + salt + datetime.

edit: And done, switched to plaintext emails now. The two different structs remain (though the two tables have been consolidated into one), since those scrypt functions are also used for instances where people enter passwords for something else without having to supply an email address at all. Thanks for the comments!

flosofl posted:

https://arstechnica.com/security/2017/04/rash-of-in-the-wild-attacks-permanently-destroys-poorly-secured-iot-devices/

lol

Double Punctuation posted:

I loving love Cloud To Butt right now.

flosofl posted:

wolrah posted:

One of my friends has this smoker: https://www.charbroil.com/smartchef-digital-electric-smoker

For some idiotic reason the app is required to set the temperature. When he brought it down to my house a few weeks back during a LAN party the fact that my WiFi SSID has a space in it was the root cause behind a full hour of frustration when trying to get dinner going. This was with four people who all work in various IT fields prodding it and using monitor mode on Linux to watch the actual WiFi traffic. A normal person wouldn't have had a chance at figuring this out.

Doug posted:

This isn't true. The ?s mask in hashcat which covers all special characters also includes the space. So if a mask uses ?s or ?a it's going to catch your space.

pr0zac posted:

Lol. You don't know what you're talking about. Smart lock is unequivocally a good idea and most likely more secure than a password manager.

apseudonym posted:

That's not an accurate description of the bug. The bug was they were comparing only up to the attack supplied length.

The truth is funnier.

Mr Chips posted:

it's not quite like that, if you try manually logging into the admin account via the web interface with no password you won't get anywhere. You actually need to fiddle with the HTTP a bit, there's a synopsis from the guy who found it here: https://www.embedi.com/files/white-papers/Silent-Bob-is-Silent.pdf

Volmarias posted:

"We need to get this thing out yesterday and they're not paying us to do anything after it's feature complete" mostly

flosofl posted:

It wasn't a whim to register. SOP when trying to "disarm" and analyze an outbreak is to try to sinkhole the C&C, which is what MalwareTech assumed this was. You do that so you can start to a) capture any active traffic for analysis and b) disrupt the C&C functions. The fact it was unregistered just made it easier to sinkhole, and you want to jump on it quickly in case it was an oversight and the attacker could correct it at any moment.

The fact that the domain itself was the killswitch was happenstance, which MalwareTech points out in his twitter feed.

Last Chance posted:

I don't know much about nothin' here, but wtf is this when I visit that URL:

flosofl posted:

I'll bet you say ATM machine and PIN number.


You monster.

Doug posted:

No reason to be an rear end in a top hat, he was making a joke that you said 'CRL list' Certificate Revocation List List...hence the statement about ATM (automatic teller machine) machine and PIN (personal identification number) number.

milk milk lemonade posted:

I don't remember it being all that serious. I lost my CAC card at a dog park and they just gave me a new one. I had access to some relatively interesting stuff

Edit: the card had a picture for visual identification obviously, but the PKI is only 1/2 or less of the equation in terms of accessing any part of any information systems

Thermopyle posted:

You can just install one of the apps from the Chrome store that unzip 7zip files.