4 ms·

There is a "many ways to skin a cat" joke here somewhere. It is actually terrible - the hmac timing attack requires around 3 minutes of google searching to avoi

There is a "many ways to skin a cat" joke here somewhere. It is actually terrible - the hmac timing attack requires around 3 minutes of google searching to avoid and is basic public domain knowledge. The other are much worse.

sliverstorm 13y ago
I wish I knew how to find my way into security as a hobby. Such a fun topic.
- oliwary 13y ago
  I am in the same position. Stanford Online started a Coursera course on cryptography yesterday, might be interesting for you. https://www.coursera.org/course/crypto https://www.coursera.org/course/crypto
- scott_s 13y ago
  Long-time HN member tptacek's company has a challenge set that many praise highly: http://www.matasano.com/articles/crypto-challenges/ http://www.matasano.com/articles/crypto-challenges/
  - schoen 13y ago
    Are the Matasano crypto challenges currently stuck in some way, like with a grading backlog? I signed up some months ago, sent my first set of answers just after the new year, and have never heard back about the second challenge set.
    - tptacek 13y ago
      We are way. way. way. backlogged. If anyone has any idea on how to help a hapless team of security researchers manage many thousands of people looking to get through the crypto challenges, we'd be t-h-r-i-l-l-e-d. We were able to keep up last summer, but then Microcorruption happened, we got into a hole, and we're only slowly digging ourselves out of it. Alex, Sean, and I are turning the challenges into a book, which we're going to release "choose-your-price" with all funds directly going to a charity (I like Watsi, but who knows); that book will also include Set 8, which is all ECC. I'm hoping we'll be done with that by August.
      - rcsorensen 13y ago
        Have you considered taking people who have passed challenges (and are excited about them) on as volunteer assistants for the challenges?
        tptacek 13y ago
        If anyone has ideas on how we could do that, I'm all ears. We'd have to mitigate the privacy issues somehow, because not everyone has given us permission to reveal that they're working through the challenges, and passing submissions to people outside the firm would be that.
        orthecreedence 13y ago
        Not sure what you guys are using to track all of it, but maybe a simple web app would help you out. For instance, an email address would be attached to a "level" (so you guys could input your previous members and attach what level they're on so if they sign up with that same email it'd be aligned). People could sign up and post their solutions, and others would be able to validate entries of levels below them (so someone on level 3 could validate a level 2 submission). Or hell, the webapp may even be able to validate some of it (obviously not entries where you paste code, but things like "Decrypt !4321hj4123$@!#$" could be automated). This way, you could submit solutions via your login (attached to your email) and people validating the entries wouldn't be able to see the email address, just the answers, and could comment on the submission. Sorry, this was a bit stream of consciousness. If this was particularly barebones, you might be able to slam it out in not too much time. If you don't mind PHP or Common Lisp in the backend, I might even be able to help out a bit.
        tptacek 13y ago
        We actually do have a web application we use to track the challenges (the mail is all done through Mailgun). Two things complicate managing the challenges: * We have to actually read the code people send us (if you get things wrong, there's a pretty good chance we'll catch it). We try hard not to move people forward a level until they've gotten the previous challenges right. * We don't dictate any particular format for submissions. Some people paste code into their email messages; some people attach lots of little files; some people attach archives. Some languages let you stick all that code in 1 file; others, like Java and C#, have complicated directory hierarchies.
- tptacek 13y ago
  Why find your way in as a hobby? Are you a professional developer now? Do you like low-level code? Are you OK with jumping directly into the deep end of the pool and maybe drowning a little bit? Why not reach out and talk to us about working on a professional security team? We have gotten very, very good at taking low-level devs and turning them into terrifying killing machines, and if you don't mind having all your flesh removed and your skeletal musculature replaced by pistons and servomotors, we'd be happy to do the same to you. http://matasano.com/careers http://matasano.com/careers
  - sliverstorm 13y ago
    Coding is a purely ancillary function to my day job; I am not a developer.
    - tptacek 13y ago
      "I hate coding" would be a problem for us, but "I ship software every day", not so much.
      - nialo 13y ago
        How about "I really enjoyed microcorruption and the crypto challenges, but am mostly working as a mechanical engineer"?
        tptacek 13y ago
        "Really enjoying Microcorruption and the crypto challenges" puts people pretty high up on my priority list.
  - lrigknat 13y ago
    And try their crypto challenges :)
  - ph0rque 13y ago
    ...if you don't mind having all your flesh removed and your skeletal musculature replaced by pistons and servomotors... Ah, but have you pen-tested the pistons and servomotors to make sure they're secure against attacks?

sliverstorm 13y ago

I wish I knew how to find my way into security as a hobby. Such a fun topic.

oliwary 13y ago
I am in the same position. Stanford Online started a Coursera course on cryptography yesterday, might be interesting for you. https://www.coursera.org/course/crypto https://www.coursera.org/course/crypto
scott_s 13y ago
Long-time HN member tptacek's company has a challenge set that many praise highly: http://www.matasano.com/articles/crypto-challenges/ http://www.matasano.com/articles/crypto-challenges/
- schoen 13y ago
  Are the Matasano crypto challenges currently stuck in some way, like with a grading backlog? I signed up some months ago, sent my first set of answers just after the new year, and have never heard back about the second challenge set.
  - tptacek 13y ago
    We are way. way. way. backlogged. If anyone has any idea on how to help a hapless team of security researchers manage many thousands of people looking to get through the crypto challenges, we'd be t-h-r-i-l-l-e-d. We were able to keep up last summer, but then Microcorruption happened, we got into a hole, and we're only slowly digging ourselves out of it. Alex, Sean, and I are turning the challenges into a book, which we're going to release "choose-your-price" with all funds directly going to a charity (I like Watsi, but who knows); that book will also include Set 8, which is all ECC. I'm hoping we'll be done with that by August.
    - rcsorensen 13y ago
      Have you considered taking people who have passed challenges (and are excited about them) on as volunteer assistants for the challenges?
      - tptacek 13y ago
        If anyone has ideas on how we could do that, I'm all ears. We'd have to mitigate the privacy issues somehow, because not everyone has given us permission to reveal that they're working through the challenges, and passing submissions to people outside the firm would be that.
        orthecreedence 13y ago
        Not sure what you guys are using to track all of it, but maybe a simple web app would help you out. For instance, an email address would be attached to a "level" (so you guys could input your previous members and attach what level they're on so if they sign up with that same email it'd be aligned). People could sign up and post their solutions, and others would be able to validate entries of levels below them (so someone on level 3 could validate a level 2 submission). Or hell, the webapp may even be able to validate some of it (obviously not entries where you paste code, but things like "Decrypt !4321hj4123$@!#$" could be automated). This way, you could submit solutions via your login (attached to your email) and people validating the entries wouldn't be able to see the email address, just the answers, and could comment on the submission. Sorry, this was a bit stream of consciousness. If this was particularly barebones, you might be able to slam it out in not too much time. If you don't mind PHP or Common Lisp in the backend, I might even be able to help out a bit.
        tptacek 13y ago
        We actually do have a web application we use to track the challenges (the mail is all done through Mailgun). Two things complicate managing the challenges: * We have to actually read the code people send us (if you get things wrong, there's a pretty good chance we'll catch it). We try hard not to move people forward a level until they've gotten the previous challenges right. * We don't dictate any particular format for submissions. Some people paste code into their email messages; some people attach lots of little files; some people attach archives. Some languages let you stick all that code in 1 file; others, like Java and C#, have complicated directory hierarchies.
tptacek 13y ago
Why find your way in as a hobby? Are you a professional developer now? Do you like low-level code? Are you OK with jumping directly into the deep end of the pool and maybe drowning a little bit? Why not reach out and talk to us about working on a professional security team? We have gotten very, very good at taking low-level devs and turning them into terrifying killing machines, and if you don't mind having all your flesh removed and your skeletal musculature replaced by pistons and servomotors, we'd be happy to do the same to you. http://matasano.com/careers http://matasano.com/careers
- sliverstorm 13y ago
  Coding is a purely ancillary function to my day job; I am not a developer.
  - tptacek 13y ago
    "I hate coding" would be a problem for us, but "I ship software every day", not so much.
    - nialo 13y ago
      How about "I really enjoyed microcorruption and the crypto challenges, but am mostly working as a mechanical engineer"?
      - tptacek 13y ago
        "Really enjoying Microcorruption and the crypto challenges" puts people pretty high up on my priority list.
- lrigknat 13y ago
  And try their crypto challenges :)
- ph0rque 13y ago
  ...if you don't mind having all your flesh removed and your skeletal musculature replaced by pistons and servomotors... Ah, but have you pen-tested the pistons and servomotors to make sure they're secure against attacks?