Security Fuckup Megathread - v7.2 "BoringSFM"

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > YOSPOS > Security Fuckup Megathread - v7.2 "BoringSFM"

«‹›47 »

vOv: Feb 8, 2014

cookies over http is a bad idea, film at 11

# ? Jul 29, 2014 16:58

Adbot: ADBOT LOVES YOU

# ? May 14, 2024 10:56

goddamnedtwisto: Dec 31, 2004; If you ask me about the mole people in the London Underground, I WILL be forced to kill you; Fun Shoe

Shinku ABOOKEN posted:

why do some sites forbid using the same letter three times in a row????

does that even help? this only reduces the set of valid passwords making brute forcing easier, no?

presumably to stop people setting their password as aaaaaaaaaaa

# ? Jul 29, 2014 17:04

Pile Of Garbage: May 28, 2007

im lazy so i like the way that qualys handle asswords: e-mail you your new password in the clear and dont enforce changing it at next login

# ? Jul 29, 2014 17:08

goddamnedtwisto: Dec 31, 2004; If you ask me about the mole people in the London Underground, I WILL be forced to kill you; Fun Shoe

cheese-cube posted:

im lazy so i like the way that qualys handle asswords: e-mail you your new password in the clear and dont enforce changing it at next login

for some reason every usenet provider i've ever used also does this

# ? Jul 29, 2014 17:32

Lain Iwakura: Aug 5, 2004; The body exists only to verify one's own existence.; Taco Defender

https://www.kickstarter.com/projects/504595646/cryptocat-private-instant-messaging-for-everyone

20 hours to go
$5,500 raised
$45,000 needed

WHAT A SUCCESS

# ? Jul 29, 2014 18:06

Pile Of Garbage: May 28, 2007

quote:

The Cryptocat team will fly over to your city of residence and give a full-day workshop on Internet privacy and computer security to your workplace! Note that you must cover travel costs, and that we reserve the right to postpone travel due to safety concerns.

honestly words escape me.

# ? Jul 29, 2014 18:12

Pile Of Garbage: May 28, 2007

i mean, i shouldnt be surprised that a terrible person could create a terrible kickstarter but this is just something else

# ? Jul 29, 2014 18:14

Lain Iwakura: Aug 5, 2004; The body exists only to verify one's own existence.; Taco Defender

cheese-cube posted:

i mean, i shouldnt be surprised that a terrible person could create a terrible kickstarter but this is just something else

as shared in #yossec

http://www.kicktraq.com/projects/504595646/cryptocat-private-instant-messaging-for-everyone/#chart-daily

# ? Jul 29, 2014 18:44

Westie: May 30, 2013; Baboon Simulator

vOv posted:

cookies over http is a bad idea, film at 11

same but for facebook chat, history and all.

# ? Jul 29, 2014 19:22

Moist von Lipwig: Oct 28, 2006; by FactsAreUseless; Tortured By Flan

BangersInMyKnickers posted:

pirated semen installs

mods

# ? Jul 29, 2014 19:31

Volmarias: Dec 31, 2002; EMAIL... THE INTERNET... SEARCH ENGINES...

LARD LORD posted:

mods

Link us to Genuine semen please so that we can True Up

# ? Jul 29, 2014 19:33

Moist von Lipwig: Oct 28, 2006; by FactsAreUseless; Tortured By Flan

Volmarias posted:

Link us to Genuine semen please so that we can True Up

okay

# ? Jul 29, 2014 19:38

Volmarias: Dec 31, 2002; EMAIL... THE INTERNET... SEARCH ENGINES...

LARD LORD posted:

okay

# ? Jul 29, 2014 21:06

Qtotonibudinibudet: Nov 7, 2011; Omich poluyobok, skazhi ty narkoman? ya prosto tozhe gde to tam zhivu, mogli by vmeste uyobyvat' narkotiki

OSI bean dip posted:

https://www.kickstarter.com/projects/504595646/cryptocat-private-instant-messaging-for-everyone

20 hours to go
$5,500 raised
$45,000 needed

WHAT A SUCCESS

can i send a doobie dog over it

# ? Jul 29, 2014 22:11

Lain Iwakura: Aug 5, 2004; The body exists only to verify one's own existence.; Taco Defender

http://www.cbc.ca/news/politics/chinese-cyberattack-hits-canada-s-national-research-council-1.2721241

so fyi the canadian government still uses ie6 in a lot of departments

even our national police force

# ? Jul 29, 2014 23:08

Dixie Cretin Seaman: Jan 22, 2008; all hat and one catte; Hot Rope Guy

android lol

Android Fake ID Vulnerability Lets Malware Impersonate Trusted Applications, Puts All Android Users Since January 2010 At Risk

The Android package installer makes no attempt to verify the authenticity of a certificate chain; in other words, an identity can claim to be issued by another identity, and the Android cryptographic code will not verify the claim

Dubbed �Fake ID,� the vulnerability allows malicious applications to impersonate specially recognized trusted applications without any user notification. This can result in a wide spectrum of consequences. For example, the vulnerability can be used by malware to escape the normal application sandbox and take one or more malicious actions: insert a Trojan horse into an application by impersonating Adobe Systems; gain access to NFC financial and payment data by impersonating Google Wallet; or take full management control of the entire device by impersonating 3LM.

Dixie Cretin Seaman fucked around with this message at 00:08 on Jul 30, 2014

# ? Jul 30, 2014 00:05

raruler: Oct 5, 2003; “Here lies a toppled god —
His fall was not a small one.
We did but build his pedestal,
A narrow and a tall one.”

just gonna check that this certificate is valid

not gonna check who vouched for it, or anything

why yes, the chinese government is in my trust store

# ? Jul 30, 2014 00:20

kitten emergency: Jan 13, 2008; get meow this wack-ass crystal prison

with friends like Google, why would :nsa:

even need backdoored

# ? Jul 30, 2014 00:57

kitten emergency: Jan 13, 2008; get meow this wack-ass crystal prison

you know what, it's better that way

# ? Jul 30, 2014 00:57

a cyberpunk goose: May 21, 2007

wrap it up ????ailures

# ? Jul 30, 2014 01:01

ahmeni: May 1, 2005; It's one continuous form where hardware and software function in perfect unison, creating a new generation of iPhone that's better by any measure.; Grimey Drawer

OSI bean dip posted:

http://www.cbc.ca/news/politics/chinese-cyberattack-hits-canada-s-national-research-council-1.2721241

so fyi the canadian government still uses ie6 in a lot of departments

even our national police force

there's still good money to be made working for the govt if you're one of the poor souls that knows coldfusion

# ? Jul 30, 2014 01:08

A Wheezy Steampunk: Jul 16, 2006; High School Grads Eligible!

Dixie Cretin Seaman posted:

android lol

Android Fake ID Vulnerability Lets Malware Impersonate Trusted Applications, Puts All Android Users Since January 2010 At Risk

The Android package installer makes no attempt to verify the authenticity of a certificate chain; in other words, an identity can claim to be issued by another identity, and the Android cryptographic code will not verify the claim

Dubbed �Fake ID,� the vulnerability allows malicious applications to impersonate specially recognized trusted applications without any user notification. This can result in a wide spectrum of consequences. For example, the vulnerability can be used by malware to escape the normal application sandbox and take one or more malicious actions: insert a Trojan horse into an application by impersonating Adobe Systems; gain access to NFC financial and payment data by impersonating Google Wallet; or take full management control of the entire device by impersonating 3LM.

but open source code can be reviewed by anyone which makes it more secure and furthermore,

# ? Jul 30, 2014 01:48

Dixie Cretin Seaman: Jan 22, 2008; all hat and one catte; Hot Rope Guy

raruler posted:

just gonna check that this certificate is valid

not gonna check who vouched for it, or anything

why yes, the chinese government is in my trust store

dont worry google issued a patch so once the carriers push it to all the android phones sold in the last 4 years this problem goes away

# ? Jul 30, 2014 02:42

Jewel: May 2, 2009

https://www.documentcloud.org/documents/1237512-daoud-7th-circuit.html

Long story short: Federal court says defendant cannot see :nsa:

surveillance evidence against him.

hosed up tbh.

# ? Jul 30, 2014 03:10

Qtotonibudinibudet: Nov 7, 2011; Omich poluyobok, skazhi ty narkoman? ya prosto tozhe gde to tam zhivu, mogli by vmeste uyobyvat' narkotiki

ahmeni posted:

there's still good money to be made working for the govt if you're one of the poor souls that knows coldfusion

as if the govt uses anything that modern

some bureaucrat in their 70s writes each returned page's html by hand and feeds the punchcard into the mainframe

at least that's the only explanation i have for websites that close after 5pm in the evening.

# ? Jul 30, 2014 04:02

anthonypants: May 6, 2007; by Nyc_Tattoo; Dinosaur Gum

scroogle nmaps posted:

as if the govt uses anything that modern

some bureaucrat in their 70s writes each returned page's html by hand and feeds the punchcard into the mainframe

at least that's the only explanation i have for websites that close after 5pm in the evening.

i worked at the local VA hospital a while back and their intranet was classic asp and sharepoint. lol coldfusion

# ? Jul 30, 2014 04:10

Bloody: Mar 3, 2013

reminder: howard dean invented drupal

# ? Jul 30, 2014 04:11

Volmarias: Dec 31, 2002; EMAIL... THE INTERNET... SEARCH ENGINES...

Bloody posted:

reminder: howard dean invented drupal

no wonder he was caught screaming on tape :ohdear:

# ? Jul 30, 2014 05:10

Optimus_Rhyme: Apr 15, 2007; are you that mainframe hacker guy?

LOL I just got invited to give a talk/keynote at a pretty big mainframe conference and I come to find out that some security people at CA and IBM think I'm 'too dangerous' to talk. To the point that they were willing to leave the board for the conference if I'm allowed to speak.

# ? Jul 30, 2014 05:21

Wiggly Wayne DDS: Sep 11, 2010

Optimus_Rhyme posted:

LOL I just got invited to give a talk/keynote at a pretty big mainframe conference and I come to find out that some security people at CA and IBM think I'm 'too dangerous' to talk. To the point that they were willing to leave the board for the conference if I'm allowed to speak.

go on

# ? Jul 30, 2014 05:24

vOv: Feb 8, 2014

Optimus_Rhyme posted:

LOL I just got invited to give a talk/keynote at a pretty big mainframe conference and I come to find out that some security people at CA and IBM think I'm 'too dangerous' to talk. To the point that they were willing to leave the board for the conference if I'm allowed to speak.

# ? Jul 30, 2014 05:28

Volmarias: Dec 31, 2002; EMAIL... THE INTERNET... SEARCH ENGINES...

Are you a loose cannon y/n

# ? Jul 30, 2014 05:29

Heresiarch: Oct 6, 2005; Literature is not exhaustible, for the sufficient and simple reason that no single book is. A book is not an isolated being: it is a relationship, an axis of innumerable relationships.

Optimus_Rhyme posted:

LOL I just got invited to give a talk/keynote at a pretty big mainframe conference and I come to find out that some security people at CA and IBM think I'm 'too dangerous' to talk. To the point that they were willing to leave the board for the conference if I'm allowed to speak.

what the hell have you done

# ? Jul 30, 2014 05:30

infernal machines: Oct 11, 2012; we monitor many frequencies. we listen always. came a voice, out of the babel of tongues, speaking to us. it played us a mighty dub.

Volmarias posted:

Are you a loose cannon y/n

well apparently they're going to take his badge for it

# ? Jul 30, 2014 05:31

pseudorandom name: May 6, 2007

I don't think a conference badge counts, sadly.

# ? Jul 30, 2014 05:31

CISADMIN PRIVILEGE: Aug 15, 2004; optimized multichannel
campaigns to drive
demand and increase
brand engagement
across web, mobile,
and social touchpoints,
bitch!

Optimus_Rhyme posted:

LOL I just got invited to give a talk/keynote at a pretty big mainframe conference and I come to find out that some security people at CA and IBM think I'm 'too dangerous' to talk. To the point that they were willing to leave the board for the conference if I'm allowed to speak.

post your speech

# ? Jul 30, 2014 05:43

my homie dhall: Dec 9, 2010; honey, oh please, it's just a machine

Optimus_Rhyme posted:

LOL I just got invited to give a talk/keynote at a pretty big mainframe conference and I come to find out that some security people at CA and IBM think I'm 'too dangerous' to talk. To the point that they were willing to leave the board for the conference if I'm allowed to speak.

Nice!

# ? Jul 30, 2014 06:23

Lain Iwakura: Aug 5, 2004; The body exists only to verify one's own existence.; Taco Defender

Optimus_Rhyme posted:

LOL I just got invited to give a talk/keynote at a pretty big mainframe conference and I come to find out that some security people at CA and IBM think I'm 'too dangerous' to talk. To the point that they were willing to leave the board for the conference if I'm allowed to speak.

make noise and embarrass the gently caress out of them

# ? Jul 30, 2014 06:39

EMILY BLUNTS: Jan 1, 2005

idk just say something like "ARCSERVE SUCKS" and CA will get mad but sort of quietly agree

# ? Jul 30, 2014 09:12

Adbot: ADBOT LOVES YOU

# ? May 14, 2024 10:56

compuserved: Mar 20, 2006; Nap Ghost

Optimus_Rhyme posted:

LOL I just got invited to give a talk/keynote at a pretty big mainframe conference and I come to find out that some security people at CA and IBM think I'm 'too dangerous' to talk. To the point that they were willing to leave the board for the conference if I'm allowed to speak.

please elaborate, this sounds pretty deece

# ? Jul 30, 2014 12:35

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > YOSPOS > Security Fuckup Megathread - v7.2 "BoringSFM"

«‹›47 »