3,315 reputation
11130
bio website ladadadada.net
location London, United Kingdom
age 33
visits member for 3 years, 1 month
seen 8 hours ago

I'm an Australian by birth but currently live in London. I'm a traveller at heart and I love seeing how different the rest of the world is. I'm always up for something new and interesting.

I've been playing with computers pretty much my whole life, working with them since 2000 in tech support and programming and as a full-time Sysadmin since 2006. I've been fascinated by security since about 2003 and I tend to become the default "security guy" at most places I have worked.

I enjoy all forms of sport and outdoors activities but particularly cycling, hockey, sailboarding, snowboarding, camping and Frisbee. I'm also passionate about the environment, growing my own food, cooking it and eating it.


Jan
9
reviewed Close What steps remain for a robust, neutral and surveillance-proof Internet?
Jan
6
reviewed Leave Closed How can I ensure that an android app was installed on a physical device and not an emulator?
Jan
2
reviewed Approve suggested edit on Should we bother with cell-level encryption for an ASP.NET/SQL Server web application?
Jan
1
reviewed Approve suggested edit on Question: How to plan email policy for start-ups?
Jan
1
reviewed Approve suggested edit on File system history on USB drives
Jan
1
reviewed Approve suggested edit on Ways to completely spoof browser user agent and hiding OS to a webserver
Dec
27
comment Using the same base string for a password in several different logins
Gaining multiple passwords for a single user is easier than you might think. See haveibeenpwned.com
Dec
15
reviewed Leave Open How can attacker bypass this dom xss filter?
Dec
15
comment Open VPN has DNS leak
What exactly do you mean by "Still have the leak", particularly in the case where you changed your DNS resolver to the one in Romania? Does DNSLeakTest show the DNS resolver in Romania or some other resolver?
Dec
15
revised Open VPN has DNS leak
Spelling, formatting, added link to www.dnsleaktest.com and the fix patch script and privacy tag.
Nov
26
reviewed Close Are there any reasons to be concerned about the security of “Coin”?
Nov
26
comment can one stop spam with my name but not my address
Have you tried switching on your provider's and your mail client's anti-spam systems? Most of them learn their mistakes when you mark an email as spam so do that and it will get better at blocking.
Nov
9
comment Is blocking UDP and TCP sufficient to prevent unwanted network activity?
In addition to other transport layer protocols such as AppleTalk and NetBIOS you also have a list of protocols at the network layer such as IPv6 and ICMP. Information can also be tunneled in or out using universally allowed services such as DNS. Whether these matter depends heavily on your threat model.
Nov
6
comment Cryptolocker: can servers be protected?
RAID is not a backup. It protects against failed disks but not many other problems. If you delete a file, how do you get it back?
Nov
6
comment How to secure a login.php file?
Some suggestions for improving the code (not an exhaustive list): The passwords are not hashed. They should be. There's plenty of code on Sec.SE to use for that. Choose a strong password hashing function, not MD5(). The logout function should also delete the session and expire the session cookie. There should be an exit() after the header() calls or the rest of the page will be executed before the response is sent and the redirect response will include the login form which is wasteful.
Nov
6
comment How to secure a login.php file?
Because even a leak of a strongly hashed password list is embarrassing. No leak at all is better.
Nov
6
comment How to secure a login.php file?
Restrictive file permissions would be another good addition. Only the web server user should have any (read, write or execute) access to the file.
Nov
6
comment How to secure a login.php file?
It might help to think about (and add to your question) who you are trying to secure the usernames and passwords from.
Nov
5
comment Cryptolocker: can servers be protected?
CryptoLocker holds your files to ransom doesn't it? For most servers I would just wipe and restore from backups. If the backups server was infected I would wipe/re-install and trigger a new system-wide full backup.
Nov
5
comment Is it important to keep my pastebin developer key private?
If someone wanted to cause grief for you, he could write a script that finds the new key as soon as you put it into your project and get it banned again within minutes. This could be quite an inconvenience.