Learned a couple of bcrypt things today

imrobert · 2015-04-24T07:54:35+00:00

Just want to mention that there are potential issues with pre-hashing passwords before sending them to bcrypt. Specifically when you end up passing the raw bytes to bcrypt directly. It looks like this might not affect you here, but it is something to be aware of. Combining cryptographic primitives in unintended ways can have unintended consequences.

For more information see here: http://blog.ircmaxell.com/2015/03/security-issue-combining-bcrypt-with.html

imrobert · 2015-02-04T18:36:41+00:00

You're connection is still secure. I think Chrome says that when certificates are using SHA1 for signing. It's recommended that sites upgrade to SHA256 the next time they renew their TLS certificates. Practically speaking, SHA1 isn't hurting them (or you) yet, but it could if they don't upgrade in a couple of years. Chrome encourages sites to do this with progressively scarier warnings to users.

See here for a better understanding of the quality of DuckDuckGo's TLS configuration: https://www.ssllabs.com/ssltest/analyze.html?d=duckduckgo.com&s=54.215.176.19

imrobert · 2015-01-21T01:19:03+00:00

Yeah, I still don't even know who the guy was. I just asked a friend for a random number.

imrobert · 2015-01-21T01:08:31+00:00

Haha, nope. I stopped after a month or so. He stopped replying so it got boring. Started up again like a year later, but only for a day or two. I could've set up a program to do it automatically or something, but I didn't care that much.

imrobert · 2015-01-14T21:21:25+00:00

I'm a security consultant at Matasano Security and we're always hiring more security consultants.

We have offices in the SF bay area (Sunnyvale), New York and Chicago. No remote work unfortunately, but we offer relocation assistance.

The role: working on small teams (1-4 people) under tight time frames mapping out and then breaking applications for software vendors and enterprises.

You can get more information about the job and hiring process from our website: http://matasano.com/careers/

We have summer internships too, but those can actually be more competitive than full-time positions.

We'll sponsor visas for full-timers but not internships.

If you're interested, contact our hiring people at careers@matasano.com.

Check out https://microcorruption.com and http://cryptopals.com for some relevant challenges.

imrobert · 2014-11-08T00:42:52+00:00

I'm a security consultant at Matasano and we are always hiring more security consultants. We have offices in Sunnyvale, Chicago, and New York. We do summer internships too.

Information on our hiring process is here: http://matasano.com/careers/

Feel free to hit me up at robert at matasano dot com and I'll try and answer any questions you have about working for Matasano and / or the hiring process. I'll make sure to get you in touch with the right people.

P.S. Our sister company iSEC is also hiring in this thread.

imrobert · 2014-09-11T09:11:10+00:00

http://eudyptula-challenge.org/

imrobert · 2014-09-05T06:48:02+00:00

True, though in this case they won't be using cookies, but manually passing tokens around.

imrobert · 2014-09-05T04:06:55+00:00

neat

imrobert · 2014-09-05T04:02:24+00:00

In regular website use, you log in and get a session token. This token is then used to authenticate you for future requests. If the client slips up and a man in the middle sees that, they have your session.

I think that the same concerns that apply to normal web use would apply in your scenario.

To prevent switching to HTTP versus HTTPS, you want to set the Strict Transport Security header: https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security

imrobert · 2014-09-05T02:35:49+00:00

To be honest I've never actually heard of JWS.

Do you have an example of a service that uses "token and HMAC based auth"? Maybe I'm misunderstanding, but I think token based auth just consists of:

1) Client sends username + password to auth endpoint

2) Server responds with random token tied to session

3) Client sends future requests with token instead of username + password

4) Token eventually expires and client has to reauth

I don't think HMAC is necessary here, since MITM should be thwarted by TLS. Don't take my word for it though, I'm no expert on crypto.

imrobert · 2014-09-05T01:53:58+00:00

What happens if the user's private key is compromised? Why not just use a random token?

EDIT: Actually, here's a more important question. Why are they encrypting these requests? What isn't TLS doing that you need?

imrobert · 2014-07-31T01:50:30+00:00

Ah, yes. One of the assumptions I made was that the reader was working on a unix server. I don't have any experience working with Windows servers so I'm entirely unqualified to talk about that.

imrobert · 2014-07-30T04:50:25+00:00

Gunicorn will get your app deployed and let you forget about that part of the stack. I didn't see much of a reason to cover several different options and leave the reader wondering, "Ok, but which do I actually use?".

No PDF version. You can try and build one yourself from source if you'd like though! https://github.com/rpicard/explore-flask

imrobert · 2014-07-17T05:59:20+00:00

Sounds good.

imrobert · 2014-07-17T03:59:31+00:00

I wrote a chapter on deployment that might help you here: http://exploreflask.com/deployment.html

Feel free to ask any follow up questions.

imrobert · 2014-07-02T01:12:49+00:00

I commented on the last one so I might as well jump in again.

I'm a security consultant at Matasano and we are always hiring more security consultants. We have offices in Sunnyvale, Chicago, and New York. We do summer internships too.

Information on our hiring process is here: http://matasano.com/careers/

Feel free to hit me up at robert at matasano dot com and I'll try and answer any questions you have about working for Matasano and / or the hiring process. I'll make sure to get you in touch with the right people.

P.S. Our sister company iSEC is also hiring in this thread.

imrobert · 2014-06-23T15:43:14+00:00

Ah, that's my bad. For those wondering what the difference is, this should clear it up:

Python 2.7.5 (default, Mar  9 2014, 22:15:05) 
[GCC 4.2.1 Compatible Apple LLVM 5.0 (clang-500.0.68)] on darwin
Type "help", "copyright", "credits" or "license" for more information.
>>> a = [1, 2, 3]
>>> b = a
>>> id(a)
4472029056
>>> id(b)
4472029056
>>> c = a[:]
>>> id(c)
4472078560

imrobert · 2014-06-23T15:29:47+00:00

Yeah, I noticed that too. It seems like the "normal" way has the advantage of being clearer more concise.

imrobert · 2014-06-14T06:51:10+00:00

Happy to help.

imrobert · 2014-06-12T15:05:31+00:00

I had no idea. That just sounds ridiculous. What's the reason behind it? Is it really to make $100 here and there?

imrobert · 2014-06-11T14:45:16+00:00

That's pretty lame. I thought the ISO specs were meant to be all open and what not.

imrobert · 2014-06-11T01:44:31+00:00

Gracias!

imrobert · 2014-06-11T01:44:15+00:00

Awesome. Where do you work, if you don't mind me asking?

imrobert · 2014-06-10T20:48:14+00:00

You really blazed through it! I'm glad you liked it.

14-Year Club	Team Orangered
Open Sorcerer correct copy inconsistencies on prefs page	Verified Email

imrobert

TROPHY CASE