1,910 reputation
716
bio website 141.io
location United Kingdom
age 19
visits member for 2 years, 6 months
seen Oct 5 at 15:00

Hello there,

The essence of hacking to me is being enthusiastic about the inner workings of programmable systems or devices in-general, as opposed to just using abstracted features and facilities.#LifeHacker

I'm Rohan Durve and I go as Decode141 on the inter webs and beyond. Although I'm currently pursing my bachelors in computer security, I prefer to introduce myself as a white-hat, developer or a geek in-general aspiring to be a noble Information ninja (researcher, consultant and beyond).

My current work includes Offensive Security Testing, Exploit Development, Freelance Web Development, Programming and basic information security research. I love waking up to emails, so feel free to contact me for anything (apart from spam).

Thanks for stalking! ^_^"

-Decode141


Jun
20
awarded  Nice Answer
Jun
16
awarded  Yearling
May
30
awarded  Good Answer
May
23
comment Is it good idea to rely on Mifare UID for security/authorization reasons?
Eg. en.wikipedia.org/wiki/Oyster_card#Technology The entire London underground uses DESFire and surely if the the bussiness loss was very significant they would have switched by now.
May
23
comment Is it good idea to rely on Mifare UID for security/authorization reasons?
No RFID solution is completely secure. Money will always be lost. The only equation you need to consider is if it more profitable to invest in better security or resist damage from security compromises. If you go for a more secure solution, it will cost more. Let's say it costs you 2£ more for an RFID solution that will be cracked in the next 3 years (an optimistically long time). Per 1000 customers, you're now losing 2000£. Maybe if you used the MiFare DESFire you'd have sufferred loss from theft, but would it be more than this security investment?
May
23
comment Is it good idea to rely on Mifare UID for security/authorization reasons?
Everything will eventually be broken. Even if you invest in a more secure (and more expensive) RFID solution it will eventually be broken. 2FA is the only way to add good resilience. People trying to clone RFIDs for eCash are low in number not because you need a 300$ device, as there have been much cheaper solutions with successful clones from specific root'd Android phones, but rather the fact that you need the knowledge and proximity to someone's card to clone. If someone reports a erronious balance, replacing their card is cheaper than adopting more expensive solution for everyone.
May
19
revised Is it good idea to rely on Mifare UID for security/authorization reasons?
added 555 characters in body
May
19
answered Is it good idea to rely on Mifare UID for security/authorization reasons?
Mar
26
revised Why ARP Poising is not working for some sites?
'cuz grammar.
Mar
23
answered Why ARP Poising is not working for some sites?
Feb
21
comment What is the difference between ordinary XSS and Dom XSS vulnerabilities?
That's what the 2nd answer in that post was.
Jan
2
comment Is the concept of Authenticated Anonymity possible?
Yes, I agree, they can both serve in authentication mechanisms, but both biometrics and cash are examples of replicable objects. The question really is that if your biometrics or your government's processes and mechanisms to print currency are an open secret or not. If your iPhone fingerprint lock can be broken by a fingerprint clone of your actual finger, then the systems security lies in the secrecy of your fingerprint. Does it not?
Jan
2
comment Is the concept of Authenticated Anonymity possible?
I guess that's where I'm stuck then. As per my limited understanding, authentication is just a mechanism to try to associate two identities accurately. Eg. Allowing Rohan from irl access to Decode141 at Gmail for example. The way I see it even if you have an in-replicable physical object, the authentication fails if the object and its functioning become available to one other than the authorized party. Eg: The password is useless when it is no longer a secret. Could you point out where I'm going wrong?
Jan
2
comment validate file encryption without decryption key
I was basing the concept on the question author's concept. "both clients share that knowledge (without being aware of each other) but the service provider doesn't so still would not be able to encrypt." Just moving the hash check to be done before upload.
Jan
2
awarded  Nice Answer
Jan
2
comment Is the concept of Authenticated Anonymity possible?
"Guys, we're wasting our time, I'm pretty sure there's a cryptographic protocol designed exactly for this" - Some Wise Guy on DMZ.
Jan
1
revised Is the concept of Authenticated Anonymity possible?
spellings.
Jan
1
revised Is the concept of Authenticated Anonymity possible?
spellings.
Jan
1
answered Is the concept of Authenticated Anonymity possible?
Jan
1
revised validate file encryption without decryption key
deleted 31 characters in body