25,153 reputation
761121
bio website ayrx.me
location Singapore
age 19
visits member for 2 years, 6 months
seen 16 mins ago

This is not the profile you are looking for.


Nov
1
comment How does nmap determine if it's running HTTP service on a port? Fails here
@warl0ck In addition, a custom nmap-services file can be passed as an option using the --servicedb flag.
Nov
1
comment How does nmap determine if it's running HTTP service on a port? Fails here
@warl0ck No. nmap does not use the /etc/services file for port specifications. Instead, nmap maintains a nmap-services file. In my Fedora 19 machine, the file is located at /usr/share/nmap/nmap-services. The file format is the same as the /etc/services file though, so customizing it is very possible.
Oct
20
comment May I `store` the password, by making it the key in AES-256?
@LuciferOrichalcum I dump your database. I have the username, R and E. I randomly try deriving P and K through a bruteforce or dictionary attack by guessing the password until I find a value where E = encrypt(k,P). Your scheme does not protect against this at all.
Oct
20
comment May I `store` the password, by making it the key in AES-256?
@LuciferOrichalcum You derive the key for AES encryption by hashing the password ONCE. This is trivial to bruteforce and has no bearing on the strength of AES as an encryption algorithm. It's fine for most things to want to try something new, but cryptography is not one of them. Stick with well tested schemes instead....
Oct
20
comment Protecting personal documents in cloud
Hello, welcome to Information Security Stackexchange. Could you provide more information, perhaps even a summary of the article? Link-only answers are discouraged because they usually lead to link-rot.
Oct
19
comment How does a key file increase the security of a password manager?
@HighCommander4 Convenience?..
Oct
19
comment How does a key file increase the security of a password manager?
@HighCommander4 What? I only store the key file on my phone or database because I do not have any means to conveniently use a USB drive with those devices. The point is, I do not distribute the key file the same way I distribute my password database.
Oct
19
comment How does Dropbox keep files secure
Self plug, I wrote a client side app to encrypt files before uploads. Might be a little buggy still though. github.com/Ayrx/pyDropSecure
Oct
17
comment Is it possible to use a GPG or SSH key for web based authentication in a secure fashion?
Great answer as always. I guess this isn't really feasible since the manual operations needed will piss off even the most dedicated of users.
Oct
17
comment Is it possible to use a GPG or SSH key for web based authentication in a secure fashion?
+1 Some points for me to think about.
Oct
16
comment Is this password hashing + salt method the most secure way possible?
@Chrisgozd It looks ok, but you don't actually have to generate the salt separately unless you want to store it elsewhere. The HashPassword() function will automatically generate the salt for you.
Oct
15
comment Is this password hashing + salt method the most secure way possible?
@Chrisgozd What exactly is BcryptDude? I hope you are just wrapping the Bcrypt.NET library in your own namespace and not rolling your own version of the algorithm...
Oct
14
comment Linux: Blocking outside attempts at attacking computer
@Friendly RHEL-based systems has system-config-firewall. Not sure what the Debian-based one is called but a quick Google search will reveal the answer.
Oct
14
comment Is this password hashing + salt method the most secure way possible?
@Chrisgozd Yes, RNGCryptoServiceProvider is a cryptographically secure RNG so you should be find there. With regards to iteration count, that depends on the hardware you are targeting. The correct answer will be as high as possible without introducing large delays for your users. So, profile profile profile.
Oct
13
comment comparing password hashing algorithms - PoC ideas?
Name of company so we know to stay away from them?
Oct
12
comment Encrypting something with multiple keys such that k out of n keys are needed; what's it called?
@user31890 No problem, be sure to click the little arrow on the left side of an answer if you think it's the correct one.
Oct
11
comment Free Alternatives in Web-Application Mapping Software
nikto is an interesting one as well.
Oct
7
comment Is Password Complexity required at all
@RichardPetheram Hashing your passwords is precisely to protect against an attacker somehow managing to compromise your database. If you assume a magical fantasy world where your server is zero-day free and your code is flawless, you don't need to hash your passwords to protect it.
Oct
7
comment Twitter's HTTP response vs Google's HTTP response
@Manishearth As they should. :P
Oct
6
comment Best way to allow sudo access when using ssh keys
@Lekensteyn I have corrected NOPASSWD. See idioms.thefreedictionary.com/any+old+thing for the phrase "any old user". Sure, sudo can allow execution as any user, not just root but that's really not that relevant...