24,452 reputation
759119
bio website ayrx.me
location Singapore
age 19
visits member for 2 years, 6 months
seen 9 hours ago

Currently a student studying IT security.


Oct
22
revised Are there any security related rules in PCI-DSS that govern when I can capture a payment?
rolled back to a previous revision
Oct
22
reviewed Leave Open Are there any security related rules in PCI-DSS that govern when I can capture a payment?
Oct
22
reviewed Approve suggested edit on What's the purpose? Strange login attemps “sshd[***] Received disconnect from **.**.**.**: 11: Bye Bye [preauth]”
Oct
22
reviewed Approve suggested edit on SQL injection across multiple tables
Oct
21
awarded  Nice Answer
Oct
20
answered Preventing exploits like ROP and Return-to-libc in modern Operating systems
Oct
20
awarded  Announcer
Oct
20
comment May I `store` the password, by making it the key in AES-256?
@LuciferOrichalcum I dump your database. I have the username, R and E. I randomly try deriving P and K through a bruteforce or dictionary attack by guessing the password until I find a value where E = encrypt(k,P). Your scheme does not protect against this at all.
Oct
20
revised May I `store` the password, by making it the key in AES-256?
added 9 characters in body
Oct
20
comment May I `store` the password, by making it the key in AES-256?
@LuciferOrichalcum You derive the key for AES encryption by hashing the password ONCE. This is trivial to bruteforce and has no bearing on the strength of AES as an encryption algorithm. It's fine for most things to want to try something new, but cryptography is not one of them. Stick with well tested schemes instead....
Oct
20
answered May I `store` the password, by making it the key in AES-256?
Oct
20
reviewed Reject suggested edit on How does a key file increase the security of a password manager?
Oct
20
reviewed Reviewed the Informix password crack
Oct
20
reviewed Reject suggested edit on Isn't all security “through obscurity”?
Oct
20
reviewed Reviewed Protecting personal documents in cloud
Oct
20
comment Protecting personal documents in cloud
Hello, welcome to Information Security Stackexchange. Could you provide more information, perhaps even a summary of the article? Link-only answers are discouraged because they usually lead to link-rot.
Oct
20
answered Protecting personal documents in cloud
Oct
19
answered Isn't all security “through obscurity”?
Oct
19
comment How does a key file increase the security of a password manager?
@HighCommander4 Convenience?..
Oct
19
comment How does a key file increase the security of a password manager?
@HighCommander4 What? I only store the key file on my phone or database because I do not have any means to conveniently use a USB drive with those devices. The point is, I do not distribute the key file the same way I distribute my password database.