1,394 reputation
310
bio website ewanm89.co.uk
location United Kingdom
age 24
visits member for 2 years, 9 months
seen Apr 15 at 0:17

I code for fun, mostly self taught, both high and low level. Also self taught in various aspects of information security. Love the puzzles.


Jun
29
comment If hashing is one way, why can we decrypt MD5 hashes?
@drjimbob I'm sure I can find a collision before that with rainbow tables. Used to be a time when Google had indexed at least one collision of most md5 hashes until the modified their search input to ignore hex strings of certain lengths.
Jun
25
suggested suggested edit on Key size difference between AES and RSA
Jun
16
comment Licensing/selling digital certificate to another company
Why can't the large software company go to microsoft/apple... and get there own digital certificate? There is no reason ever to sell such a certificate that is in your name/your companies name unless you are selling full control of the company and name. Even then, revoke and let them get a new one under the name is a better option.
Jun
9
comment Stopping spam and worms with SPF
I would point out that perfectly legitimate emails can be erroneously caught by SPF too, say registration confirmation or password reset email sent direct from webserver that has different IP address than the mail server).
Jun
9
comment Who can view my https browsing habbits?
you missed off good sslstrip attacks, who cares about encryption when the browser will even connect just fine without it. And most users wouldn't notice.
Jun
3
comment How can a system enforce a minimum number of changed characters in passwords, without storing or processing old passwords in cleartext?
One could generate and save the hashes of "similar" passwords, or run such an algorithm on the new pass and see if it figures the old pass is similar. More likely they are saving the last n passwords and checking the hash doesn't match any of them.j
May
27
comment the Informix password crack
hash_type== sha-256 there is the hashing algorithm used, not sure exactly how they are appending salt, but trying various common methods would probaby gain that information. Finally, the output looks like it is base64 encoded.
May
27
comment Which is more secure, AES or Rijndael?
AES is Rijndael with some parameters specifically set to safe choices.
May
26
comment Why do we allow SSL certificates to be replaced before their expiry date, without revokation of others?
cert patrol addon to firefox attempts to do that: addons.mozilla.org/en-US/firefox/addon/certificate-patrol though it doesn't solve the situation 100% as the first connection could be attacked.
May
25
comment How long does it take after a card is skimmed (unknowingly) at an ATM for the thief to be able to steal cash from the account?
I would add skimmers usually target busy atm's and do it in batches, leaving the skimming in place for several hours just collecting data. And use a different machine (or even another country) to withdraw the money some time later.
May
16
comment Backup schedule for Encryption Keys
This also depends on how one is doing the backup? If one went to the bank to put a USB memory stick in safety deposit box every week, And once a year when keys change they take 2 USB memory sticks instead, it is not likely that an attacker would notice it.
Apr
30
comment How does an offline CA revoke certificates?
Yeah, unfortunately most of us can't afford a local caesium clock. However wouldn't a GPS timesource for maintaining sync be acceptable?
Apr
23
comment How can browser select suggestions for my private searches?
@Luc except that you are the only one at that IP address or in that block that regularly disables JavaScript?
Apr
20
comment If someone steals my laptop while I'm logged in, how can I protect my browser?
Full disk encryption is a possibility too. But a good attacker would know how to do a cold boot attack to solve it. Ultimately physical access == no security.
Apr
13
comment Aviation security - Lessons to learn from PlaneSploit
Sanatize, verify and authenticate all incoming communication. Same as any system. The problem is the NAA's (FAA, CAA, CASA, TC...) need to wake up and realise this.
Apr
11
comment Microsoft Office 2013 File Encryption
I would like to add, if the attacker is prepared and comes with some liquid nitrogen, he can maintain the state of the memory modules for several hours before they degrade too much to rip the encryption key in a cold boot attack. Though truecrypt and such deliberately scrub that area of RAM on proper shutdown.
Apr
8
comment Man-in-the-middle Blue coat proxy ssl or what?
no, it depends on jurisdiction and contract terms, whether the employer is allowed to do it at all. Let alone without consent. in most cases consent for such stuff is folded into something else you signed.
Mar
31
comment What technical reasons are there to have low maximum password lengths?
@Polynomial bcrypt would only have the password length have any effect on CPU time on the first iteration IIRC and then it's just a single hash of 1MB of data (your server that slow to hash 1MB?). I think bandwidth is a lot more of a problem.
Mar
31
comment What technical reasons are there to have low maximum password lengths?
In other words, modern algorithms implemented properly and there is absolutely no reason for a maximum password limit, other than to make it not completely insane (lets see, say a 1MB long password?). Old Windows NT LANMAN hashes had similar problems with being a maximum of 14 characters which are split into 2x 7 character passwords and hashed without salting.
Mar
22
comment Spike in TCP port 5904 activity - what for?
Yes, though, it's only likely that VNC will only be using 5904 in thin client systems. VNC main listen is on 5900 and it spawns a port for each display server sequentially up from that, so 5904 is not 'till the 4th display server.