1,404 reputation
410
bio website ewanm89.co.uk
location United Kingdom
age 25
visits member for 3 years, 1 month
seen 2 days ago

I code for fun, mostly self taught, both high and low level. Also self taught in various aspects of information security. Love the puzzles.


Jun
30
awarded  Yearling
Jun
3
comment Why is it difficult to break RSA?
I thought shors algorithm did efficiently allow factorisation, of course it can't be run on classical computers and quantum machines running it have managed to factorise the number 21 before decoherence set in. So i think 2048 numbers are safe for a while.
Mar
1
comment How can I Hide my Public IP Address
I would like to add that in the case of a proxy the proxy itself must know the ip address. 2 of the isp's records/logs are good enough then it is technical possible to the physical endpoint of the cable. Wireless networks are a little less accurate but down to the cell/access point location is possible.
Jan
28
comment Should login pages be cacheable?
Only issue I see is if one is injecting a random unique anti CSRF token/nonce onto the page. In that case, part of the login information is the token embedded in the form html.
Jan
14
comment Forward secrecy for kids
Agreed but who said scouts needed 1024 bit security, as a learning tool it wouldn't be bad. I doubt they are using something like AES at the moment.
Jan
14
comment Forward secrecy for kids
Hmm, why couldn't scouts do a difi-hellman key exchange? It isn't actually all that hard to calculate require only raising to the power and modulo other than the initial random integer generations.
Jan
8
comment Is data exposed in a CSRF attack?
All this is assuming there isn't a same origin policy exploit available on that users browser. Exploiting same origin policy makes it a cross site scripting attack.
Nov
21
comment How does HSBC's “Secure Key” actually work?
@scorpion there are two different types in user in the UK by various banks. They look similar but work it different ways. 1) put there card in type in the pin, card verifies it and spots out a cryptographical prng generated output only valid for given nonce. Server runs same algorithm and verifies answers match. 2) works the same way but smartcard chip already embedded doing away with the external card reader.
Oct
19
answered Why are security-crucial software written in unsafe languages?
Oct
10
comment How secure is automatic authentication in Skype?
Inventing your own and keeping it hidden even with a good group of cryptographers is not a good thing. All cryptographers make mistakes, this leads to axiom 1, don't invent your own crypto, just ask don't about ps3 issues. The fact they won't publicly disclose is suggesting they are relying on security through obscurity, axiom 2, security should rely entirely on a single secret key not that the whole process is kept secret.
Oct
10
comment How secure is automatic authentication in Skype?
"top most security algorithms", what do you mean by throw? Do you mean best, most secure... Microsoft invents there own crypto and then keeps the details secret, therefore it is not as well vetted by the security community. There could be make weaknesses in the latest NTLM algorithm for example.
Sep
17
comment How should I defend against TightVNC brute-force attacks?
@broiyan With physical access and all bets are off anyway.
Sep
9
revised Explain real world symmetric key encryption
added 1 characters in body
Sep
8
answered Explain real world symmetric key encryption
Sep
8
revised How can we trust PKI, for example, Verisign?
added 747 characters in body
Sep
8
answered How can we trust PKI, for example, Verisign?
Jul
11
comment Taking password letters not whole one, is this secure?
@lynks HSM is one part of a system as a whole. asking for individual characters to stop keylogging, then having to use a HSM as it's the only maybe secure method to store the password so it can still be broken into individual parts, I have nothing against HSMs in general. What I am against is using one as the only means of any defence to fix another problem and failing to fix that original problem anyway.
Jul
11
comment Taking password letters not whole one, is this secure?
@lynks Yet you still have failed to show it is any better than crypto at stopping keylogging attacks, which is what such systems banks are using pretend to do.
Jul
11
comment Taking password letters not whole one, is this secure?
@lynks, and you can guarantee 100% that there is no physical way to extract them. In fact, my experience of these things is that the manufacturers keep it secret how they actually store the data. However the point of the system is to stop keylogger getting password fails anyway, one just has to log multiple login attempts.
Jul
11
comment Taking password letters not whole one, is this secure?
@Polynomial not all, NatWest for example asks characters x, y and z from password and digits n, m and o from a separate pin. The idea is to stop key loggers getting the pass, but it is total fail for multiple reasons. 1) it doesn't take many logs to piece together most or the whole of the pass, 2) even using black box hardware storage, the pass needs to be either encrypted, plaintext or individual characters hashed. How long does it take to generate hash for all characters of 7 bit ANSI at 2.75 million sha1 hashes a second?