5,266 reputation
621
bio website
location
age
visits member for 1 year, 11 months
seen 7 hours ago

1d
reviewed Approve suggested edit on DNS Spoofing vs DNS Cache Poisoning
1d
comment Principles of memory forensics tools
Good answer. I would add that memory analysis is similar to the action of a debugger or reverse engineering tool. It's a lot of work to catalog all the different compilers, libraries, and how they all produce code, and building this knowledge is expensive. They tend to hold onto this as their "secret sauce", so user3127632 may not find too much more info on the details.
Jul
22
comment Hashing a credit card number for use as a fingerprint
@staticx, no, you cannot create a valid track 1 that will pass authorization unless you have the correct CVV. The bank will reject it. The PAN is less risky to keep than the CVV.
Jul
21
comment Hashing a credit card number for use as a fingerprint
@staticx, it's not ridiculous. The CVV data in the track is used as "evidence" that the mag stripe was present for the transaction, as opposed to the CVV2 number, which only indicates a human saw it. Banks assign less risk to Card Present transactions, so the retailer gets a reduced rate on processing them. Keeping CVV2 would let a retailer commit fraud.
Jul
21
comment Hashing a credit card number for use as a fingerprint
And Braintree. But honestly, no one is interested in this vulnerability, because removing it would necessarily kill the business justification.
Jul
17
comment Hashing a credit card number for use as a fingerprint
@staticx, the spec clearly states the PAN is customer data, just like cardholder name, and is not in the sensitive data column. Track data is sensitive because it contains CVV, not because it contains PAN.
Jul
17
comment Hashing a credit card number for use as a fingerprint
Actually, it's permitted, because the PAN isn't on that list of sensitive data (see page 12.) Sensitive data is either full track data, CAV2/CVC2/CVV2/CID, or PIN blocks. (Disclaimer: I am not a QSA, consult your QSA for your own situation.)
Jul
17
answered Hashing a credit card number for use as a fingerprint
Jul
16
answered Client Authentication Certificate Not Expiring, but “parent” cert IS
Jul
15
answered Is it ever possible to crack an encryption key character by character?
Jul
8
awarded  Necromancer
May
14
reviewed No Action Needed Why would you not permit Q or Z in passwords?
May
14
reviewed No Action Needed Why do I hear about so many Java insecurities? Are other languages more secure?
May
14
reviewed No Action Needed Why would you not permit Q or Z in passwords?
May
14
reviewed No Action Needed Why would you not permit Q or Z in passwords?
May
14
reviewed No Action Needed Why would you not permit Q or Z in passwords?
May
14
reviewed Leave Open Adding a SSL builds trust with technical clients?
May
14
reviewed Leave Open Protecting local admin password against 3rd party software
May
14
reviewed Leave Open Can anybody explain XSS?
May
14
reviewed Close A Google owned IP address accessed my outlook account