Idea: HiddenCon

hiddencon: a hacker conference with a specific location/date only available after some trivial and/or creative CTF legwork... or, in practice, someone who did the work vouches for your worthiness or cultural fit by revealing it to you. I have a few ideas for how to accomplish a few different security properties for these challenges. To avoid biasing your thought process I will start with only a few goals to consider for this project. trust-only leakage you can't leak the location in a way that can be validated: you can only reveal it to people who trust you not to lie. This can be enhanced with a culture of elitist trickery. This seems to necessitate having a bunch of puzzles so you can't leak the location by leaking a walk-through. provably random seed for location generation Pretty sure the cryptography part is a solved problem- gets a bit more complicated with other goals involved. Not sure if this works well with logistics, etc. Do you want all the hotels in town to be already full of hackers when you show up? Maybe you could compose a list of suggested locations that would work and then use the seed to pick one. multi-instance interoperability/decentralization It would be nice to have multiple locations for such a conference depending on how wide the draw is and how far people tend to be willing to travel. Multiple respected puzzle-creators could split the work of making puzzles. It would be nice to not have to place too much trust in many puzzle makers or event planners, or even in any of them. Why? For one, I believe that this could be useful for making a conference that cannot be infiltrated by corporate. You will not get carte blanche to bill the corporate credit card or buy airline tickets when they don't even know where you are going or have confirmation that you are going to the right location. This is very much a thing that corpies can only do on their own time. It might even give feds a bit of trouble with surveillance. This also aligns well with the desire to revitalize a culture of privacy in a conference. Seclusion aligns with the desire to integrate more shadier-but-competent aspects that you might have once found at defcon and fewer cosplayers. Yes, mohawk punk girl posers are cute but I would like a conference that is more selective- for both capability and agency. My apologies for the soyjak, I wanted to post an anime girl but she was too .webp for this club.

FORMATTING FIX (aka reddit spacing) >>74617 trust-only leakage you can't leak the location in a way that can be validated: you can only reveal it to people who trust you not to lie. This can be enhanced with a culture of elitist trickery. This seems to necessitate having a bunch of puzzles so you can't leak the location by leaking a walk-through. provably random seed for location generation Pretty sure the cryptography part is a solved problem- gets a bit more complicated with other goals involved. Not sure if this works well with logistics, etc. Do you want all the hotels in town to be already full of hackers when you show up? Maybe you could compose a list of suggested locations that would work and then use the seed to pick one. multi-instance interoperability/decentralization It would be nice to have multiple locations for such a conference depending on how wide the draw is and how far people tend to be willing to travel. Multiple respected puzzle-creators could split the work of making puzzles. It would be nice to not have to place too much trust in many puzzle makers or event planners, or even in any of them.

>I wanted to post an anime girl but she was too .webp for this club. Nothing to apologize for, webp is a soykaf format that belongs in the dustbin of history.

>>74625 What kind of "hacker" can't convert an image from one type to another?

>>74629 I could but I didn't want to bother moving between qubes boxes and the soyjak was right there

Cool idea, well written post, but I see some problems. Mostly that people don't usually commit to such things enough. Just look at the meetup thread on this board, hardly anyone is open to leaving their comfort zone slightly by meeting a stranger within their area. Now imagine how many would go if they had to spend hundreds for plane tickets and hotels. I've seen some cicada wannabes on various chans and forums in the last years, the reaction by most people was just to make fun of it and not put in any serious effort to solve the riddles. If you look at the reactions in this thread so far you can already imagine how many will care. If you are thinking about the more mainstream security scene, the CTF players that hang out on discord and often don't care so much for privacy or underground activities, they might be more likely to come, but are those really the sort that you want to attract? And now even if this would be solved, I wonder how >This seems to necessitate having a bunch of puzzles so you can't leak the location by leaking a walk-through. is supposed to be understood. I have no idea how this would work. Do you have an actual plan for this?

>>74648 To answer your final question before the rest of your post, I have only a few slightly more detailed implementation ideas that I will probably spill ITT in a week or so. I have straightforward ideas on how to accomplish trust-only leakage and provably random seed generation, but these get tangled up if decentralization (or untrusted central facilitation?) are design goals. This probably means that the first version should settle for the former two properties while keeping potential improvements in mind. I have nothing super specific, and it is not a priority for me to actually work on right now. I am using this as a cool idea that I will work on or fund at a later time to motivate me on my main projects. I am mainly throwing it out there in case someone else looking for something to do can draw inspiration from it. Your critique by way of the right people not caring strikes home, because I don't like CTFs a whole lot either. If there was something like this, the CTF part would just be a chore for me. Perhaps it could be less of a chore if you could select the type of CTF challenge you want to work on. "Oh, yeah I haven't used AFL in a while a basic fuzzing challenge would just be a welcome refresher that I ought to do soon anyway." Yet this does increase the number of puzzles you need for the same level of testing. I guess instead of CTFs the main gating process could be something like a short essay on an interesting topic/project/idea. That changes the workload to "read a bunch of posts and decide which ones are clever enough" which is more reasonable to distribute among a community than "make 16 different binary reverse engineering challenges". You could also imagine putting this step before a far less rigorous CTF stage. It shouldn't be that hard to essentially ask for one high quality technical blogpost. I meant that to be understood as "each person gets a random series of puzzles every time they try, so someone can't just give people a step-by-step guide to solve all the challenges" Alone this doesn't change how long it takes to solve all the puzzles and release all the solutions, given the same N total puzzles. If you add a rate limit or something similar to slow the enumeration of all puzzles, like a small fee or a captcha or some more rigorous process.

>>74617 Honestly lain the bar is really low if youre trying to deter people. You dont have to make some grand complicated scavenger hunt. You can just put the time and place out in the clear and most people wont go anyway.