382 reputation
111
bio website
location Norway
age
visits member for 3 years, 8 months
seen Dec 18 at 13:24

whitehat


Dec
18
comment Is SSL more secure than encoding?
I was referring to the expression "security by obscurity", which I don't find to have anything to do with real security. I think we agree, but maybe not on the meaning of the expression :P
Dec
18
comment Is SSL more secure than encoding?
What you're describing is "security by obscurity". While it might fool the "internet cafe owner", it most certainly won't withstand the scrutiny of any security research.
Sep
24
awarded  Autobiographer
May
23
awarded  Popular Question
Jan
22
comment Swap file may contain sensitive data
Lets say I set up Debian with encrypted LVMs (standard setup) would that mean this is set up?
Jan
19
awarded  Citizen Patrol
Jan
19
comment Swap file may contain sensitive data
Nice one. Is there a similar easy fix for Linux without using protected memory?
Jan
13
comment UNION SQL Injection
you need to close the query before the comment
Nov
24
comment What are the main weaknesses of mobile software based OTP generators?
Agreed. It would be easy to reverse engineer the OTP-generation algorithm and learn future passwords.
Aug
14
awarded  Caucus
Aug
14
comment Is this a ViewState attack?
Is this the only occurrence from this IP? For me the suspicious part is the " ' " character, which is often used for probing SQL injection vulnerabilities.
Apr
17
awarded  Yearling
Mar
8
comment How to perform security exploits/penetration on devices like iPhone's, PSP's, and Android to run your owncode?
No need to apologize :) I like the question, but maybe it should be broken into multiple more specific ones. And I too am very interested in this topic. For reference I've been testing Android apps and this might point you in the right direction for that: intrepidusgroup.com/insight/2011/05/androidaudittools and wsec.be/blog/2011/10/05/adventures-in-pentesting-android-apps
Mar
7
comment How to perform security exploits/penetration on devices like iPhone's, PSP's, and Android to run your owncode?
I think you should be more specific - as each device is different, how you exploit or pentest each device is inherently different. At least technically. Many of the principles are of course the same as with all clients, be it a Windows computer or an Android device.
Feb
22
comment Is accessing bank account on the internet really secure?
@AviD just a typo, I meant authentication of course. But in Norway where I'm from I have not heard of any bank that don't use two-factor authentication. I actually thought that was a requirement for PCI compliance, but of course it might just be an "extra service" our banks provide.
Feb
19
comment Does strong naming remove the need for packing/obfuscation?
I agree you are right. However everywhere I read about them they're presented as a security feature.
Feb
19
revised Does strong naming remove the need for packing/obfuscation?
added 7 characters in body
Feb
19
revised Does strong naming remove the need for packing/obfuscation?
Edited to add answer
Feb
16
accepted Does strong naming remove the need for packing/obfuscation?
Feb
16
comment Does strong naming remove the need for packing/obfuscation?
Okay, so long as the attacker has control over its GAC they will be able to do this. I'm accepting this answer.