Tech Solvency / Talks

Towards Integrated Cyber Preparedness for Alaskans (ArcticCon 2018, 2018-10-04)
- Video - TBA
- Slides - OpenOffice ODP, PDF
- InfoconDB entry
- Errata
  - Duplicated nmap slide (slide 57). I remember thinking during the talk that I'd accidentally gone backwards (which I also did for real - I need a more intuitive pointer!)
- Reviews
  - "That was a lot of slides. Like ... a lot." - anonymous
- If you attended or watch the video, I welcome any feedback.

A Security Mindset in the Age of Ransomware (Association of Continuity Professionals, Greater Alaska chapter, 2018-04-04)
- Video - none (not recorded)
- Slides - OpenOffice ODP, PDF
- Errata - none yet noted

Password Cracking 201: Beyond the Basics (BSidesLV, Ground1234! track, 2017-07-25)
- Video - YouTube
- Original livestream for the entire track (my talk starts at 5:37:42 - ~50 minutes)
- Peerlyst post
- Slides - OpenOffice ODP, PDF
- InfoconDB entry
- Errata
  - The difference in scale/keyspace between 14-char upper/lower/number and five dictionary words was not sufficiently clear - a few folks though I was trying to pull a fast one. :) I try to make the distinction more clear during the spoken part of the talk.
  - I accidentally left out a slide about bruteforcing multibyte characters using RuraPenthe's method. This would have been helpful for the question I took at the end from the South African fellow that I couldn't adequately answer.
  - During talking about slide 34, I said that MDXfind is Windows only - this is not the case! (Linux 32/64, macOS, Windows - even ARM!). I was thinking of InsidePro's Hash Manager and confused the two. I also mentioned 80% as my personal preferred fan speed, but this depends heavily on ambient temps and I'm in Alaska ;), so adjust to your environment.
  - For comparing performance, I also forgot to mention password-guessing.org by m33x and colleagues.
  - On slide 46, the hash should begin with a lower-case 'a', not an upper-case 'A' (thanks, LibreOffice)
  - On slide 54, the difference in speed should not be this great. I forgot that I was using a beta version of hashcat, which no longer automatically performs some optimizations in non-benchmark mode, in exchange for support for longer passwords. The previous default optimizations can be enabled with -O:
```
$ hashcat -m 0 -a 3 bslv.hash -d 1 \
  --quiet --speed-only \
  --machine-readable ?a?a?a?a?a?a?a?a
1:3273837251

$ hashcat -O -m 0 -a 3 bslv.hash -d 1 \
  --quiet --speed-only \
  --machine-readable ?a?a?a?a?a?a?a?a
1:10105820035
```
  - The aspect ratio of my slides in the video is not the original aspect ratio. (I had no control over that, but it's vaguely annoying :) )
  - Hashes.org is no longer up - Hashmob (hashmob.net) is a suitable alternative
  - I should have used python to show the large integer values in scientific notation:
```
                       python -c 'print("{:.2E}".format(167303**6))'
                       2.19E+31
                       
```
- Reviews
  - "Really enjoyed it!" - Matt Weir / @lakiw
  - "Agreed, some good insights" - @hashcat
  - (paraphrasing) "You did pretty well. Next time, don't read your table-of-contents slide - let the audience absorb it while you talk about something else." - Micah Hoffman / @WebBreacher
  - "We're so proud of you!" - Mom ;)
- Updates
  - I mention rli as the fastest way to dedupe wordlists. This has been superseded by rling