| 00:31.00 | *** join/#utah markl_ (n=mark@dsl093-225-127.slc1.dsl.speakeasy.net) |
| 00:33.37 | *** join/#utah elg (n=fugalh@falcon.fugal.net) |
| 00:33.46 | elg | ScytheBlade1: nice one |
| 00:33.50 | elg | i'll have to remember that |
| 00:34.26 | elg | -lart vont |
| 00:37.33 | elg | hah. this is exactly how I feel today http://www.phdcomics.com/comics/archive.php?comicid=732 |
| 00:37.34 | brac | [Piled Higher and Deeper] |
| 00:38.57 | ScytheBlade1 | elg, yeah, it's awesome |
| 00:42.41 | elg | try doing that with ipsec.;-) |
| 00:43.25 | ScytheBlade1 | elg, UVSC and basically every single wifi AP out there will have NAT ;) |
| 00:43.47 | ScytheBlade1 | (That said, the tunnel was covered with a high-grade SSL cert, which we then could have IPSec'd) |
| 00:43.52 | ScytheBlade1 | But that's a little overkill |
| 00:44.03 | elg | i'd say |
| 00:44.08 | elg | ipsec is no more secure than ssl |
| 00:44.13 | elg | probably less so |
| 00:44.16 | ScytheBlade1 | lol |
| 00:44.30 | ScytheBlade1 | Nah, it's quite a bit more secure, but for a different reason |
| 00:44.42 | elg | theoretically, maybe |
| 00:44.43 | ScytheBlade1 | Either way, I wasn't really worried about people looking at my traffic |
| 00:44.57 | ScytheBlade1 | IPSec also provided authentication, not encryption |
| 00:45.00 | ScytheBlade1 | Unlike OpenVPN |
| 00:45.04 | elg | but practically it's more likely to be _less_ secure because nobody groks the whole thing and make configuration mistakes |
| 00:45.12 | ScytheBlade1 | Oh okay |
| 00:45.15 | ScytheBlade1 | Yeah I'll give you that |
| 00:45.45 | elg | how does ipsec auth better than openvpn, if you're checking certs? |
| 00:46.36 | ScytheBlade1 | OpenVPN uses the cert for encryption |
| 00:46.47 | ScytheBlade1 | No real way of knowing if there's a MITM attack there |
| 00:49.16 | elg | are you sure? |
| 00:49.49 | ScytheBlade1 | Decently |
| 00:50.00 | ScytheBlade1 | Feel free to prove me wrong, but that's my understanding of it |
| 00:50.16 | ScytheBlade1 | Likewise, if OpenVPN was sufficient - then why bother with IPSec at all? |
| 00:50.30 | elg | uh, because people are idiots |
| 00:50.32 | elg | and ipsec was first |
| 00:50.39 | elg | and there's all these ipsec appliances |
| 00:51.07 | ScytheBlade1 | The best I have is a printer that accepts a 56-bit SSL cert tops :P |
| 00:51.09 | elg | let me know if you find any, I'd be curious to learn of them |
| 00:51.18 | elg | I've done my time with some non-nice ipsec appliances |
| 00:51.36 | ScytheBlade1 | will do |
| 00:51.43 | ScytheBlade1 | But yeah, 53/udp ^^ |
| 00:55.49 | ScytheBlade1 | It's so very nice... the speeds at UVSC were honestly insane |
| 00:55.56 | ScytheBlade1 | That's 2-3MB/sec |
| 00:56.01 | ScytheBlade1 | megabytes, not megabits |
| 00:59.44 | elg | fast |
| 01:00.28 | elg | ok, I'll take you up on the debate. the openvpn session is set up with public key cryptography, using the certs on both ends |
| 01:00.36 | elg | a man in the middle would need the private key(s) |
| 01:01.16 | ScytheBlade1 | Good point. I fail at basic logic, it would seem. |
| 01:01.18 | elg | a hole is if your client doesn't use --tls-remote or --tls-verify to make sure he's connecting to who he thinks he is |
| 01:01.55 | *** join/#utah vontrapp (n=von@66.7.119.3) |
| 01:02.08 | vontrapp | ~lart broadcom |
| 01:02.19 | vontrapp | the crapiest wireless manufacturer known to all the universe |
| 01:03.00 | elg | there's also --tls-cipher to keep a man in the middle from tricking you both into using lowgrade security |
| 01:03.34 | ScytheBlade1 | Right |
| 01:03.42 | vontrapp | will it keep my wireless card associated? |
| 01:04.29 | elg | -lart vontrapp |
| 01:11.54 | emcnabb | ~lart elg |
| 01:12.42 | elg | -lart emcnabb |
| 01:17.57 | elg | ~hit emcnabb |
| 01:17.58 | ibot | ACTION punches emcnabb. |
| 01:22.25 | elg | ibot, come off your high horse |
| 01:36.23 | tristanbob | in the cups web-interface - what credentials is it looking for? (Ubuntu 6.06) |
| 01:36.32 | tristanbob | I am trying to add a printer |
| 01:36.44 | tristanbob | and I get a Username/Password prompt |
| 01:36.56 | ScytheBlade1 | root user and pass |
| 01:37.10 | tristanbob | so user is "root" |
| 01:37.14 | ScytheBlade1 | yup |
| 01:37.19 | tristanbob | and then the normal sudo password for ubuntu? |
| 01:37.21 | ScytheBlade1 | and password = root's password |
| 01:37.34 | ScytheBlade1 | No, the sudo password = your user password |
| 01:37.43 | tristanbob | in ubuntu root user is disabled |
| 01:37.51 | ScytheBlade1 | I'd ask a more ubuntu knowledgable user, actually |
| 01:37.53 | ScytheBlade1 | I use gentoo ;) |
| 01:38.05 | ScytheBlade1 | but I know that's how cups works |
| 01:38.12 | ScytheBlade1 | it'll accept the root user and pass |
| 01:59.49 | tewk | ScytheBlade1: If certs are used on both sides of the connection it eliminates MITM |
| 02:01.39 | tewk | The problem with normal HTTTP SSL traffic is that client certs are rarely used. |
| 02:29.34 | ScytheBlade1 | tewk, <ScytheBlade1> Good point. I fail at basic logic, it would seem. |
| 02:35.18 | *** join/#utah spengy (n=spengy@unaffiliated/spengy) |
| 03:04.12 | *** join/#utah wps (n=wps@gw6.rapidwave.net) |
| 03:19.02 | *** join/#utah findlay (n=justin@Brentwood-mikrotik.veracitycom.net) |
| 03:19.11 | findlay | ~lart oct |
| 03:24.26 | tensai | ~lart findlay for attacking such an innocent creature as OCT |
| 03:46.52 | *** join/#utah mheath (n=Mike@c-67-182-231-23.hsd1.co.comcast.net) |
| 04:05.57 | *** join/#utah neybar (n=jalance@thelances.net) |
| 04:30.48 | mheath | Not too talkative in here tonight. |
| 04:33.16 | goozbach | 9 days disconnected... |
| 04:33.20 | goozbach | feels good |
| 04:34.04 | mheath | I'm going to go half a year without touching a computer |
| 04:34.20 | mheath | (though there is a two week period in the middle of that during which I could) |
| 04:35.20 | goozbach | see you all again on tuesday |
| 04:35.20 | mheath | Heh. |
| 04:35.28 | mheath | Have fun, goozbach. |
| 04:35.37 | goozbach | mheath: invoke me |
| 04:35.43 | goozbach | say invoke goozbach |
| 04:35.46 | mheath | ~invoke goozbach |
| 04:35.53 | mheath | invoke goozbach |
| 04:35.55 | goozbach | without the tilde |
| 04:36.03 | goozbach | cool |
| 04:36.12 | goozbach | just wanted to make sure it really was working |
| 05:23.08 | QBFreak | hmm, I missed the vista download period didn't I... |
| 05:32.48 | maquis | goozbach: howdy |
| 05:33.30 | maquis | QBFreak: why do you care? |
| 05:34.33 | QBFreak | I just built a dedicated windows box and I figured whats one more version? :) |
| 05:34.45 | maquis | *shudder* |
| 06:35.27 | *** join/#utah herlo (n=clints@71-219-26-231.slkc.qwest.net) |
| 08:59.15 | *** join/#utah kober (n=kober@c-71-199-29-164.hsd1.co.comcast.net) |
| 10:24.21 | *** join/#utah mrpull-x (i=xmjake@xmission.xmission.com) |
| 10:24.27 | *** join/#utah bytheway (i=bytheway@xmission.xmission.com) |
| 10:26.37 | *** join/#utah herlo (n=clints@71-219-26-231.slkc.qwest.net) |
| 10:37.49 | *** join/#utah mrpull-x (i=xmjake@xmission.xmission.com) |
| 11:53.44 | emcnabb | I need to get moving... |
| 12:59.21 | *** join/#utah Cubeyfreak (n=qbfreak@cpe-069-132-229-120.carolina.res.rr.com) |
| 13:22.24 | *** join/#utah RyanE (i=Piadas@rberick.dsl.xmission.com) |
| 13:39.57 | *** join/#utah RyanE_ (i=Piadas@rberick.dsl.xmission.com) |
| 14:15.14 | tristanbob | tewk: I don't think client certificates are required to prevent man-in-the-middle attacks |
| 14:15.44 | *** join/#utah mheath (n=Mike@c-67-182-231-23.hsd1.ut.comcast.net) |
| 14:15.56 | tristanbob | if the session is being intercepted the client will show a warning that the cert is invalid |
| 14:16.16 | tristanbob | the problem is that most users will just hit OK and continue |
| 14:19.10 | mheath | tristanbob: Thats a habit developed because 99% of invalid cert warning are just because the admin of a website is stupid |
| 14:19.31 | tristanbob | or too cheap |
| 14:19.47 | mheath | I've seen lots of government/military websites that generate invalid cert warnings. |
| 15:19.51 | mheath | (all of those are like advertisement and info sights, nothing mission critical or confidential) |
| 15:19.57 | mheath | s/sights/sites/g |
| 15:54.56 | *** join/#utah mrpull-x (i=xmjake@xmission.xmission.com) |
| 19:56.13 | *** join/#utah elg (n=fugalh@falcon.fugal.net) |
| 19:56.34 | elg | overtime. why am i not surprised? |
| 20:25.29 | *** join/#utah mindjuju (n=Administ@216.20.238.225) |
| 20:25.48 | *** part/#utah mindjuju (n=Administ@216.20.238.225) |
| 21:01.51 | *** join/#utah nick125 (n=nick@atarack/staff/nick125) [NETSPLIT VICTIM] |
| 21:01.58 | *** join/#utah maquis (n=maquis@joanna.zmonkey.org) [NETSPLIT VICTIM] |
| 21:02.01 | *** join/#utah Supaplex (n=supaplex@shell.aros.net) [NETSPLIT VICTIM] |
| 21:02.06 | *** join/#utah mrpull-x (i=xmjake@xmission.xmission.com) [NETSPLIT VICTIM] |
| 21:02.49 | *** join/#utah wps (n=wps@gw6.rapidwave.net) [NETSPLIT VICTIM] |
| 21:14.36 | *** join/#utah jlp_work (n=jlp@67.106.37.5) [NETSPLIT VICTIM] |
| 21:14.47 | *** join/#utah xbmodder_newlapp (i=nobody@xbmodder.us) |
| 21:14.52 | *** join/#utah WoodsDog (n=woodsdog@64.0.193.2) [NETSPLIT VICTIM] |
| 21:19.13 | *** join/#utah tensai (n=tensai@joanna.zmonkey.org) |
| 22:36.09 | *** join/#utah RyanE (i=Piadas@rberick.dsl.xmission.com) |
| 22:54.52 | *** join/#utah elg (n=fugalh@falcon.fugal.net) |