23,935 reputation
756114
bio website ayrx.me
location Singapore
age 19
visits member for 2 years, 3 months
seen 4 hours ago

Currently a student studying IT security.


Oct
17
comment Is it possible to use a GPG or SSH key for web based authentication in a secure fashion?
Great answer as always. I guess this isn't really feasible since the manual operations needed will piss off even the most dedicated of users.
Oct
17
comment Is it possible to use a GPG or SSH key for web based authentication in a secure fashion?
+1 Some points for me to think about.
Oct
16
comment Is this password hashing + salt method the most secure way possible?
@Chrisgozd It looks ok, but you don't actually have to generate the salt separately unless you want to store it elsewhere. The HashPassword() function will automatically generate the salt for you.
Oct
15
comment Is this password hashing + salt method the most secure way possible?
@Chrisgozd What exactly is BcryptDude? I hope you are just wrapping the Bcrypt.NET library in your own namespace and not rolling your own version of the algorithm...
Oct
14
comment Linux: Blocking outside attempts at attacking computer
@Friendly RHEL-based systems has system-config-firewall. Not sure what the Debian-based one is called but a quick Google search will reveal the answer.
Oct
14
comment Is this password hashing + salt method the most secure way possible?
@Chrisgozd Yes, RNGCryptoServiceProvider is a cryptographically secure RNG so you should be find there. With regards to iteration count, that depends on the hardware you are targeting. The correct answer will be as high as possible without introducing large delays for your users. So, profile profile profile.
Oct
13
comment comparing password hashing algorithms - PoC ideas?
Name of company so we know to stay away from them?
Oct
12
comment Encrypting something with multiple keys such that k out of n keys are needed; what's it called?
@user31890 No problem, be sure to click the little arrow on the left side of an answer if you think it's the correct one.
Oct
11
comment Free Alternatives in Web-Application Mapping Software
nikto is an interesting one as well.
Oct
7
comment Is Password Complexity required at all
@RichardPetheram Hashing your passwords is precisely to protect against an attacker somehow managing to compromise your database. If you assume a magical fantasy world where your server is zero-day free and your code is flawless, you don't need to hash your passwords to protect it.
Oct
7
comment Twitter's HTTP response vs Google's HTTP response
@Manishearth As they should. :P
Oct
6
comment Best way to allow sudo access when using ssh keys
@Lekensteyn I have corrected NOPASSWD. See idioms.thefreedictionary.com/any+old+thing for the phrase "any old user". Sure, sudo can allow execution as any user, not just root but that's really not that relevant...
Oct
5
comment Force https, complex implementation
Good point on the bookmarks issue. I forgot about the RewriteCond and RewriteRule directives.
Oct
5
comment Can he see the websites I visited?
@Lavin So change the password...
Oct
5
comment Force https, complex implementation
@david I think I made a little mistake so I edited my answer. I'm going from memory though, so you will have to play around with the Redirect directive a little.
Oct
5
comment Force https, complex implementation
@david I don't have apache handy to test it right now but it should. You can also use a directive such as Redirect permanent /user/add https://sub.abc.com/user/add if you only want a redirect in certain pages.
Oct
5
comment Can he see the websites I visited?
@Lavin He has the wifi password... so why is he unable to connect to the network...?
Oct
5
comment Can he see the websites I visited?
@Lavin Frankly, if he can connect to the network, it's a trivial thing that a 10yo with access to Google can pull off.
Oct
4
comment What are the security features of the proposed “secure email” from Brazil?
Definitely worth a post on meta. My opinion is that speculative questions will not add much to the site and should be closed.
Oct
4
comment What are the security features of the proposed “secure email” from Brazil?
The answer will be "no one knows at this very moment."