| 00:37.54 | *** join/#utah tiwula (~lane@174-23-52-120.slkc.qwest.net) |
| 00:38.28 | *** join/#utah dev_random[m] (devrandomm@gateway/shell/matrix.org/x-xtamftoyrepetxxq) |
| 02:26.33 | *** join/#utah josephscott (~josephsco@74.114.153.251) |
| 03:22.00 | *** join/#utah tiwula (~lane@174-23-11-37.slkc.qwest.net) |
| 03:44.48 | *** join/#utah josephscott (~josephsco@74.114.153.251) |
| 04:57.30 | *** join/#utah tiwula (~lane@174-23-11-37.slkc.qwest.net) |
| 04:58.27 | TodPunk | romanovic: don't you work at Domo? |
| 04:59.20 | TodPunk | (Referring to last Tuesday's mention of engineers looking for work by you) |
| 05:04.52 | tiwula | Ahoy TodPunk! |
| 05:05.01 | TodPunk | Hullo |
| 05:07.37 | TodPunk | I'm not going to dog on Domo too hard or anything, but I would expect people to be leaving more than moving toward them |
| 06:03.11 | *** join/#utah Sargun (~sargun@atarack/Staff/Sargun) |
| 09:12.27 | *** join/#utah frostyfrog (~frostyfro@unaffiliated/frostyfrog) |
| 13:28.21 | *** join/#utah josephscott (~josephsco@74.114.153.251) |
| 13:44.17 | *** join/#utah aeryndunham (~aeryndunh@96.71.45.243) |
| 13:59.18 | *** join/#utah aeryndunham_ (~aeryndunh@96.71.45.252) |
| 14:36.59 | *** join/#utah josephscott (~josephsco@74.114.153.251) |
| 15:39.04 | *** join/#utah tiwula (~lane@70.89.246.241-Busname-UT.hfc.comcastbusiness.net) |
| 16:43.28 | *** join/#utah josephscott (~josephsco@74.114.153.251) |
| 17:11.50 | *** join/#utah aeryndunham_ (~aeryndunh@96.71.45.252) |
| 17:15.33 | romanovic | TodPunk: I do! and, not worried about any shortage of people coming to work at Domo. The trick is being able to bring new engineers to _my_ team in particular, before they get snapped up by the engineering department |
| 17:16.26 | *** join/#utah bashNinja (uid121707@gateway/web/irccloud.com/x-fcpgzbhohlzbzkhh) |
| 17:33.10 | joshh | romanovic: whats your department out of curiosity if not engineering? |
| 18:38.49 | romanovic | joshh: I work on a labs/special projects team that reports directly to the CTO, so we do a lot more experimental features |
| 18:39.40 | jfindlay | romanovic: how does domo compare/contrast with tableau/powerbi? |
| 18:40.31 | jfindlay | tableau tried to interview me a few times but I think determined I wasn't bro enough each time |
| 18:40.50 | joshh | ah, cool |
| 18:41.26 | jfindlay | but domo has always appeared as the arch bro shop |
| 18:43.55 | romanovic | there's a lot of crossover with tableau. I feel like they provide more of an individual power-user BI experience, and are trying become more cloudy, while Domo is more enterprise scale and cloud centric, but has products also targeted to the end user, and there's a lot of overlap in the middle there |
| 18:45.15 | romanovic | jfindlay: I feel that way when we used to be housed near the sales teams. But, I've felt that way about sales at every other company I worked at as well. |
| 18:45.42 | jfindlay | tableau is definitely still in the desktop app market |
| 18:46.17 | jfindlay | but clouding it along in synchronization with the rest of the microsoft penumbra |
| 19:23.51 | *** join/#utah tiwula (~lane@70.89.246.241-Busname-UT.hfc.comcastbusiness.net) |
| 19:45.02 | *** join/#utah youtah (~youtah@67.139.187.132) |
| 19:45.05 | youtah | OMG eightyeight !!! |
| 19:45.06 | youtah | lol |
| 19:45.25 | eightyeight | what |
| 19:45.26 | youtah | I have the Reputation Manager for B&H Photo on Twitter telling me that Password Length doesn't matter! |
| 19:45.33 | eightyeight | link? |
| 19:45.46 | youtah | https://twitter.com/h_posner/status/1108086367043702787 |
| 19:49.34 | youtah | I think my reply was nice: https://twitter.com/youtah/status/1108093133365993472 |
| 19:52.09 | romanovic | nice. |
| 19:53.59 | jfindlay | https://www.xkcd.com/221/ |
| 19:54.07 | romanovic | I want to know how this misinformation persists? how can admins say things like "Complexity too is more important than length" when you can show them real numbers? |
| 19:54.41 | romanovic | A 16-character password with alphanumeric only is far more secure than a 14-character password that uses all the special characters? |
| 19:55.27 | eightyeight | alphanumeric = [a-zA-z0-9] or [a-z0-9]? |
| 19:56.06 | eightyeight | er [[:upper:][:lower:][:digit:]] vs [[:lower:][:digit:]] |
| 19:56.16 | romanovic | in my example, I was estimating the first pattern, but i suspect even with the second pattern it only takes a small number of additional characters to make it more secure? |
| 19:56.42 | romanovic | you would know better than I do |
| 19:56.48 | eightyeight | ok. so log2(62^16) ~= 95-bits |
| 19:57.05 | eightyeight | psecial characters = [[:punct:]] ? |
| 19:58.01 | romanovic | yeah |
| 20:00.17 | romanovic | i count 94 with +, /`~!@#$%^&*()-_=;:'",<.>? |
| 20:00.19 | eightyeight | assuming graphical |
| 20:00.23 | eightyeight | not printable |
| 20:00.27 | eightyeight | IE: ignore whitespace |
| 20:01.07 | eightyeight | `~!@#$%^&*(){}[]/=\?+|-;: |
| 20:01.18 | eightyeight | 26 total |
| 20:01.23 | youtah | Either way, when he replied, I was like |
| 20:01.29 | youtah | WHERE'S eightyeight !!!!!!1 |
| 20:01.34 | youtah | AHGHHHHHGGGGGGGHHHHHHHHH |
| 20:01.43 | eightyeight | log2(26^14) ~= 65 bits |
| 20:01.53 | eightyeight | a touch weak, but sufficient |
| 20:02.37 | youtah | Someone hurry and sign up for a B&H Photo Account |
| 20:02.42 | youtah | so we can see what the minimum is |
| 20:02.45 | youtah | I can't remember |
| 20:03.58 | eightyeight | IMNSHO, you want to target 70-bits, but you don't want to drop beneath 55 bits |
| 20:04.21 | eightyeight | consider a randomized 8-character graphical ASCII password |
| 20:04.33 | youtah | I think, IIRC, it was 8-15 |
| 20:04.44 | eightyeight | log2(94^8) ~= 52-bits |
| 20:05.05 | eightyeight | it's closer to 52.4367. so for shits-n-giggles, assume 53-bits |
| 20:05.18 | eightyeight | 2^53 = 900,719,925,4740,992 |
| 20:05.46 | youtah | I also still find it funny that they have a dedicated "online reputation manager" |
| 20:06.01 | youtah | "So what do you do for work?" |
| 20:06.05 | eightyeight | assume it's hashed with a single pass of MD5 |
| 20:06.07 | youtah | "Oh, I pick fights on the internet" |
| 20:06.28 | eightyeight | according to https://gist.github.com/epixoip/ace60d09981be09544fdd35005051505, 8x Nividia GTX 1080 Ti GPUs can hash 307,200,000,000 passwords with MD5 per second |
| 20:06.50 | youtah | 9,007,199,254,740,992 |
| 20:06.56 | youtah | comma was slightly off |
| 20:07.01 | eightyeight | er, yeah |
| 20:07.03 | eightyeight | thx |
| 20:07.06 | youtah | so we're looking at minutes |
| 20:07.16 | eightyeight | regardless 9,007,199,254,740,992/307,200,000,000 ~= 29,320 |
| 20:07.33 | eightyeight | 29,320 seconds is about 8 hours |
| 20:07.35 | youtah | nm |
| 20:07.36 | youtah | lol |
| 20:07.42 | youtah | still insanely fast |
| 20:07.46 | eightyeight | so that cluster can clear out 53-bits of entropy during a shift at work |
| 20:07.57 | youtah | Well, and that doesn't take into account collisions |
| 20:08.46 | eightyeight | 55-bits takes about a day-and-a-half using that same cluster |
| 20:09.16 | eightyeight | 56-bits 3 days. 57-bits 6 days. 58-bits 12 days. 59-bits 24 days. 60-bits 48 days. etc. |
| 20:09.32 | eightyeight | this is for 100% exhaustion |
| 20:09.45 | eightyeight | you only need to clean out 50% to have the odds in your favor that you'll find it |
| 20:09.49 | eightyeight | so divide that work by 1/2 |
| 20:09.54 | eightyeight | er, multiply it by 1/2 |
| 20:09.56 | eightyeight | anyway |
| 20:09.58 | eightyeight | you get the idea |
| 20:10.20 | *** join/#utah keldwud (~keldwud@199.192.164.75) |
| 20:10.20 | *** join/#utah keldwud (~keldwud@unaffiliated/keldwud) |
| 20:26.54 | *** join/#utah josephscott (~josephsco@74.114.153.251) |
| 20:28.57 | jfindlay | forcing the brutes |
| 20:42.59 | jlp_znc | don't forget, youtah, that when you tell lastpass that at least two characters in your password must be numeric you have *reduced* the entropy and made your password less secure. |
| 20:43.43 | eightyeight | https://twitter.com/AaronToponce/status/1108095688275968000 |
| 20:44.52 | jfindlay | eightyeight: when password cracking, are there cracking methods and/or password obfuscation systems that allow for confirmation of partial crack? |
| 20:45.19 | jfindlay | wheel of fortune cracking? |
| 20:45.42 | eightyeight | not that i know of, if it's using a cryptographically secure hashing function |
| 20:46.27 | jfindlay | so would that be considered a vulnerability? |
| 20:47.31 | eightyeight | yeah |
| 20:48.15 | eightyeight | imagine if your password was "iLoveYou" and someone else's was "iLoveDan", and it succeeded on "iLove" |
| 20:48.51 | jfindlay | are there methods that can reduce the password space without taking advantage of unintended weaknesses in the encryption model/implementation used? |
| 20:49.14 | eightyeight | password cracking is all about lowest-hanging-fruit |
| 20:49.25 | eightyeight | it's going to be dictionary attacks primarily |
| 20:51.04 | jfindlay | right, I'm just interested in any academic work, however trivial or peripheral that could provably guarantee an optimization |
| 20:51.19 | eightyeight | if you know the structure a company requires out of its users for passwords, you can use that pattern in hashcat as an upperhand, rather than blindly guessing |
| 20:51.53 | eightyeight | like, if you're cracking, and patterns start dropping out, like "always a number, and always a special character", then you could use that to fine tune your approach |
| 20:52.24 | eightyeight | https://hashcat.net/wiki/#core_attack_modes |
| 20:52.36 | youtah | All of my co-workers are loving/reading the thread eightyeight |
| 20:52.41 | jfindlay | is there a way to crack the size of the password before knowing what it is? |
| 20:52.49 | eightyeight | youtah: nice |
| 20:52.52 | eightyeight | jfindlay: what do you mean? |
| 20:53.37 | jfindlay | eightyeight: can you find out that `len(pw) == 25` before learning that `pw == 'correcthorsebatterystaple'`? |
| 20:54.01 | eightyeight | not if it's hashed with a cryptographically secure hashing function |
| 20:54.04 | jfindlay | where 25 means 25 bytes |
| 20:54.15 | eightyeight | maybe if the length was stored in the db? but what would be the point of that? |
| 20:55.09 | jfindlay | so this all depends on the quality of the hash, which depends on the quality of entropy available at the time of hash |
| 20:55.31 | eightyeight | the hash itself shouldn't reveal anything about the message that was hashed |
| 20:55.51 | eightyeight | so the whole point of password cracking is exploiting the weakness in humans to create passwords |
| 20:55.59 | eightyeight | because the hash itself isn't going to help any |
| 20:56.25 | eightyeight | so you're going to have at your disposal, massive rainbow tables and many dictionaries |
| 20:56.36 | jfindlay | I comprehend, but also find that pragmatism less interesting :-) |
| 20:56.44 | eightyeight | and then you're going to hope and pray to dobbs it's not hashed with bcrypt, scrypt, or argon2 |
| 21:02.12 | jfindlay | how big is a typical hash set: what is the worst case brute force irrespective of actual password size? |
| 21:04.33 | jfindlay | ~brain |
| 21:04.33 | infobot | brain are you pondering what I'm pondering? |
| 21:04.44 | jfindlay | ~pondering |
| 21:04.44 | infobot | Uh, I think so, Brain, but we'll never get a monkey to use dental floss. |
| 21:04.50 | eightyeight | https://canhdx.wordpress.com/2015/09/15/how-password/ might be of interest |
| 21:06.26 | youtah | eightyeight, I really want the guy to respond |
| 21:06.28 | youtah | but he hasn't yet |
| 21:07.43 | eightyeight | yeah, i'm not holding my breath. heh. |
| 21:09.21 | jlp_znc | yeah, he's not going to |
| 21:17.35 | jfindlay | I'm just wondering about if you're concerned with finding the matching hash, rather than the password that creates it, how long would it take you to cover the entire hash space |
| 21:18.20 | jfindlay | I'm guessing that a good password is going to have the same order as the hash set itself |
| 21:18.50 | eightyeight | right |
| 21:19.13 | eightyeight | if you have the hash, then finding a message that matches it, is a preimage attack |
| 21:19.15 | jfindlay | man, I'm really missing the maths |
| 21:19.19 | eightyeight | and even MD5 is secure there |
| 21:19.47 | eightyeight | MD5 is a 128-bit hashing function, so you would need to exhaust 2^127 possible inputs before you've exhausted 1/2 the search space |
| 21:21.33 | eightyeight | if you don't care about the output, and you just want to find 2+ inputs that collide to the same output, then MD5 and SHA-1 are both broken here |
| 21:21.39 | eightyeight | but that's just blind collision searching |
| 21:21.53 | eightyeight | if you have a hash, and want to find an input that matches it, that's a preimage |
| 21:22.08 | eightyeight | if you have a hash, and the input, but want to find a second input that matches your hash, that's a second preimage attack |
| 21:22.32 | eightyeight | MD5 and SHA-1 are broken in blind collision searching (not caring what the output is, so long as two inputs collide) |
| 21:22.43 | eightyeight | but they are also both secure against preimage and second preimage attacks |
| 21:22.53 | eightyeight | which is where password cracking is happening |
| 21:22.59 | jfindlay | but for any hash algorithm, if the input size is arbitrary, you're going to have arbitrary collisions |
| 21:23.08 | eightyeight | sure |
| 21:23.17 | eightyeight | that doesn't mean they're easy to find |
| 21:23.22 | eightyeight | just that they exist |
| 21:24.12 | jfindlay | so by broken, you mean there's a known optimization to find a collision with O better than brute force |
| 21:24.42 | eightyeight | by broken, i mean it's practical to find MD5(m1) = MD5(m2) |
| 21:24.49 | eightyeight | or SHA-1(m1) = SHA-1(m2) |
| 21:25.39 | eightyeight | it is only theoretical currently to find SHA-256(m1) = SHA-256(m2) |
| 21:26.57 | jfindlay | well, if you're mapping any set to a smaller set, you're going to have collisions |
| 21:27.14 | eightyeight | yeah. that's not up for debate. it's how difficult it is to find them. |
| 21:28.14 | jfindlay | I wish I had more free time do the maths |
| 21:28.54 | eightyeight | for SHA-256, for example, the range is 2^256 possibilities |
| 21:29.22 | jfindlay | one of the topics I want to research more in the number theory area is https://en.wikipedia.org/wiki/General_number_field_sieve |
| 21:29.22 | eightyeight | can you find two distinct messages, that when hashed with SHA-256, map to the same output? |
| 21:29.36 | eightyeight | currently, the answer is only theoretically yes, due to the pigeon hole principle |
| 21:30.03 | eightyeight | but the answer is no in practical terms. SHA-256 is considered cryptographically secure so long as this holds |
| 21:30.34 | jfindlay | eightyeight: do you not imply in the question: 'can you find the distinct messages in the general case at order better than worst case (brute force)'? |
| 21:31.02 | eightyeight | ah, yes |
| 21:31.03 | eightyeight | so |
| 21:31.08 | jfindlay | and having such an optimization means the algorithm is 'broken' in terms of collisions |
| 21:31.52 | eightyeight | yeah. the trick is finding an approach faster than brute force, inded |
| 21:32.16 | eightyeight | so far, for SHA-256, there is no such approach for the full rounds |
| 21:32.19 | eightyeight | only on reduced rounds |
| 21:32.28 | eightyeight | and the amount of CPU and RAM necessary to make it possible |
| 21:32.35 | eightyeight | see https://en.wikipedia.org/wiki/SHA-2#Cryptanalysis_and_validation |
| 21:33.04 | jfindlay | so a good hashing algorithm means, that for all the obfuscation services it provides, guessing the result is ~ O(brute force) |
| 21:33.15 | eightyeight | yes |
| 21:33.44 | jfindlay | CPU ~= O_time and RAM ~= O_space |
| 21:35.24 | eightyeight | on the full rounds, yes |
| 21:40.17 | *** join/#utah th3ph3d (sid300152@gateway/web/irccloud.com/x-tzsaltnfxkgrghon) |
| 21:40.26 | *** join/#utah MikeDawg (~mikedawg@unaffiliated/mikedawg) |
| 21:40.35 | th3ph3d | waves |
| 21:41.32 | jfindlay | ~trump th3ph3d |
| 21:41.32 | infobot | ACTION deports th3ph3d |
| 21:41.39 | jfindlay | ~hillary eightyeight |
| 21:41.39 | infobot | ACTION hides a scandal from eightyeight |
| 21:41.48 | keldwud | y'all missed the password cracking discussion |
| 21:42.03 | eightyeight | (â¯Â°â¡Â°ï¼â¯ï¸µ â»ââ» |
| 21:42.04 | jfindlay | ~md5 keldwud |
| 21:42.44 | MikeDawg | keldwud: At least give me a little of the flavor |
| 21:42.52 | th3ph3d | ~help |
| 21:43.03 | keldwud | https://pastebin.com/189eHmF7 |
| 21:43.08 | keldwud | MikeDawg ^ |
| 21:43.10 | jfindlay | ~logs |
| 21:43.10 | infobot | All conversations are logged to http://infobot.rikers.org/%23utah/ Lines starting with spaces are not logged. Logs are updated daily. |
| 21:43.20 | keldwud | oh yeah that's even better! |
| 21:43.31 | MikeDawg | Wow, I dig it. |
| 21:43.41 | keldwud | the last 40 minutes or so |
| 21:43.48 | th3ph3d | <PROTECTED> |
| 21:44.01 | keldwud | sorry to brigade guys, thought some people would be interested in the discussion |
| 21:44.03 | eightyeight | ~bcrypt jfindlay |
| 21:44.15 | jfindlay | hunter2 |
| 21:45.46 | MikeDawg | So, is SHA-1 seeing any collisions in the real world? Or has it all been in the lab-space? |
| 21:46.49 | eightyeight | MikeDawg: https://shattered.io/ |
| 21:47.37 | MikeDawg | I would say that is legit. |
| 22:17.32 | jlp_znc | jfindlay, why do I see just stars? |
| 22:19.35 | youtah | https://www.cnn.com/2019/03/19/world/karen-uhlenbeck-abel-prize-mathematics-trnd/index.html |
| 22:20.02 | youtah | "Karen Uhlenbeck, a mathematician and professor at the University of Texas, has been awarded this year's Abel Prize, a mathematics prize modeled after the Nobels. It's the first time the prize has gone to a woman." |
| 22:20.34 | eightyeight | sweet |
| 22:21.14 | youtah | my reaction as well |
| 22:28.11 | youtah | https://www.technologyreview.com/s/603337/a-100-drone-swarm-dropped-from-jets-plans-its-own-moves/ |
| 22:28.21 | youtah | This has to be one of the most crazy cool things I have seen in a long time. Make sure to watch the ENTIRE video, with sound. The buzzing of the swarm as they track and follow their subjects is crazy. |
| 22:29.30 | youtah | Wait |
| 22:29.35 | youtah | jlp_znc, you an op in here? |
| 22:44.07 | MikeDawg | I would normally make a joke about Karen's but Karen Uhlenbeck is too awesome to be bothered with that. |
| 22:44.12 | jfindlay | prizes are anathema to real scientific work |
| 22:44.14 | jlp_znc | youtah: apparently so |
| 22:46.11 | jfindlay | believing that the abel/nobel prize is going to signify the most important work in a field is like believing that the most coveted universities graduate only the most meritorious |
| 22:48.51 | MikeDawg | jfindlay: You convinced me, I've now changed my mind. Karen is now just another Karen. |
| 22:48.57 | MikeDawg | MISSION ACCOMPLISHED! |
| 22:49.00 | jfindlay | sweet |
| 22:49.18 | shalkie | youtah: That is creepy as hell. |
| 22:55.16 | romanovic | it's like they provide their own high-pitched violin-like disaster soundtrack. |
| 23:53.59 | shalkie | New business idea: Killer Sounds, because a thoughtful killer will provide a soundtrack to heighten the experience for their intended. Get your Killer Sound _today_! |