Unable to load image

Our security auditor is an idiot. How do I give him the information he wants? (Server Fault, 2009)

https://serverfault.com/questions/293217/our-security-auditor-is-an-idiot-how-do-i-give-him-the-information-he-wants

As explained, this information should be easily available on any well maintained system to any competent administrator. Your failure to be able to provide this information leads me to believe you are aware of security flaws in your system and are not prepared to reveal them. Our requests line up with the PCI guidelines and both can be met. Strong cryptography only means the passwords must be encrypted while the user is inputting them but then they should be moved to a recoverable format for later use.

:marseyxd#:

119
Jump in the discussion.

No email address required.

I remember the good old days when clicking the forgot your password link would just have them email you your password.

Jump in the discussion.

No email address required.

That is insecure. You should just type in your email address and get told your new password is now abc123

Jump in the discussion.

No email address required.

Jump in the discussion.

No email address required.

When I was young, I got asked to implement that at my first professional job, and I had to explain to the boss why it's a good thing that isn't possible.

Jump in the discussion.

No email address required.

Hello I m Prince auditer frm Kenya. Please send all you password now.


Don't forget to turn off signatures in settings!

Jump in the discussion.

No email address required.

Ok. I will put them here right now:

Account: CARPS_NUMBER_ONE_HATER

Password: F0ckC@rp

Account: I_HATE_EVERYONE

Password: Everyone12

Account: HumanUser123

Password: I4Mhum@n

Jump in the discussion.

No email address required.

I first assumed it was some type of test to assess if an admin was dumb enough (and had the means to) comply that request, but the auditor keeps doubling down. What the actual frick.

Jump in the discussion.

No email address required.

wow, that is actually blindingly stupid

Jump in the discussion.

No email address required.

Why? He's a IT guy; he won't get hacked lmao.

Jump in the discussion.

No email address required.

SOC auditors:

A profession where you're paid 6 figures a year to send emails asking about excel row items someone else more competent generated for you, and when asked for details or additional clarifications on their demands, just re-reads the excel row item verbatim and providing nothing of additional value.

Jump in the discussion.

No email address required.

>just give us all your passwords lmao

And I thought our pentest guys are stealing our money, compared to this their reports are fricking pulitzer price winning masterpieces.

Jump in the discussion.

No email address required.

There are a lot of people in the security space that have no idea what they are doing. I call myself an amateur and was lucky to learn under CISOs for some well known companies and some pretty well known security researchers who know what they are doing. I learn something new all the time from them.

I just did something for a client and read their pen-test report and it wasn't bad but some of the things they put as "proof" that things are fine are not really proof at all. Like forcing the application to go to HTTPS isn't full proof of sufficient TLS but I'm not an expert either so I keep my mouth shut.


Krayon sexually assaulted his sister. https://i.rdrama.net/images/17118241526738973.webp https://i.rdrama.net/images/17118241426254768.webp https://i.rdrama.net/images/17156480765435808.webp

Jump in the discussion.

No email address required.

I call myself an amateur and was lucky to learn under CISOs for some well known companies and some pretty well known security researchers who know what they are doing.

I'm not an expert either so I keep my mouth shut.

So you didn't learn anything.

Love it.

Jump in the discussion.

No email address required.

oh look it's my peepee rider.


Krayon sexually assaulted his sister. https://i.rdrama.net/images/17118241526738973.webp https://i.rdrama.net/images/17118241426254768.webp https://i.rdrama.net/images/17156480765435808.webp

Jump in the discussion.

No email address required.

Keep dreaming sweaty.

![](https://media.giphy.com/media/P8MxmGnjmytws/giphy.webp)

Jump in the discussion.

No email address required.

admit it, you lovvvvvvve to rageface at my posts. You always reply. I'm going to keep you as my pet.

![](/images/16766669054684675.webp)


Krayon sexually assaulted his sister. https://i.rdrama.net/images/17118241526738973.webp https://i.rdrama.net/images/17118241426254768.webp https://i.rdrama.net/images/17156480765435808.webp

Jump in the discussion.

No email address required.

I honestly have no idea who you are.

Also I'm a top.

Jump in the discussion.

No email address required.

No such thing as a Euro top, stop lyin.


Krayon sexually assaulted his sister. https://i.rdrama.net/images/17118241526738973.webp https://i.rdrama.net/images/17118241426254768.webp https://i.rdrama.net/images/17156480765435808.webp

Jump in the discussion.

No email address required.

Born and raised in Ohio bb.

Midwest cob here :#marseycornlove::#marseycornlove::#marseycornlove:

Jump in the discussion.

No email address required.

Most important lesson I learned in college was my Operating Systems professor who said "The thing about Computer 'Science' is that it's all made up. Physicists can't change the law of Gravity". The blind are leading the blind everywhere.

Jump in the discussion.

No email address required.

I recently finished up a project with some fintech firm where the infosec engineer they saddled me with couldn't linux, couldn't vim, and both the engineer and their infosec director complained that I spent too much time teaching them cli stuff and not enough time on clicking shit in the UI.

Jump in the discussion.

No email address required.

I think the problem is that SMBs have no direction on who is a good hire in this space. Developers often think they are hackers, but you see their pen-test report and it's obvious most developers don't know hacking at all. lol So how do you hire a good security guy if you can't hire some FAANG CISO guy but need someone who can help with security?

You see that in the dev space too where SMBs can't afford a good dev so now it's 10 years later and the guy in charge of development built all tables with MS Access. lol


Krayon sexually assaulted his sister. https://i.rdrama.net/images/17118241526738973.webp https://i.rdrama.net/images/17118241426254768.webp https://i.rdrama.net/images/17156480765435808.webp

Jump in the discussion.

No email address required.

It's all just varying degrees of hackability with no real actual proof you've done it right.

Jump in the discussion.

No email address required.

Holy frick lmfaoooooooo

Jump in the discussion.

No email address required.

Both of these people are fricking morons. lol.

I would have just laughed in this security muppet's face after the first communication, probably called him an r-slur to his face and gotten fired so i can move on to a functional company.

:#marseylaughbothsides:

Jump in the discussion.

No email address required.

encrypted while the user is inputting them

What the frick what the frick what the frick what the frick WHAT DOES THAT EVEN MEAN

AM I SUPPOSED TO ENCRYPT A FRICKING CLIENT-SIDE HTML TEXT BOX AFTER EVERY KEY PRESS

:#marseybangfast:

Jump in the discussion.

No email address required.

I'm going to guess it was supposed to mean "make the characters show as asterisks on the screen"

Jump in the discussion.

No email address required.

User types in abc123

Encrypt it with AES and the password "00000000".

Send it to the server.

The server decrypts it.

Jump in the discussion.

No email address required.

basically, you calculate the hash of the password h = H(p) in the webpage using js and send that over instead.

when you want to log in, the server provides a challenge C, and you return H(H(p) xor C), which the server can verify as H(h xor C)

Jump in the discussion.

No email address required.

My mothers gmail password was bbb until 2006 (she was literally a beta user and that’s how long it took for them to make her change it)

Jump in the discussion.

No email address required.

He should use a JSon export from GNU Linux running a TMP encrypter:marseyreading:

Jump in the discussion.

No email address required.

Just make something up?

Jump in the discussion.

No email address required.

wow! nobody gives a frick about your feelings and why should they? I dont care about your week, your day, or even your fricking life. This is an internet forum and if you cant handle being here where there is free speech then shut the frick up and go home. It's 2020 if you are still crying about your fricking skin color you are pathetic. Theres more opportunity for BIPOCs to succeed than ever before, and if you are jewish then you could do us all a favor and choke on a peepee. If you aren't smart enough to learn and apply some knowledge blame your fricking biology and your brain cell count and mental capacity and not your skin color. Weak butt fricking babies. That's why you are at the bottom of the food chain now, that fricking weak butt mentality. No mental fortitude and apparently no capacity to learn and apply yourself.

Snapshots:

Jump in the discussion.

No email address required.

Alright someone who understands that I haven't studied the security chapters yet explain to me how passwords are stored. Also is the Admin a jeet? I am getting strong jeet energies here.

Jump in the discussion.

No email address required.

You use "hashes". Hashes are "one-way functions" that give you a unique output based on a given input. It changes entirely if there's even a tiny change in the input data.

[email protected]:~$ echo "hello" > test1
[email protected]:~$ echo "hello marsey" > test2
[email protected]:~$ shasum test*
f572d396fae9206628714fb2ce00f72e94f2258f  test1
37057632696135cb3c07d99500d6062d461427c3  test2
[email protected]:~$ 

The other property, and why they are called "one way", is you cannot get the original data back from a hash.

Why this is important to passwords is even in the event passwords are hacked or leaked simple hashing will prevent exposing your actual password. So a website can confirm hunter 2 is your password by comparing the hash it has but a hacker can't turn e0fee1adf795c84eec4735f039503eb18d9c35cc into hunter 2.

I'm sure some :marseyakshually: people here will expand but that's the jist. It also ignores common attacks that are prevented by using special hashes or including "salts" to prevent rainbow table attacks.

Jump in the discussion.

No email address required.

do you mean a hacker can't turn ****** into readable password?

Or that each system has their own code for converting hashes to random gibberish and back to hashes?

Thank you makes sense.

Jump in the discussion.

No email address required.

Hashes aren't reversible because there's loss of information involved. It's not the same as encryption where all the data is still there in an encoded format. Instead, the hash represents a (hopefully) unique value for any given input. You can't take a hash and figure out what the plain text was that it represents, it's not possible due to the information not really being there anymore.

Nothing to do with *s and stuff, think more like:

Password: mypassword1 -> Hash 123ABC

Password: mypassword2 -> Hash FFFDDD

The hash won't in any way resemble the input, and even closely related input will generate hashes that look nothing like each other.

Jump in the discussion.

No email address required.

it's not so much about losing information (even a truncation achieves that) but rather the preimage resistance/collision resistance properties. Actually, it's obvious that hashes cannot be unique (ie, a hash function is not injective), since the input is arbitrary-length and the output is fixed-length. But the design of hash functions is such that the only known way to find a preimage or collision is to try a large number of inputs.

Jump in the discussion.

No email address required.

I put a meme password there but rdrama filters it which is funny.

Jump in the discussion.

No email address required.

hunter2

edit: lol

Jump in the discussion.

No email address required.

very funny :marseyclapping:

Jump in the discussion.

No email address required.

Passwords are stored using an irreversible hash function. When you log in, your input is hashed and compared to the stored hashed value.

Jump in the discussion.

No email address required.

Nice find. I wonder how tf he got that job.

Jump in the discussion.

No email address required.

Reported by:

I'd quit

Jump in the discussion.

No email address required.

Link copied to clipboard
Action successful!
Error, please refresh the page and try again.