1,434 reputation
510
bio website ewanm89.co.uk
location United Kingdom
age 25
visits member for 3 years, 5 months
seen yesterday

I code for fun, mostly self taught, both high and low level. Also self taught in various aspects of information security. Love the puzzles.


Mar
1
revised Normalizing Windows Advanced Firewall rules
edited tags
Feb
23
comment Why are iframes allowed at all in modern browsers?
Yeah, those payment things trigger all of NoScript's XSS warnings every time too.
Feb
21
comment Why are iframes allowed at all in modern browsers?
Embedding a youtube video isn't legitimate? With an iframe I can just add the video and let youtube worry about whether to serve the user the HTML5 or Flash version for example.
Feb
9
comment For a desktop application, why use an SSL certificate from a trusted authority?
One could use their own CA in the application as long as it is verified properly. This would allow some level of revocation. Of course one still needs to find some way to authenticate the initial download of the application.
Feb
7
comment Our logs showing a lot of SSH brute force attacks originating on Port 11
@ZachOfAllTrades that would only apply to destination port not source port which is set to port 11. And I doubt there are enough computers running systat to even bother attempting to find one.
Feb
7
comment Our logs showing a lot of SSH brute force attacks originating on Port 11
I know some machines fingerd is still running on... No, I don't own them.
Feb
7
comment Our logs showing a lot of SSH brute force attacks originating on Port 11
Or the attacker is on a windows machine with no such low port restriction? Now I wonder how many more of us would have had to look up which abandoned service used that port.
Feb
3
comment After How Much Data Encryption (AES-256) we should change key?
@DeepeshM it's mostly out of a misguided notion that if it is compromised, it is only compromised for a maximum of 90 days when the keys are all changed. Therefore limiting the breach to that period. Of course, unless the initial breach is fixed, all the attacker has to do is repeat every 90 days to compromise the new keys. If he didn't add a backdoor in the first time.
Feb
3
comment After How Much Data Encryption (AES-256) we should change key?
@CodesInChaos well, that also depends on block mode, but lets guess it's one where a sequentially increasing iv (say CTR mode), all we need do is use a >=64bit long IV, and we'll also be at 2^64 blocks before that repeats.
Feb
3
comment Received a Kindle from a stranger, what are the risks?
Yeah, and watch them take it, stick it in a room somewhere never to be seen of again. All because the police have no idea what to do with it.
Jan
29
comment Mutual authentication for humans
The best Eve/Mallory could do is MITM the authentication, just use two connections simultaneously and relay the challenge/response pairs.
Jan
28
comment Are services like “LastPass” less secure, as they have all my passwords protected by a single password?
<sarcasm>Javascript encryption is real secure</sarcasm> please see: security.stackexchange.com/questions/24423/…
Jan
28
comment Are services like “LastPass” less secure, as they have all my passwords protected by a single password?
One could have multiple password databases, a high security one and medium and a low with there own master passwords? It's still better than password reuse, and there is no longer a single point of failure.
Jan
28
comment How to treat non-optional bad security questions?
So, random data stored in password manager along with passwords good enough? @Callum yeah, I know a few banks that do that.
Jan
21
comment Can law enforcement track a criminal through dynamic IP address?
Maintaining better backups is also recommended.
Jan
21
comment How is it possible that a virus can infect the system if the browser is started with non-admin rights
Through a privilege escalation exploit. Admin rights are needed to actually do a lot of things, a layer sits between with functions programs can use without admin rights to trigger actions which do. These layers are not flawless and have vulnerabilities in them enabling them to be exploited to escalate the privileges of a process.
Jan
19
comment is there better email, file, disk encryption than PGP?
@ZippyZeppoli The NSA should have more important targets than you and other uses for supercomputers. And for the US government, $2 billion is remarkably cheap...
Jan
18
comment is there better email, file, disk encryption than PGP?
Not to mention there are plenty of ways to get the data without breaking the encryption, usually it's easier to either get the user to use your encryption keys, or get the user to give the key/access to the data. This is why good key management is important, and I haven't gone into what can be done with physical access yet.
Jan
14
comment In SSL/TLS, how is the authenticity of a server's certificate verified?
The certificate authority is entirely irrelevant after the initial check, TACK alone is enough to verify that only valid changes have been made in terms of key changes and such. It does exactly that, check the key hasn't been changed by an adversary. but if the key hasn't been changed by an adversary and you can verify that, and you've previously verified the key belongs to that server. What use is a certificate authority at this point?
Jan
14
comment How traceable is ATM and point-of-sale credit card use back to you in practice?
@superuser I bet they traced the card number (if a card was used) and particular ATM used. I expect the actual guy was using someone else's card or a hack that doesn't require a card and was long gone by the time the police got to the ATM.