meta user
network profile
| bio | website | ewanm89.co.uk |
|---|---|---|
| location | United Kingdom | |
| age | 24 | |
| visits | member for | 1 year, 11 months |
| seen | 21 hours ago | |
| stats | profile views | 125 |
I code for fun, mostly self taught, both high and low level. Also self taught in various aspects of information security. Love the puzzles.
|
Dec 19 |
comment |
Changing user account passwords from PHP script - vulnerabilities? If piping to another utility, why not pipe not passwd that is already installed? Not that it is a sensible idea in the first place, why not use a proper separate email database? You don't think google create system accounts for every gmail account do you? |
|
Dec 18 |
comment |
Does a renewed certificate open old messages? I assume we are talking S/MIME email here? |
|
Dec 18 |
comment |
Is there any way to differentiate between a normal web request and a web service request? What kind of security layer is it? Application level proxy/firewall or firewall with deep packet inspection properties or just a standard state-full firewall? |
|
Dec 18 |
comment |
Is there any way to differentiate between a normal web request and a web service request? A web service is just that a service that is accessed via HTTP... Technically the login form is a web service, I assume you mean that you have something replying JSON or XML to JSON or XML POST data, in which case you have to identify it the same way the web application does. Does it use a different ip address, domain name, specific page urlm always a different user agent (only works if there are dedicated clients, wouldn't rely on it at all and a javascript client will show as a standard web browser)... |
|
Dec 16 |
comment |
Password Manager - id_rsa as key file it's not 2048-bits of entropy though. That is why asymmetric keys are 1024-4096 bits long not 128bit - 512bit long keys. A 2048 bit RSA key pair is roughly equivalent to 112 bits of entropy, you might as well generate 128 bits of random data to use. |
|
Dec 15 |
comment |
Password Manager - id_rsa as key file As for centralising it, I just stick the encrypted keepass2 database in dropbox, should be no issues with keepass v.1 format files this way either. The only thing is one needs to make sure they reload the database (lock and unlock workspace in keepass2) if it has been changed on another machine. |
|
Dec 15 |
comment |
Password Manager - id_rsa as key file Yes, your keyfile should be random data, id_rsa is not random data, it is mathematically specific data. |
|
Dec 12 |
comment |
Can I safely trust my Anti-virus protection? @Mok-KongShen no, certainly not, infact when playing in CTF and red team/blue team wargames the security system is often a fun and common attack vector. Also Peiter C. Zatko (Mudge) in the keynotes for Shmoocon, Blackhat USA and Defcon conferences in 2011 went into his work at DARPA into how the biggest attack area is the thousands of lines of code in the massive IDS and firewall systems used in military information networks. |
|
Dec 12 |
comment |
Can I protect against keylogging by using the mouse? @Polynomial Well, trojan specifically refers to something the user installed thinking it was something else or partly was something else. |
|
Dec 12 |
comment |
Can I protect against keylogging by using the mouse? @Iszi not when it's on the USB cable going to hub both the keyboard and the mouse are plugged into... I'm considering how an iMac tend to be setup with the mouse plugged into the USB hub built into the apple keyboard. |
|
Dec 12 |
comment |
Can I protect against keylogging by using the mouse? Not to mention, an attacker could record mouse movements as easily as key presses. |
|
Dec 7 |
comment |
What are some steps to take for securing a Linux server that aren't in this list of obvious ones? Was it ubuntu server edition installed? Not desktop edition stripped? |
|
Dec 7 |
comment |
What are some steps to take for securing a Linux server that aren't in this list of obvious ones? Might add some SYN packet rate limiting on the IPTables firewall too, it won't stop a DDoS attack, but it it can help weather the effects. |
|
Dec 6 |
comment |
Is there a way to negotiate a secret between 2 parties with no prior knowledge? Well, with SSH one should check the key fingerprint via a side channel on that first connect. |
|
Dec 5 |
revised |
Eavesdropping in VoIP. Any other software besides Ethereal? added 282 characters in body |
|
Dec 5 |
answered | Eavesdropping in VoIP. Any other software besides Ethereal? |
|
Dec 3 |
comment |
How do certification authorities store their private root keys? Yeah, it's not like diginotar was hacked, and comodo has lost control of one of it's subsidiary certificates before now. They are supposedly audited before they are trusted by major browsers, but the system is not flawless and it only takes one bad CA to ruin the whole system. And I expect even at the more reputable CA's the executives like to cut corners and costs at every turn they can. |
|
Dec 3 |
comment |
Securely publishing GPG keys This is what certificates and web of trust is for. Either that or you can verify the keys via a side channel (other person rings you up and reads the key fingerprint out over the phone and you confirm it). |
|
Dec 3 |
comment |
Choosing a session ID algorithm for a client-server relationship I would point out that PHPs built in session generator isn't all that great, at least not until the RNG is replaced by a cryptographically secure one. |
|
Dec 3 |
comment |
What is the most common default security setting on most consumer and small business Wi-Fi routers? Most from ISPs have a default key generated from the particular serial number these days, open/wep/wpa depends entirely on routers age mostly. New models tend to have wpa if the wifi is on by default. Finally, so the automatic configuration tool on the CD the include in the box works, the serial number has been known to be broadcast and then the disc can run the generation algorithm itself, I'll let you consider the consequences of that. |
