Terry Chia

11,100 reputation

42367

bio	website	infosecstudent.com
	location	Singapore
	age	18
visits	member for	1 year
	seen	7 hours ago
stats	profile views	555

Currently a student studying IT security.

	11,100 reputation	bio	website	infosecstudent.com	visits	member for	1 year
42367 badges		location	Singapore		seen	7 hours ago

summary answers questions tags badges favorites bounties reputation activity

309 Comments

suggestions reviews revisions comments badges posts accepts all

Mar 19	comment	Why don't major browsers currently support TLS above version 1.0? @SmitJohnth "Firstly, there's the usual problem of buggy servers. TLS has a version negotiation mechanism, but some servers will fail if a client indicates that it supports the newer TLS versions." From the article I linked to. Like I said, the article is a year old though, things should have improved somewhat since then.
Mar 19	comment	How can I portscan large subnets? Thanks for the recommendation. It looks like a nice alternative to nmap for certain scenarios.
Mar 19	comment	How would one crack a weak but unknown encryption protocol? @Rushyo Given how well Kerckhoff's principle has worked for modern algorithms, I'd say it's a fact.
Mar 18	comment	How would one crack a weak but unknown encryption protocol? @RamRachum So you want me to give an answer specific to your algorithm with frankly very unrealistic limitations? Sorry no can do. That would be "Too Localized". My answer is sound as long as you are living in the real world.
Mar 18	comment	How would one crack a weak but unknown encryption protocol? @RamRachum I'm sorry, but why is this useless? You can't expect me to tell you how to break every single homegrown scheme out there can you? The crux of the matter is that homegrown schemes are weak, and there are very smart people out there breaking them.
Mar 18	comment	How would one crack a weak but unknown encryption protocol? @AndySmith Fine fine. :P Edited.
Mar 18	comment	How can I portscan large subnets? @D3C4FF Well, you could split the scan into several smaller ones. Also has the advantage of allowing you to run multiple scans at one go, speeding up the process overall. Should be easy enough to collate the results especially using the xml format. nmap has still been the most reliable network scanner for me.
Mar 17	comment	Is pixel based image encryption secure? Regardless of how good you think your homemade scheme is, don't roll your own crypto. Why are you encrypting each pixel individually rather than encrypting the entire image as a byte stream? Do you have a good reason for doing so?
Mar 17	comment	Concrete figures on password cracking in the wild Don't have any figures to back this up so I'm just posting this as a comment: attackers don't really have to invest in large GPU arrays to obtain a major speed up. A single GPU that most people have in their computers are already insanely fast. Also, john the ripper is probably as easy as it gets as it is mostly a fire-and-forget tool unless you are configuring some specific ruleset for your attack.
Mar 16	comment	Why not allow spaces in a password? Everything you mentioned is strictly an encoding issue, which shouldn't have an impact on a properly designed password hashing system.
Mar 15	comment	What exactly is the impact on security when forcing user passwords to contain a particular character? @bitmask Ahh, I actually meant reducing entropy compared to a random password of equal length. Sorry if it wasn't clear.
Mar 14	comment	Does the padlock on my browser really indicate a reasonable assurance against eavesdropping? possible duplicate of Are address bars unphishable?
Mar 14	comment	Where do I securely store application-specific symmetric key? Sounds like you need some magic fairy dust.
Mar 14	comment	Is it safe to use public USB charging stations? See: security.stackexchange.com/a/25925/10211
Mar 12	comment	Report an email address being used by a phisher Hi, can you please expand your answer with more details?
Mar 11	comment	How much information about the reason for an unsuccessful login should a web application give? @Snuffleupagus Can't say I do... I only have 2 email accounts for clearly separate purposes. Moot point anyway since all my account details are stored in KeePass.
Mar 11	comment	How much information about the reason for an unsuccessful login should a web application give? First, I would like to say that the StackExchange network doesn't necessarily place a huge emphasis on security. It doesn't even use site-wide SSL. Next, I already mentioned that all such measures are not a replacement for good strong passwords. It is true that relying on security by obscurity isn't good. However, don't dismiss the benefits of security by obscurity in slowing down and discouraging attackers. I'd argue that since most users have been trained to accept an ambiguous error message, there isn't even a usability tradeoff in exchange for the slight increase in security.
Mar 11	comment	How much information about the reason for an unsuccessful login should a web application give? @vandalizmo What you must know is that all of such measures are merely a way to obscure/slow down an attacker. Nothing beats a high-entropy password. Are there ways to bypass such measures? Of course. Should you tell the attacker everything he needs to know? Of course not! It's about finding the right balance.
Mar 11	comment	Is there website for FastTrack? You are basically asking "Where is the website for xxx" which isn't on topic here or any where on the StackExchange network.
Mar 11	comment	Is there website for FastTrack? Welcome to IT Security. Sadly, this question isn't on-topic as defined by the scope of the FAQ as it has nothing to do with security.