24,249 reputation
759119
bio website ayrx.me
location Singapore
age 19
visits member for 2 years, 5 months
seen 22 mins ago

Currently a student studying IT security.


Oct
20
comment Protecting personal documents in cloud
Hello, welcome to Information Security Stackexchange. Could you provide more information, perhaps even a summary of the article? Link-only answers are discouraged because they usually lead to link-rot.
Oct
19
comment How does a key file increase the security of a password manager?
@HighCommander4 Convenience?..
Oct
19
comment How does a key file increase the security of a password manager?
@HighCommander4 What? I only store the key file on my phone or database because I do not have any means to conveniently use a USB drive with those devices. The point is, I do not distribute the key file the same way I distribute my password database.
Oct
19
comment How does Dropbox keep files secure
Self plug, I wrote a client side app to encrypt files before uploads. Might be a little buggy still though. github.com/Ayrx/pyDropSecure
Oct
17
comment Is it possible to use a GPG or SSH key for web based authentication in a secure fashion?
Great answer as always. I guess this isn't really feasible since the manual operations needed will piss off even the most dedicated of users.
Oct
17
comment Is it possible to use a GPG or SSH key for web based authentication in a secure fashion?
+1 Some points for me to think about.
Oct
16
comment Is this password hashing + salt method the most secure way possible?
@Chrisgozd It looks ok, but you don't actually have to generate the salt separately unless you want to store it elsewhere. The HashPassword() function will automatically generate the salt for you.
Oct
15
comment Is this password hashing + salt method the most secure way possible?
@Chrisgozd What exactly is BcryptDude? I hope you are just wrapping the Bcrypt.NET library in your own namespace and not rolling your own version of the algorithm...
Oct
14
comment Linux: Blocking outside attempts at attacking computer
@Friendly RHEL-based systems has system-config-firewall. Not sure what the Debian-based one is called but a quick Google search will reveal the answer.
Oct
14
comment Is this password hashing + salt method the most secure way possible?
@Chrisgozd Yes, RNGCryptoServiceProvider is a cryptographically secure RNG so you should be find there. With regards to iteration count, that depends on the hardware you are targeting. The correct answer will be as high as possible without introducing large delays for your users. So, profile profile profile.
Oct
13
comment comparing password hashing algorithms - PoC ideas?
Name of company so we know to stay away from them?
Oct
12
comment Encrypting something with multiple keys such that k out of n keys are needed; what's it called?
@user31890 No problem, be sure to click the little arrow on the left side of an answer if you think it's the correct one.
Oct
11
comment Free Alternatives in Web-Application Mapping Software
nikto is an interesting one as well.
Oct
7
comment Is Password Complexity required at all
@RichardPetheram Hashing your passwords is precisely to protect against an attacker somehow managing to compromise your database. If you assume a magical fantasy world where your server is zero-day free and your code is flawless, you don't need to hash your passwords to protect it.
Oct
7
comment Twitter's HTTP response vs Google's HTTP response
@Manishearth As they should. :P
Oct
6
comment Best way to allow sudo access when using ssh keys
@Lekensteyn I have corrected NOPASSWD. See idioms.thefreedictionary.com/any+old+thing for the phrase "any old user". Sure, sudo can allow execution as any user, not just root but that's really not that relevant...
Oct
5
comment Force https, complex implementation
Good point on the bookmarks issue. I forgot about the RewriteCond and RewriteRule directives.
Oct
5
comment Can he see the websites I visited?
@Lavin So change the password...
Oct
5
comment Force https, complex implementation
@david I think I made a little mistake so I edited my answer. I'm going from memory though, so you will have to play around with the Redirect directive a little.
Oct
5
comment Force https, complex implementation
@david I don't have apache handy to test it right now but it should. You can also use a directive such as Redirect permanent /user/add https://sub.abc.com/user/add if you only want a redirect in certain pages.