Captain Foo posted:

Root of thread trust chain posting

Powercrazy posted:

What is the public PGP key of this thread so I know I'm getting an authenticated yospos security fuckup experience?

Subjunctive posted:

IDK how long it takes to clear whatever cache of things and stuff, but:

uncurable mlady
fishmech
Crusader
jre
Captain Foo
Storysmith
Westie
Mad Wack
Testiclops
BeOSPOS

should all be set.

spankmeister posted:

Umm there are 35 trillion 184 billion 372 million 88 thousand 832 /48 blocks in the currently allocated ipv6 address space

OSI bean dip posted:

Happy Badlock Day!

moonshine is...... posted:

So apparently this is a thing https://deaddrops.com/ a friend of mine told me her techie friend is really into it. So that's fun.

Parallel Paraplegic posted:

i have pictures of butts permanently tied to my google account, and when i get a new picture google displays it in a gallery and if I accidentally swipe left or right whoops now it's a butt

it's not my butt, at least

Volmarias posted:

Well, what are you going to do? Go with another registrar for .as?

I have a .as domain, this doesn't fill me with warm fuzzies, but my options are "bear it" and "pull the domain that a bunch of your stuff is inextricably tied to."

El Mero Mero posted:

I dissected the post I was making and found it was this that was combination of letters within my post that was triggering it:

OSI bean dip posted:

Symbolic Butt posted:

cjs: thinking about rolling my own crypto

ewiley posted:

oh boy where to begin

BangersInMyKnickers posted:

Lol, PHP announce list doesn't validate senders so this gem just came through to everybody


bless u Sajin

~Coxy posted:

and there was at least one ring-O cold boot vulnerability

Volmarias posted:

hackbunny posted:

lol you jerk

Phone posted:

i've coded gotos in tyool 2016

no amount of showers have made me feel clean about it

Captain Foo posted:

lol has evolved into lmao!

anthonypants posted:

i did a security fuckup last night, where i overwrote the root user's authorized_keys file on all the linux servers without looking to see if all of them had stuff in them, because i spot-checked a few servers and most didn't even have an .ssl folder. so i made a key for nessus and configured nessus to use it and went home

this morning our oracle contractors complained that the disaster recovery backups didn't work because their script or whatever used a key. so i made an even bigger security fuckup and put all our servers' public keys in every other server's authorized_keys file.

in my defense we have exactly two root passwords on ~20 linux servers and one of those passwords is the name of our company, in lowercase. next week on monday i get to meet with one of the linux contractors and discuss some of the changes i want to make, like doing patches to our servers and making user accounts and getting rid of accounts for people who don't work here anymore.

e: forgot to mention that while i was explaining to my boss what i did wrong (he is not a linux person) he thought that the private key went on the server. i tried to explain it to him like how his password isn't stored on the server but i'm not sure he got it.

thehustler posted:

any good pokemon secfuck writeups/blogs yet?

pr0zac posted:

gently caress ya i can finally talk about this
http://newsroom.fb.com/news/2016/07/messenger-starts-testing-end-to-end-encryption-with-secret-conversations/
https://fbnewsroomus.files.wordpress.com/2016/07/secret_conversations_whitepaper-1.pdf
was working on it a bit before I left fb, same crypto thats used by signal and whatsapp
was driving me nuts not being able to mention it during all of the "facebook hates privacy" arguments in the grey forums

pr0zac posted:

http://www.aboutads.info/choices/

quote:

unrelatedly, my mom just passed away so I've spent most of today trying to get her affairs in order, its kind of ridiculous how easy it is to take over all of someone's internet accounts with only a small amount of personal knowledge, especially once i got into her email and found a chain email questionnaire thing which was basically "answers to every common security question"
accessed her email, facebook, paypal, both bank accounts, and credit card starting with just her mother's maiden name and a call to her cellular company

Bhodi posted:

environment variables are bad but it's the best of a sometimes necessary solution; there are no good universal credential stores like there are on windows. All stock solutions are compromised the same way, if you have access to that user, you have access to that user's process memory and storage; you can read files and obscure poo poo via 0400 perms but at the end of the day it's all the same security context and since the code is being read and probably stored you can sniff any decryption keys/salts as-needed, the best you can do is obscure and isolate with unique passwords, at least env variables aren't passed into process lists

dehumanize yourself, etc

daft punk railroad posted:

passwords are like underwear: usually lovely

OSI bean dip posted:

https://twitter.com/taviso/status/758074702589853696

flosofl posted:

https://twitter.com/taviso/status/758143119409885185

Nice.

Blinkz0rz posted:

not to doxx myself but corp communications just emailed the company telling us to look for our logo in the new bourne movie and it gave me a hearty lol

Jimmy Carter posted:

oh sweet the talk about master-keyed systems is up

http://livestream.com/internetsociety/hopeconf/videos/131176042

the session is real entertaining but the tl;dr is that tons of manufacturers/entities are lazy so they go with the cheapest and most available lock sets so having 2 or 3 keys means you can open a surprising amount of poo poo

LeftistMuslimObama posted:

lomarf

Captain Foo posted:

snowden talkin on tweetz0r that the equation group hack is likely russians demonstrating CCNE in order to show that they can prove U.S. responsibility of any attacks sourcing from that server, which he speculates is now being made more public in order to halt escalation of attribution in the DNC hack

Perplx posted:

this privacy doesn't sound pretty good at all

Parallel Paraplegic posted:

I should really get back to reverse engineering that smart plug i have, maybe I can turn my toaster into a bomb

YeOldeButchere posted:

dadsec

VikingofRock posted:

So one of the science organizations that I work for has a bunch of non-public data in a database. To log into this database you use an automatically generated password which is literally your name + a string which is the same for everyone. This string is posted on our (private) wiki, but on the wiki one of the characters in the string is incorrect, which led to me not being able to log in. Upon being informed that the string was off by one character, I asked whether I should fix this on the wiki, and the answer was "no, because it helps security through obscurity".

apseudonym posted:

Some of us work on TLS stuff

atomicthumbs posted:

what if we forked SSL into another thread so that this one would only have interesting things in it

Acer Pilot posted:

Do you guys think that if I made my security question "make them spell out the random characters below," the csr might actually enforce it?

Phone posted:

some would say that he's living large