Advertisement
If you have a new account but are having problems posting or verifying your account, please email us on hello@boards.ie for help. Thanks :)
Hello all! Please ensure that you are posting a new thread or question in the appropriate forum. The Feedback forum is overwhelmed with questions that are having to be moved elsewhere. If you need help to verify your account contact hello@boards.ie
Hi all,
Vanilla are planning an update to the site on April 24th (next Wednesday). It is a major PHP8 update which is expected to boost performance across the site. The site will be down from 7pm and it is expected to take about an hour to complete. We appreciate your patience during the update.
Thanks all.

Stuff that doesn't need it's own Thread

2

Comments

  • #32
    Recondite49
    Closed Accounts Posts: 1,004 ✭✭✭Recondite49


    AnCatDubh wrote: »
    Nice one.

    Just throwing random stuff into it it comes up with a funny;

    A given password holycowsbatman!-- will take 3 months to crack whereas if I add a third hyphen for it to become holycowsbatman!--- it takes 3 days.

    I know there's repeated characters in there and 'widely used combinations' as the tool will respond, but the repeated characters (though not as many of them) were there in the first example as were the combinations.

    Most recent advice i've come across all makes a virtue of elongating your password which I kinda get in terms of the theory of it. If i keep adding hyphens to elongate the password then it increments the time taken as you might expect.

    Does it look like a bug in there somewhere or does that look like reasonable behaviour of the checker?

    Hi Ancat,

    Although I'm a little rusty when it comes to password "salting" as I understand it, the warning about repeated characters is because it results in a more predictable hash of your password, hence the "3 days" - I agree though that bigger is always going to be better.

    I ran your password there through howsecureismypassword.net - adding a hyphen as you did means the difference between 20 and 849 billion years for a desktop PC to crack it, so I think you're on the right track.

    The reason for my preoccupation with long passwords has to do with a software "Dead Man's switch" on which I'm currently working (have posted about this in a separate thread in this forum).

    An essential part of this is that the password generated is one which is near nigh impossible to commit to memory, also one which cannot be cracked even by a supercomputer.

    In a nutshell, the idea is to store the password in an encrypted file on a server (currently I'm using one in Iran). A script is constantly running on the server with a timer, which unless it's reset every 24 hours will securely erase the file.

    Whenever you want to unlock your encrypted drive all you need to do is log into the server, decrypt the file and copy and paste the password.

    This sounds elaborate but it seems to me the only way that you can't be compelled to hand over the key. Provided you can hold out for 24 hours, then the data can't be retrieved.

    Of course any fool can invent a security system that they can't get around themselves so I'd be very interested to hear your thoughts on this in the other thread.


  • #33
    Recondite49
    Closed Accounts Posts: 1,004 ✭✭✭Recondite49


    FSL wrote: »
    Not limiting it to keyboard characters i.e. using 12 random bytes between Hex 01 and Hex FE i.e. excluding 00 and FF would take confiker 5380 centuries and the super computer 33 centuries.

    Thanks FSL,

    For any Linux users out there if you want to create a truly random password of X bits, you can do this very easily from the command line:

    dd if=/dev/random bs=1 count=X 2>/dev/null | base64 -w 0 | rev | cut -b 2- | rev

    e.g

    dd if=/dev/random bs=1 count=32 2>/dev/null | base64 -w 0 | rev | cut -b 2- | rev
    bN95Jid3is1SYt0G+sx/41+LKXq3fDbbxGCwcuGbKnQ

    A lot easier to generate than to remember sadly! :)


  • #34
    Rucking_Fetard
    Closed Accounts Posts: 1,260 ✭✭✭Rucking_Fetard


    This Man Has Nothing to Hide—Not Even His Email Password

    The Surveillance Engine: How the NSA Built Its Own Secret Google

    Does Randomness Actually Exist?


  • #35
    Rucking_Fetard
    Closed Accounts Posts: 1,260 ✭✭✭Rucking_Fetard


    Stealing Encryption Keys Just by Touching a Laptop

    Windows XP 'Unofficial Service Pack 4' brings updates to Microsoft's obsolete OS

    Feds warn first responders of dangerous hacking tool: Google Search


  • #36
    suspectdevice
    Registered Users Posts: 328 ✭✭suspectdevice


    Quick one; i noticed on a gmail account that someone had accessed it via a vodafone mobile service. I have the IP address but it looks like a Vodafone mobile IP address. I know I haven't used this and am wondering how can i look further into who did.

    Does Vodafone use a range of IP for mobile access so that someone using mobile only shows the Vodafone IP?

    The IP is from between Borrisokane and Roscrea - is this simply a repeater tower in the area or does it indicate the cell that the user was accessing from?

    Not understanding a whole lot about mobile IP so any help much appreciated.

    EDIT: so its the same geolocation for my fixed IP on Broadband so nothing relevant there.


  • Advertisement
  • #37
    Rucking_Fetard
    Closed Accounts Posts: 1,260 ✭✭✭Rucking_Fetard


    Electromagnetic Warfare Is Here

    What I use instead of Google services

    Twilight


  • #38
    Manach
    Moderators, Society & Culture Moderators Posts: 9,659 Mod ✭✭✭✭Manach


    Interesting Slashdot discussion on how NATO will now respond to IT attacks:
    http://yro.slashdot.org/story/14/09/02/1643236/nato-set-to-ratify-joint-defense-for-cyberattacks


  • #39
    Rucking_Fetard
    Closed Accounts Posts: 1,260 ✭✭✭Rucking_Fetard


    On BBC2 Now.

    Inside the Dark Web
    Duration: 1 hour

    Twenty-five years after the world wide web was created, it is now caught in the greatest controversy of its existence: surveillance.

    With many concerned that governments and corporations can monitor our every move, Horizon meets the hackers and scientists whose technology is fighting back. It is a controversial technology, and some law enforcement officers believe it is leading to 'risk-free crime' on the 'dark web' - a place where almost anything can be bought, from guns and drugs to credit card details.

    Featuring interviews with the inventor of the world wide web, Sir Tim Berners-Lee, and the co-founder of WikiLeaks, Julian Assange, Horizon delves inside the 'dark web'.

    Repeated Tomorrow 23.20 (Not in Scotland), will be on Iplayer (bit of hassle to watch though)

    Grand Designs (New Season) on CH4 now though, I'm watching that.


  • #40
    Recondite49
    Closed Accounts Posts: 1,004 ✭✭✭Recondite49


    Rucking_Fetard wrote: »
    Electromagnetic Warfare Is Here

    What I use instead of Google services

    Twilight

    Very much enjoyed the article you posted about alternatives to Google RF, many thanks.

    During my exile from the Information Security forums, I have been looking at ways to beef up my SSH sessions and have been very tempted by Google Authenticator.

    As you all know it's an open source app which helps generate OTP's which you can access from your APP on your phone. These codes need to be entered before you can connect to your server over SSH.

    While the server side software is open source, the application for Android and iPhones isn't, and contains some google specific code. Fortunately there is an open source alternative Authenticator called FreeOTP.

    This can import the keys created by Google Authenticator and help log you in.

    My question though is can this really be trusted - if an app has been created by the Gods of google, even open source, can we be sure they've found every bug and there's no backdoor?


  • #41
    Hotblack Desiato
    Registered Users Posts: 33,825 ✭✭✭✭Hotblack Desiato


    Rucking_Fetard wrote: »
    On BBC2 Now.

    Inside the Dark Web

    Sadly Horizon has been dumbed down past the point of uselessness for a couple of decades now.
    Repeated Tomorrow 23.20 (Not in Scotland)

    https://www.youtube.com/watch?v=LBJclF-i3BE
    :pac:

    Life ain't always empty.



  • Advertisement
  • #42
    Rucking_Fetard
    Closed Accounts Posts: 1,260 ✭✭✭Rucking_Fetard


    Hotblack Desiato wrote: »
    Sadly Horizon has been dumbed down past the point of uselessness for a couple of decades now.



    https://www.youtube.com/watch?v=LBJclF-i3BE
    :pac:
    Anybody watch it? Any good?

    I'l give it a look at some stage, S09 E09 of Supernatural is Tonights viewing.:D


  • #43
    Rucking_Fetard
    Closed Accounts Posts: 1,260 ✭✭✭Rucking_Fetard


    Recommended Reading


  • #44
    syklops
    Closed Accounts Posts: 18,969 ✭✭✭✭syklops


    The redacted list(e.g. without the passwords) can be downloaded from here so you can check if you or a friend/loved one is affected. Some users say the passwords are not their current ones but was one they used in the past which suggests it came from another site which people registered with which has been compromised.

    Apparently this is the biggest leak of passwords in one go in history, but can't find any data to back up that particular claim.


    Edit: People, people, people. Of the just under 5 million accounts, how many used the word "password" to form the basis of their password?


    19,646.


  • #45
    syklops
    Closed Accounts Posts: 18,969 ✭✭✭✭syklops


    I dont want to link to it here because then every skript kiddy in the house will be hacking peoples accounts. I PM'ed you, be responsible.


  • #46
    Rucking_Fetard
    Closed Accounts Posts: 1,260 ✭✭✭Rucking_Fetard


    syklops wrote: »
    The redacted list(e.g. without the passwords) can be downloaded from here
    Never worked for me (though read that it's been overloaded), here's another 1.

    https://isleaked.com/en.php
    If you don't like to specify your full email address for any reason, you can replace up to 3 characters with asterisk sign (e.g., for myaccount@gmail.com enter myac***nt@gmail.com), thus we'll show you a count of matches for this pattern. We respect your privacy.
    I don't think I'd put mine (if I used one) in to these to be honest, just change your password.


  • #47
    dalta5billion
    Registered Users Posts: 1,034 ✭✭✭dalta5billion


    One of my generated passwords from ages ago is there.

    Thank bejesus for lastpass.


  • #48
    Rucking_Fetard
    Closed Accounts Posts: 1,260 ✭✭✭Rucking_Fetard


    https://www.cyphertite.com/

    Opensource encrypted storage


    The Moment of Truth: Kim Dotcom, Glenn Grenwald, Edward Snowden, Julian Assange



    Jist is:Dotcom has an email apparently from Warner Bros to NZ Prime Min about getting Dot to NZ with the intention of raiding Mega and extraditing Dot. And New Zealand Launched Mass Surveillance Project While Publicly Denying It


    Wikileaks released FinFisher


    Get out and walk people...



  • #49
    Rucking_Fetard
    Closed Accounts Posts: 1,260 ✭✭✭Rucking_Fetard


    The Rise Of Open Source Hardware

    FBI Completes New Face Recognition System


  • #50
    Recondite49
    Closed Accounts Posts: 1,004 ✭✭✭Recondite49


    Rucking_Fetard wrote: »
    https://www.cyphertite.com/

    Opensource encrypted storage


    The Moment of Truth: Kim Dotcom, Glenn Grenwald, Edward Snowden, Julian Assange



    Jist is:Dotcom has an email apparently from Warner Bros to NZ Prime Min about getting Dot to NZ with the intention of raiding Mega and extraditing Dot. And New Zealand Launched Mass Surveillance Project While Publicly Denying It


    Wikileaks released FinFisher


    Get out and walk people...


    Thanks RF,

    Just had a look at Cyphertite, looks promising.

    There's a very generous initial offer of storage space of 8GB although it seems this is more for archiving purposes rather than actual cloud storage a la Dropbox, I could be wrong though, what do you think?

    Unlike Wuala, SpiderOak, Dropbox et. al there also isn't currently an Android app to automatically upload your pictures to the cloud which is a must for me as I like to take my handy camera phone on protests and it's good to be able to make sure your content is proof against seizure.

    There doesn't seem to be any way of limiting the upload speed of a backup and in fact the site's FAQ says specifically that the software is designed to make maximum use of your connection.

    The company is incorporated in Chicago in a "high security data facility" - possibly the most significant of the FAQ's and answers:
    Is there any legislation in the US that obligates you to report information about your users to US intelligence agencies?

     There are no laws that obligate us to share any information with US intelligence, law enforcement or other government agencies. In the U.S., like in most other jurisdictions, we may be served with a valid warrant forcing us to hand over a user's data. That data, however, is completely encrypted and will be indecipherable to anyone who does not have access to the users keys. We do not have access to users keys nor can we be forced to decrypt your data.

    All the same a warrant canary would be nice. Personally I'd feel more comfortable if their servers were located somewhere like the Caymans but there you are.

    The FAQ also claim that their secure storage passes the mud puddle test.

    It's also immensely reassuring to know they use open source software to encrypt the data and the source code for the software is available from the site.

    For the purists, an in depth explanation of the crypto they use can be found by visiting this page, then clicking "Read More".

    For the TLDR didn't read crowd, Cyphertite uses 256-bit AES-XTS to encrypt file data.


  • #51
    Rucking_Fetard
    Closed Accounts Posts: 1,260 ✭✭✭Rucking_Fetard


    http://labs.bittorrent.com/bleep/

    Ant-sized radios could help connect trillions of devices to the Internet of Things
    A team of researchers from Stanford University and the University of California, Berkeley, has created prototype radio-on-a-chip communications devices that are powered by ambient radio waves. Comprising receiving and transmitting antennas and a central processor, the completely self-contained ant-sized devices are very cheap to manufacture, don't require batteries to run and could give the "Internet of Things" (IoT) a serious kick start.

    CosmosBrowserAndroid


    Top 10 Emerging Technologies That Are Changing The World


    Craig Gentry is a computer scientist fueling a revolution in cryptography and theoretical computer science through his elegant solutions to some of the discipline’s most challenging open problems.

    Copyright Holders Want Netflix to Ban VPN Users


  • Advertisement
  • #52
    Rucking_Fetard
    Closed Accounts Posts: 1,260 ✭✭✭Rucking_Fetard


    In-depth: How CloudFlare promises SSL security—without the key

    Content delivery network and Web security company CloudFlare has made a name for itself by fending off denial-of-service attacks against its customers large and small. Today, it's launching a new service aimed at winning over the most paranoid of corporate customers. The service is a first step toward doing for network security what Amazon Web Services and other public cloud services have done for application services—replacing on-premises hardware with virtualized services spread across the Internet.

    Called Keyless SSL, the new service allows organizations to use CloudFlare’s network of 28 data centers around the world to defend against distributed denial of service attacks on their websites without having to turn over private encryption keys. Keyless SSL breaks the encryption “handshake” at the beginning of a Transport Layer Security (TLS) Web session, passing part of the data back to the organization’s data center for encryption. It then negotiates the session with the returned data and acts as a gateway for authenticated sessions—while still being able to screen out malicious traffic such as denial of service attacks.


  • #53
    Recondite49
    Closed Accounts Posts: 1,004 ✭✭✭Recondite49


    The NSA can hack your typewriter just as easily as a PC - but it probably doesn't need to

    A subject very close to my heart since I am currently using a lovely old Olivetti typewriter to send my personal letters and to store some passwords.

    The author of the article Matthew Sparkes, rightly points out that although typing letters onto a page can protect you from electronic interception of your correspondence, once the page leaves your home it can be intercepted by other means, such as bribing a courier.

    He also mentions the fact that both Russia and the US engaged in radio bugging of typewriters before the switch to computers.

    Of course this is only made possible by physical access to the device ; however in this day and age it would be a lot easier to bug a computer than a typewriter in this way.

    Also I am told by my Police friends that it's a lot harder to get a warrant to intercept someone's mail versus e-mail, so I'll stick with my humble Olivetti for now.

    Would love to hear everyone's thoughts on this.


  • #54
    Rucking_Fetard
    Closed Accounts Posts: 1,260 ✭✭✭Rucking_Fetard


    Recondite49 wrote: »
    A subject very close to my heart since I am currently using a lovely old Olivetti typewriter to send my personal letters and to store some passwords.
    Hows that work?

    Is the Hanx writer any good?:P


    Apple’s “warrant canary” disappears, suggesting new Patriot Act demands


    Middle-School Dropout Codes Clever Chat Program That Foils NSA Spying


    NSA Chief: Yes, We Still Have Friends


    Look at this one, to late to be trying to make sense of this but I skimmed it, They got all the Census Data (ethnicity), Crime Stats, anonymised (yea, right) 02 Mobile Data and threw an Algorithm at it and were able to predict with 70% accuracy future crime hotspots annnnnd, the Data could be gathered in real-time.

    What do they need to get that higher? Expect to be reading about this when it gets leaked in abit when it's up and running.
    In this paper, we present a novel approach to predict crime in a geographic space from multiple data sources, in particular mobile phone and demographic data. The main contribution of the proposed approach lies in using aggregated and anonymized human behavioral data derived from mobile network activity to tackle the crime prediction problem.

    While previous research efforts have used either background historical knowledge or offenders' profiling, our findings support the hypothesis that aggregated human behavioral data captured from the mobile network infrastructure, in combination with basic demographic information, can be used to predict crime. In our experimental results with real crime data from London we obtain an accuracy of almost 70% when predicting whether a specific area in the city will be a crime hotspot or not. Moreover, we provide a discussion of the implications of our findings for data-driven crime analysis.
    I put it up over in Big Data Forum aswell, very quiet there though.


  • #55
    Recondite49
    Closed Accounts Posts: 1,004 ✭✭✭Recondite49


    Hi RF,

    I perhaps should have explained the passwords are stored on paper, not in the typewriter!

    A colleague told me about the typewriter App, I'm an Android man but it looks mighty promising!

    I've discussed before the system I use for secure passwords whereby I use a line of text from a book plus a remembered phrase but these are just a few passwords for trivial things like iTunes, Second Life and so on.

    Didn't know about Apple's warrant canary. Presumably though if you're worried about privacy you couldn't take the risk of using a closed source OS anyway?


  • #56
    Recondite49
    Closed Accounts Posts: 1,004 ✭✭✭Recondite49


    Rucking_Fetard wrote: »


    Middle-School Dropout Codes Clever Chat Program That Foils NSA Spying

    This program Ricochet looks very promising, I like how everything is torified and it addresses the metadata issue which has long been in a thorn in the side of supposedly secure chat programs.

    The program doesn't support OTR at the moment but it has been pointed out by developers that perfect forward secrecy is something of a moot point when using a Tor hidden service:
    "I don't believe OTR has much to offer here. Encryption, authentication, and forward secrecy are provided by the rendezvous circuit, and if that is broken, there are a variety of issues that another layer of encryption on the raw text of communications won't solve. OTR's other headline benefit is deniability (in that others can forge messages, meaning others can't cryptographically authenticate a transcript after the fact); this is meaningless inside an authenticated connection."

    Nevertheless it would be a handy feature to have, particularly as the much vaunted Tor Instant Messaging Bundle seems a little slow to get off the ground.

    For now I'm going to stick with Pidgin + OTR over Tor, despite the security concerns surrounding the libpurple library. Oh well, needs must!


  • #57
    Rucking_Fetard
    Closed Accounts Posts: 1,260 ✭✭✭Rucking_Fetard


    Rucking_Fetard wrote: »

    What do they need to get that higher? Expect to be reading about this when it gets leaked in abit when it's up and running.
    Seems theirs versions of this active around the place already, in the US of course:rolleyes: (well worth a read this, it's all coming down the line)
    But these early predictive systems are only the start. In years to come, many legal experts speculate, brain scans and DNA analysis could help to identify potential criminals at the young age of three. Some evidence for the approach came in 2009 in the Proceedings of the National Academy of Sciences: researchers from the US and the UK tested 78 male subjects for different forms of the so-called ‘warrior gene’, which codes for the enzyme monoamine oxidase A (MAOA), a gene that breaks down crucial neurotransmitters in the brain.

    One version of MAOA works efficiently; but another version breaks down brain chemicals only sluggishly, and has long been linked to aggression in observational and survey-based studies. Some researchers held that, in war-prone societies, up to two-thirds of individuals had the low-activity gene – versus the more typical percentage of just one-third, found in the more peaceful nations of the world.
    ‘There’s a real risk that the data that gets inputted is biased, or based on stereotype or overgeneralisations based on race and class’, said Hanni Fakhoury, a staff attorney at the Electronic Frontier Foundation, a non-profit digital civil liberties organisation in San Francisco. ‘It’s easy to ensnare innocent people into these things. Crooks talk to non-criminals, too, and taking lots of data on some people will inevitably capture information on people who’ve done nothing wrong other than to know someone caught up in the criminal justice system’.

    Went without saying really and all the ones above already seem geared toward the not white/poor, when it's white CEO/Leaders/Bankers be they front of house or back room ruining everything.


    Exactly How Often Do Police Shoot Unarmed Black Men?


  • #58
    Rucking_Fetard
    Closed Accounts Posts: 1,260 ✭✭✭Rucking_Fetard


    Rucking_Fetard wrote: »
    Seems theirs versions of this active around the place already, in the US of course:rolleyes: (well worth a read this)
    Especially the comments!!




    Dropbox and Google create Simply Secure, an organization trying to make open source security tools easy to use
    Dropbox, Google, and the Open Technology Fund today announced a new organization focused on making open source security tools easier to use. Called Simply Secure, the initiative brings together security researchers with experts in user interaction and design to boost adoption rates for consumer-facing security solutions.

    Alot of open source stuff lately.


  • #59
    Rucking_Fetard
    Closed Accounts Posts: 1,260 ✭✭✭Rucking_Fetard


    FBI director worries about encryption on smartphones
    The U.S. Federal Bureau of Investigation is concerned about moves by Apple and Google to include encryption on smartphones, the agency's director said Thursday.

    Quick law enforcement access to the contents of smartphones could save lives in some kidnapping and terrorism cases, FBI Director James Comey said in a briefing with some reporters. Comey said he's concerned that smartphone companies are marketing "something expressly to allow people to place themselves beyond the law," according to news reports.


  • #60
    Rucking_Fetard
    Closed Accounts Posts: 1,260 ✭✭✭Rucking_Fetard


    Rucking_Fetard wrote: »
    New Zealand Launched Mass Surveillance Project While Publicly Denying It

    New laws could give ASIO a warrant for the entire internet, jail journalists and whistleblowers
    Spy agency ASIO will be given the power to monitor the entire Australian internet and journalists' ability to write about national security will be curtailed when new legislation – expected to pass in the Senate as early as Wednesday – becomes law, academics, media organisations, lawyers, the Greens party and rights groups fear.


    Recovering Evidence from SSD Drives in 2014: Understanding TRIM, Garbage Collection and Exclusions


  • Advertisement
  • #61
    Rucking_Fetard
    Closed Accounts Posts: 1,260 ✭✭✭Rucking_Fetard


    Check your Mailserver for vulne stuff

    The NSA is renting its technology to U.S. companies

    Nobodys really reading these. Another post in here after getting it's own thread. Waste of time.


Advertisement