1,434 reputation
510
bio website ewanm89.co.uk
location United Kingdom
age 25
visits member for 3 years, 5 months
seen 16 hours ago

I code for fun, mostly self taught, both high and low level. Also self taught in various aspects of information security. Love the puzzles.


Jul
11
comment Taking password letters not whole one, is this secure?
@lynks HSM is one part of a system as a whole. asking for individual characters to stop keylogging, then having to use a HSM as it's the only maybe secure method to store the password so it can still be broken into individual parts, I have nothing against HSMs in general. What I am against is using one as the only means of any defence to fix another problem and failing to fix that original problem anyway.
Jul
11
comment Taking password letters not whole one, is this secure?
@lynks Yet you still have failed to show it is any better than crypto at stopping keylogging attacks, which is what such systems banks are using pretend to do.
Jul
11
comment Taking password letters not whole one, is this secure?
@lynks, and you can guarantee 100% that there is no physical way to extract them. In fact, my experience of these things is that the manufacturers keep it secret how they actually store the data. However the point of the system is to stop keylogger getting password fails anyway, one just has to log multiple login attempts.
Jul
11
comment Taking password letters not whole one, is this secure?
@Polynomial not all, NatWest for example asks characters x, y and z from password and digits n, m and o from a separate pin. The idea is to stop key loggers getting the pass, but it is total fail for multiple reasons. 1) it doesn't take many logs to piece together most or the whole of the pass, 2) even using black box hardware storage, the pass needs to be either encrypted, plaintext or individual characters hashed. How long does it take to generate hash for all characters of 7 bit ANSI at 2.75 million sha1 hashes a second?
Jun
30
comment Security of running openpgp.js in a browser with the private key in HTML5 localStorage
Key management is also a problem, there is nothing in javascript to make it possible to deliberately write to a specific section of memory, meaning keys may remain in active memory long after they are no longer required.
Jun
30
awarded  Yearling
Jun
29
comment If hashing is one way, why can we decrypt MD5 hashes?
@drjimbob I'm sure I can find a collision before that with rainbow tables. Used to be a time when Google had indexed at least one collision of most md5 hashes until the modified their search input to ignore hex strings of certain lengths.
Jun
25
suggested suggested edit on Key size difference between AES and RSA
Jun
16
comment Licensing/selling digital certificate to another company
Why can't the large software company go to microsoft/apple... and get there own digital certificate? There is no reason ever to sell such a certificate that is in your name/your companies name unless you are selling full control of the company and name. Even then, revoke and let them get a new one under the name is a better option.
Jun
9
comment Stopping spam and worms with SPF
I would point out that perfectly legitimate emails can be erroneously caught by SPF too, say registration confirmation or password reset email sent direct from webserver that has different IP address than the mail server).
Jun
9
comment Who can view my https browsing habbits?
you missed off good sslstrip attacks, who cares about encryption when the browser will even connect just fine without it. And most users wouldn't notice.
Jun
3
comment How can a system enforce a minimum number of changed characters in passwords, without storing or processing old passwords in cleartext?
One could generate and save the hashes of "similar" passwords, or run such an algorithm on the new pass and see if it figures the old pass is similar. More likely they are saving the last n passwords and checking the hash doesn't match any of them.j
May
27
comment the Informix password crack
hash_type== sha-256 there is the hashing algorithm used, not sure exactly how they are appending salt, but trying various common methods would probaby gain that information. Finally, the output looks like it is base64 encoded.
May
27
comment Is AES more secure than Rijndael?
AES is Rijndael with some parameters specifically set to safe choices.
May
26
comment Why do we allow SSL certificates to be replaced before their expiry date, without revokation of others?
cert patrol addon to firefox attempts to do that: addons.mozilla.org/en-US/firefox/addon/certificate-patrol though it doesn't solve the situation 100% as the first connection could be attacked.
May
25
comment How long does it take after a card is skimmed (unknowingly) at an ATM for the thief to be able to steal cash from the account?
I would add skimmers usually target busy atm's and do it in batches, leaving the skimming in place for several hours just collecting data. And use a different machine (or even another country) to withdraw the money some time later.
May
16
comment Backup schedule for Encryption Keys
This also depends on how one is doing the backup? If one went to the bank to put a USB memory stick in safety deposit box every week, And once a year when keys change they take 2 USB memory sticks instead, it is not likely that an attacker would notice it.
Apr
30
comment How does an offline CA revoke certificates?
Yeah, unfortunately most of us can't afford a local caesium clock. However wouldn't a GPS timesource for maintaining sync be acceptable?
Apr
23
comment How can browser select suggestions for my private searches?
@Luc except that you are the only one at that IP address or in that block that regularly disables JavaScript?
Apr
20
comment If someone steals my laptop while I'm logged in, how can I protect my browser?
Full disk encryption is a possibility too. But a good attacker would know how to do a cold boot attack to solve it. Ultimately physical access == no security.