What's wrong with WannaCry? All it does is secure you're system by encrypting your files for you.

Fucking awesome. The 'encryption backdoor law' in Australia went through!

Now, whenever served with such warrants, companies which are active in Australia will have to pay hefty fines if they don't give encrypted messages to law enforcement in readable form. No matter whether this means just decrypting it with the keys they have or pushing backdoors/inject code into the messaging apps/services in order to extract the contents.

Now let's see how much the big companies really care about their users! (I'd expect them to pull out of Australia but the chance that this'll happen is as tiny as about nothing)

Encryption

Another attempt at trying to get support for weakening encryption recently.

An FBI spokesperson said something like 'we can put people on the moon, why can't we just create law enforcement-accessible encryption? i just don't buy it."

Fuck off and die.

Dance like no one else is watching. Encrypt like everyone is.

Using Base64 "encryption" to store credit card numbers and passwords

When the "lost password" feature of a website sends you an email with your original password :/

When I was in my second semester of college I was tasked with creating a file encrypt/decrypt program. Take in normal textfiles and spit out a new random text and symbols file. I worked on it for two weeks and read up on all different encryption types and stuff. I was so excited when it was done. After it was done compiling I tried it out on its own source code. Encrypto.c and named the output file Encrypto.c 😰 The next thing I did was google " best version control and how to use it."

Holy fuck, muscle memory just saved my ass.

At a train station wanting to do some work on my mini laptop which has disk encryption (LUKS I think). Realised that I forgot the password partly 😬

Few tries.... incorrect. FUCK.

*hey, let's try to let my hands do the work based on muscle memory!*

*starts typing the password (its insanely long) and presses enter*

*succesfully unlocked, booting...*

😅

Dance like no one's watching. Encrypt like everyone is.

"Perl – The only language that looks the same before and after RSA encryption." - Keith Bostic

Story time:

I was once working on a project that dealt with incredibly sensitive financial data.

We needed a client’s database to do a migration.

They wouldn’t send it over the internet because it was too big and they didn’t think it would be secure.

They opt to send it in the post on an encrypted usb drive.

(Fair enough thinks I)

USB drive arrives.
Is indeed encrypted.

MFW there’s a post it note in the envelope with the password on.

MFW this is a billion dollar multinational petrochem company.

MFW this same company’s ‘sysadmin’ and ‘dba’ once complained because a SQL script I sent them didn’t work - they’d pasted it twice and couldn’t work this out from the fucking “table already created” error message management studio was throwing at them.

Bad handwriting is the most effective encryption

Had three servers running in prod. For extra security all of them were encrypted (hdd encryption) just in case.
"mate, servers need a quick reboot, that alright?"
Me: yeah sure!
"oh hey they're encrypted, what's the password?"
Uhm.....
😐
😓
😨
😵😨😮😧😫
😲😶😭

Yeah, i also forgot to turn on the backup process...

Facebook publicly announced that it won't build a backdoor into its services for the intelligence agencies as for the latest requests to weaken/remove the encryption.

I can only imagine the intelligence agencies going like this now:

NSA director: Alright, as expected they said no so they won't have more damage to their public image, lets go for plan A 2.0!
NSA employee: Aaaand that is?
NSA director: Serve them a FISA court order requiring them to do this shit anyways but also serve a gag order so they can't tell legally.
NSA employee: Ahh, fair enough, I'll get that rolling. By the way, how did we do this with WhatsApp's encryption again?
NSA director: Oh that one was simple. There's a backup function which nearly everyone uses on either Android/iOS which does plaintext backups to Google Drive/iCloud.
NSA employee: Oh, okay. How do we access that data again?
NSA director: PRISM/XKeyScore!
NSA employee: Right, but then still the issue of how we even collect the encrypted messages from Facebo...
NSA director: PRISM/XKeyScore as well, don't worry about that.
NSA employee: But, how'd we justify this....?
NSA director: We probably never have to as these programs operate outside of the public view but otherwise just call terrorism/pedophelia... BAM, done.
NSA employee: Gotya, let's put this into motion!

Having a private conversation over WhatsApp these days...

So I work in IT for the police. I just received an "unneeded" encrypted smartphone.

I had to reconfigure it, in order to give it to the next policeman. Unfortunately nobody knew the password and there is actually no way to reset this damn thing.Trust me, i did my research.

About 2 days later i receive an angry call by the policeman that should be using the phone by now.

Policemen: "Why is my phone not ready yet?"
Me: "it's encrypted and nobody has the password."
Policemen: "Well just ask the previous owner then!"
Me:"It's a little difficult..."
Policemen: "Why?!?"
Me: "He shot himself."

a picture worth thousand words

> Claims to be a security expert and an Anonymous member

> His router uses WEP as encryption

*me, coding at a pub*
*random dude walks up to me*
He: "what are you doing? Programming? What?"
Me: "yup. That's a horizontally and vertically scalable webservice, that's using amqp, rest APIs and encryption to schedule starting, stopping and autoscaling of a total of 90 heroku applications. This webinterface *showing* allows you to trigger starts and stops manually and monitor all processes."
He: "oh, so you are programming a Website? In HTML?"
Me: "euhm........ Yes."

I understand this dude had probably no clue what I was talking about.. Yet I am angry at him. Reducing more than 12k loc to HTML... Go fuck yourself.

"Can you give an example of a work-based conflict you were involved in, and how you went about resolving it?"

"Heh, ohhhh yes. Last job actually. Manager flipped out at me for the billionth time for no reason at all. I calmly handed my notice in, changed a bunch of encryption keys and disabled a bunch of users on the server before leaving and never looking back."

"Wow. Seriously?!"

"Absolutely. I'm very forward-looking."

Still no idea if the guy just decided to turn up to the interview to waste our time, or he really was stupid enough to think that was a positive.

Me: "I'm a programmer"

Others: talks about linux
Others: search algorithms!
Others: service infrastructure
Others: memory optimization
Others: encryption

Me: "I'm a front end web developer"

Others: complex services
Others: strong user form validation
Others: lazy loading
Others: SEO

Me: "fucking, I make shit look pretty alright"

Working with a radio chip we selected because it had built-in encryption. Cannot make the encryption work, thus in contact with the manufacturer:
"- I cannot make the encryption work, it's like the chip doesn't want to take a key.
- which key do you use?
- does it matter?
- well yes, you can't just use any key!
- why not?
- you need to get an approved key from us.
- why is that?
- so that your competitors can't read your data!
- ...
- ...
- so the way to get working keys is to get them from you?
- of course!
- keys are 256 bits. Can we potentially use all of them?
- OF COURSE NOT!
- how many can we get from you?
- one! We reserve it from your company.
- are you telling me that all units within a company will need to have the exact same encryption key?
- yes!
- so anyone with our product could eavesdrop another same product?
- well yes, but it's all within your own products.
- ...
- ...
- that's not how encryption is supposed to work.
- but it's safe, your competitors cannot eavesdrop!
- I'm out of here."
(We finally found a satisfactory work-around, but i am still pissed at them)

We've password protected a file and forgot the password we need it cracking asap.

Sorry we can't crack passwords on files.

If we don't get access to the file it'll cost the company up to 250k.

Well you should've thought about that before encrypting the fucking file with 256 bit encryption.

"could you please just use the standard messaging/social networking thingies? That way it'll be way easier to communicate!!"

Oh I don't mind using standard tools/services which everyone uses at all.

Just a few requirement: they don't save information that doesn't need to be saved, leave the users in control of their data (through end to end encryption for example) and aren't integrated in mass surveillance networks.

Aaaaaand all the standard options which everyone uses are gone 😩

My disk isn't corrupted, it's just so secure that even I can't access it

Manager: "The password must be encrypted to store it inside the database."
Me: "Great! No problem."
Manager: "Then it must have a copy of the unencrypted password to send it by email."
😐

A US senator or judge or whatever his title is said today that he wants companies/governments to build a 'responsible encryption' system.

Preferably that would exist out of a big ass database which stores the private keys of citizens so in case a person loses their private key or the government needs access to encrypted content, that is possible.

NOO, WHAT COULD FUCKING POSSIBLY GO WRONG!?!?!

Seriously those kind of people should not be allowed to have the kind of positions they have.

This shit makes me so angry.

So the new mass surveillance law will be going into effect from the 1st of January.

Of course, since I'm very keen on my security/privacy, I'm going to implement some precautions.

- A few vps's connecting to tor, i2p and VPN provider so that I can always use a secure connection.

- Setup anti tracker/ads/etc etc shit on the VPS's. Probably through DnsMasq and the hosts file.

- Use Tor browser by default. I've tried this for a while now and damn, the tor network has become way faster than only even a year ago! Some pages literally only take a few seconds to load.

- Wipe my laptop, encrypt the harddrive and at least put QubesOS on it together with probably a few other systems.

- Ungoogle my new phone, use it with VPN by default.

- Get rid of all non encrypted communication services. I think that only leaves me with a few account removals because I haven't chatted unencrypted for nearly a fucking year now.

If anyone has any more ideas, please share!

That's some serious encryption in android I think.

Got some good news today, Australia's PM (Malcolm Turnbull) doesn't want a backdoor in encryption! All he just wants is "support" from companies to "access" their users encrypted data.

See the difference?

I don't 😒

Project Manager: You used a hash/salt to encrypt the password in our customer database?

Me: Yes.

Project Manager: That's mean we will not be able to see the password?

Me: That's the whole point. Why would you want to see what password customer is choosing?

Project Manager: Change it. Use random encryption method.

Citizens are advised not to use encryption as decrypting data takes too​ much time and is costly.
Please spread awareness and save money.

Thank you for Cooperating, have a nice day :)

I've always wanted to experiment with encryption but never do. This weekend, I'm fucking doing it. Even if I'm just flipping a few bits around, I'm fucking gonna flip those bits like they've never been flipped before and they are gonna FUCKING LIKE IT.

Dear Prof,

One does not simply encrypt the exam tips and give it to the students in a computer security introductory module.

Sincerely,
Disgruntled Undergraduate

> be me
> install linux on encrypted drive
> takes 8 hours to fill the drive with fake data so theres no chance of data leakage
> save encryption password to phone
> phone doesnt actually save password
> realize you dont have access to pc anymore
> cry
> reinstall linux

Tutanota (encrypted email service) has a newly designed interface.

I usually don't give a crap about design.

It's so beautiful 😍

I think I'm in love 😱

Senior C++ developer:
"Writing a custom encryption algorithm from scratch for our communications platform? Every developer knows that is an absolute no go, cryptography should be left to cryptography veterans!"

Same guy, year later:
"Blockchains? Hold my espresso, I can totally write a whitepaper on cryptography, write some shitty code with nice branding, and get millions from an ICO"

"I should really make better offsite backups"

"Right, this service doesn't do client side encryption"

"Oh this one doesn't have a Linux client"

"OK this one only sets up a single directory you can dump shit into"

"Wtf this one charges more than a high class escort girl"

Whatever... I'm sure my house won't burn down.

Pure marketing bullshit.

Had to give a 15 min presentation on web development. I somehow turned it into me giving a 1 hour lecture on ssl and end to end encryption to a bunch of accounting students 😅

Gotta say, I find it awesome that I can connect with some devRanters through encrypted channels.

It's awesome to talk to devRanters with the same mindset through channels that offer a very high level of security/privacy.

Thanks!

Me: *Has 3 difficult exams to study for and hours of work*

Also me: I should try my hand at encryption in Python.

10 years ago, I found a vulnerability in the connection between an insurer I was working for, and the network of databases of municipalities. I was only a hacker in so far as kids who watched Hak5 are considered hackers, so I always carried this laptop with a fake access point, package sniffer, wep crack, sslstrip, etc with me.

The vulnerabilities allowed me to register a new identity, for which I requested a passport.

Walking up to the town hall desk with two passports with different names, both mine, was pretty cool.

I did not do anything malicious, and was hired to fix the issues (wep encryption on insurers trusted wifi, and municipality postgres gave write access to all third parties)

For a few days I was the coolest kid in school though!

So... Facebook just stated that they plan on loosening up the End-to-end encryption in WhatsApp to analyze the messages and show user-specific advertisements.

Time to uninstall WhatsApp I guess!

"Just use MD5 encryption"

One of my favourite, encryption puzzles is this:

ITuyVT93oUZtLKWyVT5iqPO3nTS0VUEbMKxtp2IyoD==

Answer is plain text string in english. Good luck, post solution in the comments!

Had a discussion with a developer about security. His software transfers all user data (password and files) unencrypted, so anyone can grab them with wireshark. I told him that this is a severe issue. He said no its no problem because if you get hacked its your own fault, because you probably used an insecure network. NO ! YOU FUCKING MALADJUSTED SHEEP-MOLESTING OBJECT OF EXECRATION, YOU SHOULD ALWAYS ENCRYPT SENSITIVE USERDATA NO MATTER WHAT NETWORK YOU USE. FUCKING KILL ME ALREADY.
Not implementing encryption is one thing but then acting like its no problem is a fucking nother one. Why do people not understand that security of userdata is important???

After seeing this app on the play store, I've officially lost faith in humanity.

Setting up my new second hand thinkpad with Linux Mint KDE.

I just chose for harddisk encryption.

My password is so freaking long and complicated and I didn't write it down so let's start learning this fucker out of my head 😅

Downloaded Kubuntu because i couldn't seen to be able to boot from a freshly created KDE Neon bootable usb.

Installed it onto my netbook (Lenovo Thinkpad X121E) and it worked great!

But just the fact that somehow the installer froze when trying to setup hdd encryption kept bugging me.

Took a random flash drive which was laying around and put it in to see what would happen. KDE Neon booted just like this and everything worked very well with hdd encryption.

I now have a very secure netbook 😊

Soooo my little encryption tool makes progress. <3

After a short break from development, we had our first successful loaded container yesterday!

This means:
- Protocoll is working
- We can create containers and store/copress files in it
- we're awesome
- I love it
- you are awesome, too!

(Loaded containers will be inaccessible for movement to different directories while our tool is open)

Boy, sure wish I knew about this before putting all of my passwords into lastpass. This looks way more secure. Handwriting in English is pretty much as good as encryption.

Base64 "encryption"

Paranoid Developers - It's a long one
Backstory: I was a freelance web developer when I managed to land a place on a cyber security program with who I consider to be the world leaders in the field (details deliberately withheld; who's paranoid now?). Other than the basic security practices of web dev, my experience with Cyber was limited to the OU introduction course, so I was wholly unprepared for the level of, occasionally hysterical, paranoia that my fellow cohort seemed to perpetually live in. The following is a collection of stories from several of these people, because if I only wrote about one they would accuse me of providing too much data allowing an attacker to aggregate and steal their identity. They do use devrant so if you're reading this, know that I love you and that something is wrong with you.

That time when...

He wrote a social media network with end-to-end encryption before it was cool.

He wrote custom 64kb encryption for his academic HDD.

He removed the 3 HDD from his desktop and stored them in a safe, whenever he left the house.

He set up a pfsense virtualbox with a firewall policy to block the port the student monitoring software used (effectively rendering it useless and definitely in breach of the IT policy).

He used only hashes of passwords as passwords (which isn't actually good).

He kept a drill on the desk ready to destroy his HDD at a moments notice.

He started developing a device to drill through his HDD when he pushed a button. May or may not have finished it.

He set up a new email account for each individual online service.

He hosted a website from his own home server so he didn't have to host the files elsewhere (which is just awful for home network security).

He unplugged the home router and began scanning his devices and manually searching through the process list when his music stopped playing on the laptop several times (turns out he had a wobbly spacebar and the shaking washing machine provided enough jittering for a button press).

He brought his own privacy screen to work (remember, this is a security place, with like background checks and all sorts).

He gave his C programming coursework (a simple messaging program) 2048 bit encryption, which was not required.

He wrote a custom encryption for his other C programming coursework as well as writing out the enigma encryption because there was no library, again not required.

He bought a burner phone to visit the capital city.

He bought a burner phone whenever he left his hometown come to think of it.

He bought a smartphone online, wiped it and installed new firmware (it was Chinese; I'm not saying anything about the Chinese, you're the one thinking it).

He bought a smartphone and installed Kali Linux NetHunter so he could test WiFi networks he connected to before using them on his personal device.

(You might be noticing it's all he's. Maybe it is, maybe it isn't).

He ate a sim card.

He brought a balaclava to pentesting training (it was pretty meme).

He printed out his source code as a manual read-only method.

He made a rule on his academic email to block incoming mail from the academic body (to be fair this is a good spam policy).

He withdraws money from a different cashpoint everytime to avoid patterns in his behaviour (the irony).

He reported someone for hacking the centre's network when they built their own website for practice using XAMMP.

I'm going to stop there. I could tell you so many more stories about these guys, some about them being paranoid and some about the stupid antics Cyber Security and Information Assurance students get up to. Well done for making it this far. Hope you enjoyed it.

Just saw this in the code I'm reviewing:

function encryptOTP(otp){
var enc = MD5(otp);
return enc;
}

PM ordered me to not use encryption for customer authentication links because we want to be able so send same link if the user loose it. "we have to prioritize usability over security". At least I can tell future hackers it's not my fault..

I love how the Keybase Linux client installs itself straight into /keybase. Unix directory structure guidelines? Oh no, those don't apply to us. And after uninstalling the application they don't even remove the directory. Leaving dirt and not even having the courtesy to clean it up. Their engineers sure are one of a kind.

Also, remember that EFAIL case? I received an email from them at the time, stating some stuff that was about as consistent as their respect for Unix directory structure guidelines. Overtyping straight from said email here:

[…] and our filesystem all do not use PGP.
> whatever that means.

The only time you'll ever use PGP encryption in Keybase is when you're sitting there thinking "Oh, I really want to use legacy PGP encryption."
> Legacy encryption.. yeah right. Just as legacy as Vim is, isn't it?

You have PGP as part of your cryptographic identity.
> OH REALLY?! NO SHIT!!! I ACTIVELY USED 3 OS'S AND FAILED ON 2 BECAUSE OF YOUR SHITTY CLIENT, JUST TO UPLOAD MY FUCKING PUBLIC KEY!!!

You'll want to remove your PGP key from your Keybase identity.
> Hmm, yeah you might want to do so. Not because EFAIL or anything, just because Keybase clearly is a total failure on all levels.

Written quickly,
the Keybase team
> Well that's fucking clear. Could've taken some time to think before hitting "Send" though.

Don't get me wrong, I love the initiatives like this with all my heart, and greatly encourage secure messaging that leverages PGP. But when the implementation sucks this much, I start to ask myself questions about whether I should really trust this thing with my private conversations. Luckily I refrained from uploading my private key to their servers, otherwise I would've been really fucked.

On the presentation for my database project my team and I showed a NodeJS + Mongo + VueJS project with cloud storage capability, nothing fancy but did everything from scratch (from token auth and system encryption to the frontend CSS and the database) the teacher made some questions and meh'd at it.

Behold team two's project, WordPress with a standard template and phpMyAdmin, teacher loves it because "it's so beautiful"

Guess who just failed that class?

God I love college, it's the best time investment I've ever done and it'll surely pay out.

I found this in the code of a non-adult video portal...

Why would they need AES encryption for a pornhub grabber?

So we send a quote out to a client to update his website to make it compliant with the new privacy guidelines: SSL encryption, removing external libraries, removing Facebook Plug-ins, all that stuff. We didn't get a response.

On Monday, he called in a panic. "The website does not work, fix immediately!"

I check out the server, what do I see? An SSL cert installed the Friday before... Client decided to do it himself, on a Friday, without testing. He broke something, but cannot tell me exactly what he did.

And somehow he thinks all that is my fault :D

"Why are there so many programming languages? Why don't you guys all just program in binary?" A friend of mine some of you may remember, the same one who decided to select system32 when trying out some encryption software from the internet, and who put a shutdown script in the start up programs

My friend: I think WA. is very secured that's why I use it.
Me:

Just saw a shirt:
"Dance like nobody is watching. Encrypt like everyone is."

lol

Let's Encrypt-- Opinions?

It would seem that Australia just criminalized privacy. The world needs to watch, so this shit isn't repeated elsewhere.

Perl – The only language that looks the same before and after RSA encryption.

Discussed my Internet privacy campaign - Google-free, encryption where possible, didn't even mention VPNs - with 2 people and they've both asked, "why, what are you hiding?"

Clicking "share" on directory in Windows Explorer, digging through config panel, fidgeting with network discovery options, toggling password protection, digging through account management, jumping over a chair 3 times to channel my inner Bill Gates, checking directory permissions, sacrificing 7 virgin unicorns, go into lusrmgr.msc, curse various gods, install CIFS1.0 protocol, reboot computer, disable encryption, checking registry, trying to summon Steve Ballmer using the blood of a bald goat and sweat-scented candles... 5 hours.

Install Ubuntu on spare SSD, mount Windows NTFS drive, start SMB daemon and set up samba users... 15 minutes.

Today I was continuing my Ruby script for file encryption.

I added some features like Picture Encryption and Bookmarks.

Then I tried to start it to make sure it doesn't fuck up.

ruby PGCrypt.rb

No changes reflected.

w0t.jpg

Start debugging

Browses SO and DDG like a maniac

Reinstalls Ruby

Guess what happened.

My shell was in the wrong folder and I ran the old testing script.

GRAAAAAHHHH

Using encryption is paranoid

For anyone looking for a quick video conferencing solution, take a look at Jitsi Meet!

Although I'm still unsure about the levels of encryption, it works veeery well!

I enjoyed this little bit of Keybase humour. 😊

Edit: disregard this rant, as it seems I have no idea what I'm talking about

"Filesystems encrypted with 128 bit keys are practically unbreakable with today's technology" - my OS professor.

No, I didn't mishear him saying 1024. He said 128 bits.

And yes, it's the same guy from my previous rant (the one with "Linux is just for hackers")

Update on my quest for encryption!

For the (large number) people that don't know, I want to use encryption for (almost) everything / actually give a shit about internet privacy... And I want it done by 2018.

So.. here is my progress so far:

I have signal
I now have an @tuta.io email.
I have a complex, long password.
I am using blankslate.io instead of Google docs (except for school)
I run important stuff through Tor or a VPN or both
I have a firewall running on Android.

Any more suggestions on what to do or things to change??

(@linuxxx)

Should I actually look into getting a dev job..?

*I have a high school diploma (graduated three years early)
*College dropout (3-4 months, Computer Science - Personal Reasons)
*No prior work experience.
*Good textural communication skills, poor verbal communication skills.
*Currentally unemployed. (NEET :P)

*I have extensive personal experience with Java, and Python. Some Lua. Knowledge of data generation, parsing, Linux, Windows, Terminal(cmd & bash), & Encryption(Ciphers).
*Math, but very little algebra/geometry (though, could easily improve these).
*Work best under preasure.

Remote only.

Think anyone would hire me..?

Procedural customizable data encryption command-line Utility

ROT13 as password encryption *cringes*

My teacher thinks encryption and encoding are same

After working for this company for only a couple years, I was tasked with designing and implementing the entire system for credit card encryption and storage and token management. I got it done, got it working, spent all day Sunday updating our system and updating the encryption on our existing data, then released it.

It wasn't long into Monday before we started getting calls from our clients not being able to void or credit payments once they had processed. Looking through the logs, I found the problem was tokens were getting crossed between companies, resulting in the wrong companies getting the wrong tokens. I was terrified. Fortunately I had including safe guards tying each token to a specific company, so they were not able to process the wrong cards. We fixed it that night.

"Ultron brings to you the best in security and encryption, directly taken from IE 5.5."

*screams internally*

Was just thinking of building a command line tool's to ease development of some of my games assets (Just packing them all together) and seeing as I want to use gamemaker studio 2 thought that my obsession with JSON would be perfect for use with it's ds_map functions so lets start understanding the backend of these functions to tie them with my CL tool...

*See's ds_map_secure_save*

Oh this might be helpful, easily save a data structure with decent encryption...

*Looks at saved output and starts noticing some patterns*

Hmm, this looks kinda familiar... Hmmm using UTF-8, always ends with =, seems to always have 8 random numbers at the start.. almost like padding... Wait... this is just base64!

Now yoyogames, I understand encryption can be hard but calling base64 'secure' is like me flopping my knob on the table and calling it a subtle flirt...

One day, I spoke to my team which yubi or nitro key to get.

Senior (s) : but what do you need it for?
Me (m) : for encryption. And securing our password managers. Stuff, I guess.
S : encryption is not gonna be a thing. It hasn't and it won't.
M : *leaves*

I've been so baffled I couldn't cope with the situation.
A few weeks later I left the company. There were too many of such people and those products.

Today I continued working on my File Encryption Frontend, nothing functional, yet!

The icons are selfmade, I think at least the folder icon is pretty.

Our programm will have something like a Zip-Explorer feeling too it, but our aim is still encrypting files to the unbreakable point.

Guys Quick Question 2 :

Should I Dance like no one is watching
and Encrypt like everyone is ?

Or do the opposite ?

Not dev related but still a rant:

My company decided that all the network traffic should go throu a virus scanner. But they don't know what the fuck they are doing, so now EVERY valid SSL cert gets rejected by our browsers because the virus-scanner breaks the SSL encryption.

Anyone open for a pishing attack?

Its really a great fucking time to be alive on linux. Not only freesync is there in latest kernel but hybernation encryption is going to be a thing. This is fucking amazing.

Keep it up guys. LETS SHOW WINDOWS THAT WE CAN DO MUCH BETTER.
Oh wait we already did few years ago LOOOOL

A Bank Account Number is like a public encryption key. Any random person needs it to send me money. Why does it seem like banks treat it as a secret or even use it to confirm my identity? It's literally printed in plain text on every check.

Hello guys and girls!

My company tasked me to do something insane.
Little background info: I'm a trainee, in my first year (of three, even though I will shorten my apprenticeship to two years). I told my trainer that I like encryption in a somewhat private talk.

Now to the insane part. I got tasked to develop a whole security concept ~2 weeks ago to protect our products against industrial espionage. I feel in no way competent enough to achieve this especially because my concepts so far have been dismissed with a 'naaaah. Can't we just do X for now and add the other stuff later?' or 'we can't do that.'
I seriously don't want my name under a concept we would use world wide on our customers pcs which I know has serious flaws.
What should I do? What would you do?

Embedding private encryption key in production javascript file and fetching third party session token client side.

Maybe backing up WhatsApp messages is not such a great idea after all.

Part 6342 of "Stupid things I did as a kid": Generating an SSH key... with an online service. 🙈

God DAMN, abbie’s rant made me so fucking angry, I wanna kick someone

Created an account on Juststickers.
This is the email I get

When i get ask to implement encryption methods in my code

Registered an account with a local pizza business and rated them 5* on Yell moments before checking my email and finding they had emailed me my unencrypted password, GREAT NOW I WON'T BE ABLE TO EAT

Google researchers breaks SHA-1. Next 90 days they will release the code that was used to break this encryption.

Are we fucked?

Today I started coding an encryption algorithm I'm calling Aepples (apples)!! I'll let all of you know how it goes!

Let's teach the class about security. OK *spends 1.5 hr teaching about encryption and practices* OK now students make a login page and just store the passwords in a JavaScript array....... *Facepalm*

When I just started making things in PHP, I always taught that md5 encryption was the best thing out there.. Once I learned that it was the most easy way to break I changed to SHA1. What were I thinking? I now use a custom generated SALT for each user and encrypt with SHA512, should be safe for a while, right?

Some people are using base64 as an encryption method. Well I used to do so too.

doge-cryption, doggo + encryption

High quality encryption technique for email.

What algorithm has been used?

I like this developer!

Fuck it. Today I broke my production server installing the brotli encryption on nginx. -_-

What the fuck sort of help do you call this!?

I finally kicked myself to reinstalling my old 6 years running OS.
Now i installed Arch linux on it with gnome.
All running from HDD with encryption. Ohhhhh yessss.

Ever encrypt files on a USB drive before?

Ever do that then forget the password you used for the encryption?

Yep... 😭

Computer engineering : Insanity!!!

Today a friend of mine was assigned to make a Client-Server Encryption using Sockets. The guy did a great job applying BlowFish algorithm, but the teacher was disappointed because she couldnt map letters to the encrypted text and she declared the program to be wrong!!!

I have a mate who downloaded encryption software that he somehow managed to use to encrypt almost every system file in windows, now the entire thing is fucked, like how can anyone be that stupid? Like before he even did that he tried encrypting the .exe of the encryption software and guess how that went

Someone fucking teach these so called devs the difference between HASHING and ENCRYPTION :/ They are not fucking same.

A website I made years ago, just needed to change the url to be logged in as admin and no encryption

FUCK OPENSSL. I LOVE IT AND HATE IT SO FUCKING MUCH. WORK FASTER AND BE LESS CONFUSING SO I CAN BRAG ABOUT MY PRETTY ENCRYPTION CODE SOONER. FUCK

I made a real working example of elliptic curve encryption without code examples in javascript. I really felt like a badass.

Many people / engineers around me talk about trendy stuff like Cybersecurity or AI and show off what great encryption and neuronal networks they 'have built' ( I would rather say 'using').

I kinda get the feeling of 'Everbody talks about it - no one really knows what's goin' on inside (especially those guys who hate math and even algorithms).'

Am I just stupid or does somebody else here feel the same way? I mean people have been doing serious research about this stuff for years. And currently many kids are coming up with it as if it is easy stuff like the bubble sort.

I saw this image on IBM's blog. The author was explaining how blockchain could be used to implement self sovereign identities. But, isn't the last step wrong? In order to decrypt Alice's message, Bob should use his private key instead of Alice's public key, right? Of course, while encryption Alice has to use Bob's public key.

Had a couple occasions to feel like a badass, recently.
I'm the only programming polyglot on the team. They've been wrestling with an encryption problem. I crack open C, make a few calls to wincrypt (yes, I'm sorry, we're a Windows company) and give them a dll they can call in their IDE. They were stunned by how fast it was.
Last week, my manager asked if I could put together a communications module for our flagship software.
Him: will 3 months be enough time?
On Monday, I had an alpha of the module ready, and a standalone simulator of the module, and a couple different examples of how to communicate with it written out in python.

In my ongoing quest to un-Google my life, I turned off the Whatsapp chat back up, which uses Google Drive. There's a message in that setting which says, "Media and messages you back up are not protected by Whatsapp end-to-end encryption while in Google drive".
Damn.
All my Whatsapp chats for years have been on Google servers in plaintext.
I assumed it uploaded one massive encrypted archive.

Oh, you're encrypting user data
Your boss: write the encryption key on notepad or paper

Encryption, Data, Servers, Protection, Certificate

oOOO WEE, I use big ear old words so I must be a hacker.

When you spend 6 hours figuring out how to best encrypt/decrypt your unimportant website cookies just because you don't want people to see how bad you are at naming stuff :x

I just saw the equalizer 2 at the cinema and about half way through there is a phone with "military grade encryption" on it. We see the phone screen showing the encryption and what is it? Freaking JQuery!

TIL if you know the password for a WIFi SSID, you can replicate it with your hardware. All devices that have credentials for that SSID will connect to yours if your signal is stronger. The encryption just needs to be the same (wpa2/wep) The underlying UUID doesn’t matter.

Not bad for a quick and dirty man-in-the-middle attack. The WiFi spec needs a bit more work.
TLS all the things!

That moment on Devrant that someone thinks your comment is a vigenère, while it actually was some random generated text in my pocket while cycling home.

devRant is awesome! :)

It's been so long without an update on my little encryption project so...

We accomplished the following:
- big fixes and bug fixes
- drag and drop in files and folders
- screwed over many times
... And finally ...
- THEME SUPPORT!! WUHUUU

(Look attached screenshot)

Currently I just implemented two themes but a theme explorer will follow.

I'll create 3 themes for this project, normal, dark and Alice themed.

Stay tuned ✌️

Currently working with @Kreischo and another good friend to create a secured, encoded container to store files in it.

I am currently working on the frontend of things, thinking it's quite beautiful.. (Done with Electron)

Your opinion?

Me: "I'll use my old laptop as a server to access via SSH to do my Docker Tests. I don't wanna use Keyboard and Screen. So, I'll set up Debian Server"

Also me: "Oh, full disk encryption with a preboot Login required. That's such a GOOD idea"

Introducing: Stupid me 🤗

Encryption successful! 😂

A couple of days ago, an individual attempted to convince me that the National Security Agency is capable of cracking Rijndael encryption; as a response, I informed the individual of the infeasible nature of the factoring of extremely large semiprimes; however, my attempts were futile, as the individual believes that NSA possesses sufficient power to crack this encryption without intercepting the transmission of the corresponding private key.
The Dunning-Kruger effect is real; although this individual tends to be logically-minded, there does exist an exception to this good behaviour.

"It is easier to square a circle than get 'round a mathematician."

I have a presentation which takes 10 min and must be about anything relative to computer .
Since the other students are very stupid , I might not choose a very advanced topic ( after thinking about encryption i realized this)
So i need help!

What is your recommandation for the subject?

You know this MD5 encryption?

Me too - especially when saving customer passwords 😂

We can hide messages in images via steganography (or ZIP sewing), we can hide messages in sound via either sound-based transmission (like Morse) or waveform-based transmission (think oscilloscope art videos), we can transmit it in videos in like 300 different fucking combined forms...

Encryption isn't the ONLY way, yo. Social engineering and being a cheeky shithead can get it done too.

Decrypt api responses in an iOS app which my “senior” dev thinks it is more secure to encrypt responses in stead of setting up a proper SSL cert (they use plain http to save money 🙄)

They disable the encryption since it does not function as we wanted and set up SSL instead🙄

2nd year programming professionally I designed, coded, and released a PCI compliant credit card encryption system, including updating all 7 million records (at the time) in our existing database to utilize the new system. By some miracle, it worked with only one small hiccup (see previous rant).

When you do a login encryption using AES, rot13, Base64, rot13...
AES Password is also encrypted using rot13, Base64, rot13.

AND SOMEHOW IT DOESNT WORK FOR EVERYONE.

I cry

An identity platform where you can find each other, get the other's public key and preferred contact method. And the entire key exchange and choice of contact method are negotiated automatically. No vendor lock in, encryption happens on your own device. Effortlessly and securely communicating, no searching for skype name, email, phone number, setting up shit. It would just work.

I just saw this on a website. Good to know that they use some kind of jQuery draggable plugin for encryption.

In an encryption-module, I had a bug, that caused my PC to crash, every time I tried to encrypt something.
Turns out, the loop, that appends
0-Bytes to the string, to make it Block-Cipher compatible,
Had an logical-bug in its exit-condition, that caused it to run infinitely and allocate an infinite amount of memory.

Fucking christ this year is a fucking shitfest:

- wpa2 krack
- "DUHK Attack Lets Hackers Recover Encryption Key Used in VPNs & Web Sessions"
- "Hacker Hijacks CoinHive's DNS to Mine Cryptocurrency Using Thousands of Websites"
- "Bad Rabbit: New Ransomware Attack Rapidly Spreading Across Europe"

My fucking router didn't yet get patched, my fucking phone is outdated and I can't change to my patched one because devrant just shits the bed in extended desktop mode. Windows 8.1 loses support in 3 months, rendering my last chance of using it on my surface pro done, making me use windows 10 with its fucking shit ass not optimized tablet interface. I have just fucking constant paranoia what else could be hacked tomorrow, nothing is fucking safe anymore for fucks sake. I even went as far as implement 3 step auth and intrusion detection on my shitty ass VPS nodes, fucking give me a break you fucking assholes.

CS Teacher today:
"Transport Layer provides Security and Encryption to the communication" (TCP/IP stack)

me: WTF? Encryption is provided on the *top* of the transport layer (aka Application) ( and below [Network Layer] there is IPsec)

Teacher: no, it's wrong.

me: so Wikipedia it's wrong, RFC 5246 is wrong, and you have right?

Teacher: Yes.

me: Ok. (aka fuck you!)

What's wrong with the idea of having a huge computational network like in Watch Dogs to bruteforce encryption ?
I mean suppose having 500 or more million cores , how long does it actually take to bruteforce a 256 bit key ?

Tinfoil hat time!

So, for this scenario we assume a world war has is in full swing, and all communications are either completely out or extremely monitored.

Additionally, no servers can be trusted and no ISPs can be trusted. Even when downloading software you cannot know if the software you got is tampered or not.

You have to send a message to a recipient you cannot physically contact, and you have to make sure him and only him get the message, otherwise nukes are deployed and we all die. The message has to arrive within 3 months or else it's too late.

Is it possible? If yes, how?

Problem:
some folks left the angular codebase full of ridicolous console.logs, client was upset as he noticed it during UAT

Solution:
1. add extra script in main template page
window.console.log = function(){};
2. translate it into JSFuck
3. if they ask, pretend it's a super-secret encryption algorithm to improve security

SecureMessengerAndroid

A chat app that uses AES encryption and doesn't require any personal information like phone number or email address.

Who would be interested in reviewing an old peice of Python code I wrote..? It's a few years old, and it uses basic procedual generation to cypher text (entry, or ASCII files) using a hashed password. It's a command line tool.

I used to brag about how "secure" it was, and now I'm curious if it is secure or not.

I plan on picking it back up and open-sourcing it, but I want to know what problems might be wrong with it now.

In the time I was attempting to learn C++ I was attempting to program an application that encrypted a file. Sounds cool but at the time I had no idea on how encryption worked and it didn’t go well. And didn’t work

!rant

University assignment asks to create some encryption harder to break than Caesar Cypher. So I decided to go online and look for some tips on making a somewhat decent algorithm.

Universal answer: don't do it

😶

Well then, night off I guess 😎

A senior engineer, while talking about adding encryption to the application, mentioned using SHA256 for that purpose.

I want to use the DevRant community for a Unit test.

Inspired by Memento, I will make a tattoo ... but ... I want it encrypted. I know nothing about encryption.

I want to make some encrypted messages and I want you guys to decrypt them.

If I'm gonna put something on my wrist for life, it should be secure

What might replace email in the future?
Email is a very old concept based on a legacy technology and rules. It used to be some tech for g33ks, then it became all serious and all business. People who did not uderstand its flaws adopted it as standard and that was just idiotic back then. Now sysadmins are working hard to make it more secure. I don't care bout tls implementation as every email server has those messages stored in clear text, as encryption is not a default. Most people still find it secure. Just dumb.

So, my network security faculty thinks s/mime is secure multipurpose internet message encryption. And ssh is secure socket header.
Time to leave the class. 😭

So, you have an accessibility problem? Well, now you have a device encryption problem too.

I need to encrypt some large files at rest and then decrypt them immediately prior to processing.

App and files are on a Linux system (CentOS). App is in C. Machine is controlled by a third party.

What encryption libraries would you recommend? And, is there any clever way of managing the decryption key beyond compiling it in the code and doing some basic obfuscation?

Are they fancy obfuscation libraries out there, for example?

And, the reason I'm not going to SO (well, one reason) is that I don't want to have 50 answers that tell me that's it's impossible to 100% protect data on a machine you don't control. This I understand---just looking for "best effort" solution.

In these dark times, it's inspiring to see that a country as insignificant as Australia can demonstrate to us how things can always get worse.

By passing a law mandating that encryption must be broken, in secret (like the US's National Security Letters), at the demand of the Government, the two biggest parties have colluded to destroy Australia's tech sector.

This is the same government that has been whining endlessly about using Huawei LTE equipment in Australian infrastructure "because it might be secretly compromised". Now the same is true of Australian equipment, by law.

My favourite part of all this is how there will be firmware updates for devices sold in Australia, in order to comply with the new law. How well do you think those backdoors will be secured? How thoroughly do you expect them to be tested, given Australia's population of only 25 million?

How can any Australian company expect customers to trust them now?

If you could choose one, what should happen in 2020 :
1. Apple let developer build iOS apps on non Apple machines
2. NPM/Maven/... run 10x faster
3. Javascript dies and gets replaced by a better language
4. Governments stop trying to ruin encryption
5. Facebook splits
6. Quantum computers are being sold for consumer use
7. We have our first high - level generic AI working

Found a new "encryption" mechanism in the DB. It was base64.

Coolest bug is less of a bug and more of a feature. I've been working on a medical app and I used an open source backend which had almost everything I needed. To be hipaa compliant you have to encrypt all sensitive data - full db encryption was not something this backend was capable of.

So my solution was to encrypt the data on the client side and create a secondary server - that can only be accessed on my app server - to store and retrieve the keys.

If anyone's thinking of working on a HIPAA project - you're welcome

I think the fact that even Apple can't unlock your phone if you forget your passcode proves that they use very naive encryption method.

Suppose my data is "Hey This is Some Data" and Passcode is 1234, I could just Jumble this data using that passcode and It will be difficult to decrypt without Passcode. And If data is huge, it will be fairly impossible to do so. But that doesn't make it a good encryption method.

Such encryption, though safe is not practical, Imagine if there was no "Forget Password" Option on any account, I usually forgot my password very often when I was a child.

Apple has been doing such things for years, Using Bad things as a selling point. Apple users are dumb anyways because they don't want to control their phone.

Reset Password is a weak point which might be exploited but in such cases, usability is more important than security. Any service which doesn't allow resetting Password is a shitty service and I would never use such a service, They are too naive.

At the time, I'm working on a simple RAT, for leaning purpose, written I'm Go.
Now simple command-execution work's and I want to implement an encrypted connection between the client and the C&C-Server.
I know Go has some kind of TLS in its standard library, but is it really usable, or would it be easier to just implement my own simple encryption-module with some RSA and AES?

Me: Ok, we'll implement that message tech. But since the clients are servers in that architecture and can't speak IPv6 we've to use a dedicated VPN so the endpoint is able to connect to the servers (clients). Since we have limited network resources we should use VPN cert-encryption and send the actual data plain to save at least some overhead.

Boss: Ok! Let's do it!

Next day.

Boss: Hey! I talked to a guy from that message tech. Their encryption is certified. We should use that instead and get rid of the VPN to save the overhead!

Me: *unable to say a word*

What in "VPN in that architecture is mandatory" is unclear?

Well, I assume we'll kill the architecture then... Fun Time!

They tell me to only review security in the security reviews I'm doing (and if I bring to attention that they're implementing a weak encryption so even though they're not using it at the moment it might cause issues so be careful with that they say to only review security 😵) and then I see this mssql in a where:
AND ISNULL(field, 0) IS NULL
And I think wtf, should I report that? I did and it's a bug and they're thanking me now....
God dammit it's hard to "review security" here...

We needed to generate secret tokens for the app, me being as curious as I am, asked what encryption algorithm they were using, little did I know the the answer would be a random string generator.

Every day further from god.