Categories
What I’m Up To

My phone interview

Tap to view at full size.

All dressed up for a 📱 PHONE ☎️ interview. Sure, they won’t know I’m dressed up, but I’LL KNOW.

[See the original Tweet.]

Categories
Hardware Humor

If you thought it was bad when your COMPUTER decides to update while you’re in the middle of something…

Tweet by @robdaemon. Tap to see the source.

…wait until your IoT grill does it.

I need to look up this grill to see what its embedded controller does. Aside from…

  • reporting its current settings and temperature, and
  • some limited ability to control it remotely (very limited, if at all — the computers in IoT devices are cheap and insecure, and attackers can cause all sorts of mischief with a networked propane tank)…

…what else does it do that needs an update, never mind an update big enough to interfere with cooking?

Categories
Reading Material Security Tampa Bay

My list of links from class discussions during UC Baseline’s InfoSec week

Photo: The Undercroft sign, featuring the Undercroft’s “mascot” — a stag standing upright in a suit, leaning jauntily against an umbrella, walking stick-style.During the Information Security week of the UC Baseline cybersecurity program, the instructors asked us a lot of questions whose answers we had to look up. As a way to maximize participation, we were encouraged to share lots of links of the class’ Slack channel, which also functioned as a backchannel, as well as a way to chat with the students who were taking the course online.

The links that we shared in class were valuable material that I thought would be worth keeping for later reference. I’ve been spending an hour here and there, gathering them up and even organizing them a little. The end result is the list below.

Since these are all publicly-available links and don’t link to any super-secret UC Baseline instructional material, I’m posting them here on Global Nerdy. Think of this list as a useful set of security-related links, something to read if you’re bored, or a peek into what gets discussed during the InfoSec week of the UC Baseline course!

The links

  • U.S. Department of Health & Human Services: Cyber Security Guidance Material
    A collection of “educational materials specifically designed to give HIPAA covered entities and business associates insight into how to respond to a cyber-related security incidents.”
  • DFIR — Digital Forensics and Incident Response
    “Digital forensics and incident response is an important part of business and law enforcement operations. It is a philosophy supported by today’s advanced technology to offer a comprehensive solution for IT security professionals who seek to provide fully secure coverage of a corporation’s internal systems.”
  • Understanding RPO and RTO
    “Recovery Point Objective (RPO) and Recovery Time Objective (RTO) are two of the most important parameters of a disaster recovery or data protection plan. These are objectives which can guide enterprises to choose an optimal data backup plan.”

  • The 3-2-1 backup rule
    “For a one-computer user, the VMware backup strategy can be as simple as copying all important files to another device – or, ideally, several devices – and keeping them in a safe place. However, for multiple computer systems, things can be (and usually are) much more complicated, especially when it comes to virtual environments containing thousands of virtual machines. To protect physical machines, you would need to perform Windows Server backup or Linux Server backup, which might be difficult without effective backup tools. In these cases, a comprehensive data protection plan should include the 3-2-1 backup rule.”

  • Evaluating Risks Using Quantitative Risk Analysis
    “Project managers should be prepared to perform different types of risk analysis. For many projects, the quicker qualitative risk assessment is all you need. But there are occasions when you will benefit from a quantitative risk analysis.Let’s take a look at this type of analysis: What is it? Why should we perform it? When should it be performed? And how do we quantify risks?”

  • Buffer/stack overflows
  • Here are six basic human tendencies that are exploited in social engineering attacks:
    1. Authority: An attacker may call you pretending to be an executive in order to exploit your tendency to comply with authority figures.
    2. Liking: An attacker may try to build rapport with you by finding common interests, and then ask you for a “favor”.
    3. Reciprocation: An attacker may try to do something for you, or convince you that he or she has, before asking you for something in return.
    4. Consistency: An attacker might first get your verbal commitment to abide by a fake security policy, knowing that once you agree to do so, you will likely follow through with his next request in order to keep your word.
    5. Social Validation: An attacker may try to convince you to participate in a fake survey by telling you that others in your department already have. He or she may have even gotten some of their names and use them to gain your trust.
    6. Scarcity: An attacker may tell you that the first 10 people to complete a survey will automatically win a prize and that since some of your co-workers have already taken the survey, you might as well too.
  • Social Studies – A Lesson in Social Engineering Basics
    As we have become more and more vigilant against clicking on malicious links in suspicious emails, some social engineers have gone back to the classic person-to-person approach. Their basic strategy is to prey on vulnerabilities in human nature.
Categories
Current Events Tampa Bay

What’s happening in the Tampa Bay tech/entrepreneur/nerd scene (Week of Monday, August 24, 2020)

Once again, here’s the weekly list of events for events for Tampa Bay techies, entrepreneurs, and nerds. Every week, on GlobalNerdy.com and on the mailing list, I scour the announcements for events that are interesting to or useful for those of you who are building the future here in “The Other Bay Area, on The Other West Coast”.

This list covers events from Monday, August 24 through Sunday, August 30, 2020.

I’ve opted to list only those events that I can confirm are happening online. I’m not yet listing in-person events, as we’re still in the middle of a pandemic in one of the hardest-hit states in one of the hardest-hit countries in the world. We’re also just about to see the mandated return of students to schools, which will likely  exacerbate the situation.

Events — especially virtual, online ones — can pop up at the last minute. I add them to the list as I find out about them. Come back and check this article from time to time, as you might find a new listing that wasn’t there before!

Monday, August 24

Tuesday, August 25

Wednesday, August 26

Thursday, August 27

Friday, August 28

Saturday, August 29

No tech, entrepreneur, or nerd online events have been posted…yet!

Sunday, August 30

Do you have any events or announcements that you’d like to see on this list?

Let me know at joey@joeydevilla.com!

Join the mailing list!

If you’d like to get this list in your email inbox every week, enter your email address below. You’ll only be emailed once a week, and the email will contain this list, plus links to any interesting news, upcoming events, and tech articles.

Join the Tampa Bay Tech Events list and always be informed of what’s coming up in Tampa Bay!


Categories
Career Tampa Bay What I’m Up To

I’m at The Undercroft’s “Get a Job” career fair!

The class portion of UC Baseline — the cybersecurity training program offered by The Undercroft, Tampa Bay’s security guild — ended yesterday with the final day of Python 101, which marks the end of classes. Every weekday for the past five weeks, 8:00 a.m. to 4:00 p.m., I’ve been in a classroom (masked and socially distanced, of course), studying and furiously taking notes in the following classes:

Course Instructor
Hardware 101
(5 days)		 Tremere
Networking 101
(5 days)		 TreyCraf7
Linux 101
(3 days)		 Cochise
Windows 101
(2 days)		 Turtle
Infosec 101
(5 days)		 KobyBeefcake
TheCleverShark
Python 101
(3 days)		 KobyBeefcake

There are still two more days in the program. Today is the “Get a Job” career fair. The Undercroft have gathered a series of recruiters, security companies, and agencies to talk to us, including:

The presentations are quite good — I’m pretty impressed by the representatives I’ve seen so far.

I’m also dressed and masked for the occasion:

Categories
Current Events Programming

Happy 10th Whyday!

Today, August 19th, is Whyday! I wrote a longer post about it earlier this week, but if you want the short version, it’s this: It’s a day to celebrate creativity and whimsy using technology.

Whyday is named after the engimatic programmer/artist who operated under the name “Why the Lucky Stiff” (or _why for short), and his story is told in this video:

My favorite quote from _why, which he Tweeted before he took down his Twitter account:

when you don’t create things, you become defined by your tastes rather than ability. your tastes only narrow & exclude people. so create.

In the spirit of _why, let’s all use this day to start a creative project or try something new!

Find out more about Whyday ay whyday.org.

Categories
Hardware Process

Android *still* has a maximum passcode length of 16 characters

My new Android phone, a Motorola One Hyper, which I wrote about a couple of weeks ago, came out of the box with Android 10.

When it came time to set the passcode to unlock the phone, I found out that the longest device unlock passcode that even the most recent version of Android will accept is 16 characters. That was the case five years ago, and it’s still the case today.

Android’s “Choose Lock Password” screen is part of AOSP (Android Open Source Project), which means that its source code is easy to find online. It’s ChooseLockPassword.java, and the limitation is a constant defined in a class named ChooseLockPasswordFragment, which defines the portion of the screen where you enter a new passcode.

Here are the lines from that class that define passcode requirements and limitations:

private int mPasswordMinLength = LockPatternUtils.MIN_LOCK_PASSWORD_SIZE;
private int mPasswordMaxLength = 16;
private int mPasswordMinLetters = 0;
private int mPasswordMinUpperCase = 0;
private int mPasswordMinLowerCase = 0;
private int mPasswordMinSymbols = 0;
private int mPasswordMinNumeric = 0;
private int mPasswordMinNonLetter = 0;

Note the values assigned to these variables. It turns out that there are only two constraints on Android passcodes that are currently in effect:

  • The minimum length, stored in mPasswordMinLength, which is set to the value stored in the constant LockPatternUtils.MIN_LOCK_PASSWORD_SIZE. This is currently set to 6.
  • The maximum length, stored in mPasswordMaxLength, which is set to 16.

As you might have inferred from the other variable names, there may eventually be other constraints on passcodes — namely, minimums for the number of letters, uppercase letters, lowercase letters, symbol characters, numeric characters, and non-letter characters — but they’re currently not in effect.

Why 16 characters?

16 is a power of 2, and to borrow a line from Snow Crash, powers of 2 are numbers that a programmer would recognize “more readily than his own mother’s date of birth”. This might lead you to believe that 16 characters would be some kind of technical limit or requirement, but…

…Android (and in fact, every current non-homemade operating system) doesn’t store things like passcodes and passwords as-is. Instead, it stores the hashes of those passcodes and passwords. The magic of hash functions is that no matter how short or long the text you feed into them, their output is always the same fixed size (and a relatively compact size, too).

For example, consider SHA-256, from the SHA-2 family of hash functions:

String value Its SHA-256 hash
(empty string) e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
x 2d711642b726b04401627ca9fbac32f5c8530fb1903cc4db02258717921a4881
Chunky bacon! f0abf4f096ac8fa00b74dbcee6d24c18cfd8ab5409d7867c9767257d78427760
I have come here to chew bubblegum and kick ass… and I’m all out of bubblegum! 3457314d966ef8d8c66ee00ffbc46c923d1c01adb39723f41ab027012d30f7fd
(The full text of T.S. Eliot’s The Love Song of J. Alfred Prufrock) 569704de8d4a61d5f856ecbd00430cfe70edd0b4f2ecbbc0196eda5622ba71ab

No matter the length of the input text, the output of the SHA-256 function is always the same length: 64 characters, each one a hexadecimal digit.

Under the 16-character limit, the password will always be shorter than the hash that actually gets stored! There’s also the fact that in a time when storage is measured in gigabytes, we could store a hash that was thousands of characters long and not even notice.

My guess is that the Android passcode size limit of 16 characters is purely arbitrary. Perhaps they thought that 16-character passwords like the ones below were the longest that anyone would want to memorize:

TvsV@PA9UNa$yvNN
sDrgjwN#Vc^pmjL4
argmdKAP?!Gzh9mG
<Wea2CKufNk+UuU8
EmNv%LN9w4T.sc76

The problem is that it doesn’t account for (theoretically) more secure yet easier to remember passwords of the “correct horse battery staple” method described in the webcomic xkcd, which can easily make passwords longer than 16 characters:

Tap the comic to read the original.

Based on usability factors, there is a point after which a password is just too long, but it’s not 16 characters. I think that iOS’ 37-character limit is more suitable.