1,424 reputation
410
bio website ewanm89.co.uk
location United Kingdom
age 25
visits member for 3 years, 3 months
seen 1 hour ago

I code for fun, mostly self taught, both high and low level. Also self taught in various aspects of information security. Love the puzzles.


Jul
11
comment Taking password letters not whole one, is this secure?
@Polynomial not all, NatWest for example asks characters x, y and z from password and digits n, m and o from a separate pin. The idea is to stop key loggers getting the pass, but it is total fail for multiple reasons. 1) it doesn't take many logs to piece together most or the whole of the pass, 2) even using black box hardware storage, the pass needs to be either encrypted, plaintext or individual characters hashed. How long does it take to generate hash for all characters of 7 bit ANSI at 2.75 million sha1 hashes a second?
Jun
30
comment Security of running openpgp.js in a browser with the private key in HTML5 localStorage
Key management is also a problem, there is nothing in javascript to make it possible to deliberately write to a specific section of memory, meaning keys may remain in active memory long after they are no longer required.
Jun
30
awarded  Yearling
Jun
29
comment If hashing is one way, why can we decrypt MD5 hashes?
@drjimbob I'm sure I can find a collision before that with rainbow tables. Used to be a time when Google had indexed at least one collision of most md5 hashes until the modified their search input to ignore hex strings of certain lengths.
Jun
25
suggested suggested edit on Key size difference between AES and RSA
Jun
16
comment Licensing/selling digital certificate to another company
Why can't the large software company go to microsoft/apple... and get there own digital certificate? There is no reason ever to sell such a certificate that is in your name/your companies name unless you are selling full control of the company and name. Even then, revoke and let them get a new one under the name is a better option.
Jun
9
comment Stopping spam and worms with SPF
I would point out that perfectly legitimate emails can be erroneously caught by SPF too, say registration confirmation or password reset email sent direct from webserver that has different IP address than the mail server).
Jun
9
comment Who can view my https browsing habbits?
you missed off good sslstrip attacks, who cares about encryption when the browser will even connect just fine without it. And most users wouldn't notice.
Jun
3
comment How can a system enforce a minimum number of changed characters in passwords, without storing or processing old passwords in cleartext?
One could generate and save the hashes of "similar" passwords, or run such an algorithm on the new pass and see if it figures the old pass is similar. More likely they are saving the last n passwords and checking the hash doesn't match any of them.j
May
27
comment the Informix password crack
hash_type== sha-256 there is the hashing algorithm used, not sure exactly how they are appending salt, but trying various common methods would probaby gain that information. Finally, the output looks like it is base64 encoded.
May
27
comment Is AES more secure than Rijndael?
AES is Rijndael with some parameters specifically set to safe choices.
May
26
comment Why do we allow SSL certificates to be replaced before their expiry date, without revokation of others?
cert patrol addon to firefox attempts to do that: addons.mozilla.org/en-US/firefox/addon/certificate-patrol though it doesn't solve the situation 100% as the first connection could be attacked.
May
25
comment How long does it take after a card is skimmed (unknowingly) at an ATM for the thief to be able to steal cash from the account?
I would add skimmers usually target busy atm's and do it in batches, leaving the skimming in place for several hours just collecting data. And use a different machine (or even another country) to withdraw the money some time later.
May
16
comment Backup schedule for Encryption Keys
This also depends on how one is doing the backup? If one went to the bank to put a USB memory stick in safety deposit box every week, And once a year when keys change they take 2 USB memory sticks instead, it is not likely that an attacker would notice it.
Apr
30
comment How does an offline CA revoke certificates?
Yeah, unfortunately most of us can't afford a local caesium clock. However wouldn't a GPS timesource for maintaining sync be acceptable?
Apr
23
comment How can browser select suggestions for my private searches?
@Luc except that you are the only one at that IP address or in that block that regularly disables JavaScript?
Apr
20
comment If someone steals my laptop while I'm logged in, how can I protect my browser?
Full disk encryption is a possibility too. But a good attacker would know how to do a cold boot attack to solve it. Ultimately physical access == no security.
Apr
13
comment Aviation security - Lessons to learn from PlaneSploit
Sanatize, verify and authenticate all incoming communication. Same as any system. The problem is the NAA's (FAA, CAA, CASA, TC...) need to wake up and realise this.
Apr
11
comment Microsoft Office 2013 File Encryption
I would like to add, if the attacker is prepared and comes with some liquid nitrogen, he can maintain the state of the memory modules for several hours before they degrade too much to rip the encryption key in a cold boot attack. Though truecrypt and such deliberately scrub that area of RAM on proper shutdown.
Apr
8
comment Man-in-the-middle Blue coat proxy ssl or what?
no, it depends on jurisdiction and contract terms, whether the employer is allowed to do it at all. Let alone without consent. in most cases consent for such stuff is folded into something else you signed.