1,414 reputation
410
bio website ewanm89.co.uk
location United Kingdom
age 25
visits member for 3 years, 2 months
seen yesterday

I code for fun, mostly self taught, both high and low level. Also self taught in various aspects of information security. Love the puzzles.


Mar
31
comment What technical reasons are there to have low maximum password lengths?
In other words, modern algorithms implemented properly and there is absolutely no reason for a maximum password limit, other than to make it not completely insane (lets see, say a 1MB long password?). Old Windows NT LANMAN hashes had similar problems with being a maximum of 14 characters which are split into 2x 7 character passwords and hashed without salting.
Mar
22
comment Spike in TCP port 5904 activity - what for?
Yes, though, it's only likely that VNC will only be using 5904 in thin client systems. VNC main listen is on 5900 and it spawns a port for each display server sequentially up from that, so 5904 is not 'till the 4th display server.
Mar
16
comment Why not allow spaces in a password?
Of course in all cases random nonsensical strings of words or characters of sufficient length is more secure than non random. but with characters people also make them make sense, and there are less combinations that make sense. after all all are consonant sound, vowel sound consonant sound, vowel sound phonetically. There are less ways to connect a string to make a memorable word especially as we tend to be taught to read/write phonetically.
Mar
16
comment Why not allow spaces in a password?
@PatrickM that would depend if the attacker knew you were using a phrase or not. If an attacker had a phrase dictionary of the most commonly used phrases it is the same as a dictionary of most commonly used passwords.
Mar
15
comment Why not allow spaces in a password?
yes, but that is no different from people using password as there password... the same issues apply, sentences are easier to remember and can have vast varying meanings with a higher number of possibilities using the most common in either case is always bad as it is going to be the first the attacker is going to try.
Mar
15
comment Why not allow spaces in a password?
I bet whatever language processing the page has standard library functions for trimming leading and trailing white space characters.
Mar
15
comment Why not allow spaces in a password?
Sentences for passwords aren't all that insecure there are more possible ways of stringing together 5 words from a dictionary of ~250,000 words than 5 characters from a character set of 128 characters (ASCII). Even if we only choose combinations of words that have meaning against random individual characters there happens to be more entropy, the problem is some phrases are likely to be more common than others is also an issue with character strings used as passwords. Finally refusing space doesn't stop the use of a sentence, just don't put the spaces between the words.
Mar
11
comment Is authentication using personal pictures more secure than passwords?
@StephenTouset which is the same issue with biometric data.
Mar
11
answered Is authentication using personal pictures more secure than passwords?
Mar
6
comment Is it bad practice to send decryptable data?
it is not a hash if it is "decryptable" a hash is defined mathematically as a one way function, by being "decryptable" it is now a 2 way functions. And one, don't on invent your own cryptography you are likely to make numerous mistakes and the cryptanalyst's will have a field day, two don't implement your own cryptography you are likely to make a mistake there too. Use tools already provided by those in the field like SSL encrypt with whatever the server provides.
Mar
5
comment Passwords Being Sent in Clear Text Due to Users' Mistake in Typing it in the Username Field
Those of us who can type without looking at the keyboard can make that mistake too. Usually we also don't actually need to look at the screen and if one is slightly distracted such a mistake is easy to make. This is the advantage of the windows XP Home edition and later interface where it is a menu of users to pick from. Of course, not useful with more than a handful of users.
Mar
4
comment Anything to do about old gpg keys?
I wonder what the expiration date was set to on those keypairs... Chances are they've long since expired.
Mar
3
comment Choosing an SSL certificate provider
Both Verisign (the SSL part) and Thawte are subsidiaries of Symantec.
Mar
3
comment Windows Update - Interception
yes windows update has it's own pinned certificate list to stop such intercepts. However there is Windows Server Update Services which is run as a server inside a network so only one place needs to download the updates across the WAN to distribute to the whole LAN. How it gets over the SSL certificate issue I'm not sure.
Mar
2
answered Why we use GPG signatures for file verification instead of hash values?
Mar
2
comment how to bypass “header” in php
@Maerlyn that is part of the problem in the article.
Mar
1
revised Normalizing Windows Advanced Firewall rules
edited tags
Feb
23
comment Why are iframes allowed at all in modern browsers?
Yeah, those payment things trigger all of NoScript's XSS warnings every time too.
Feb
21
comment Why are iframes allowed at all in modern browsers?
Embedding a youtube video isn't legitimate? With an iframe I can just add the video and let youtube worry about whether to serve the user the HTML5 or Flash version for example.
Feb
9
comment For a desktop application, why use an SSL certificate from a trusted authority?
One could use their own CA in the application as long as it is verified properly. This would allow some level of revocation. Of course one still needs to find some way to authenticate the initial download of the application.