ewanm89

1,258 reputation

210

bio	website	ewanm89.co.uk
	location	United Kingdom
	age	24
visits	member for	1 year, 10 months
	seen	yesterday
stats	profile views	125

I code for fun, mostly self taught, both high and low level. Also self taught in various aspects of information security. Love the puzzles.

	1,258 reputation	bio	website	ewanm89.co.uk	visits	member for	1 year, 10 months
210 badges		location	United Kingdom		seen	yesterday

summary answers questions tags badges favorites bounties reputation activity

544 Actions

suggestions reviews revisions comments badges posts accepts all

Dec 1	comment	Impact of Mathew Garrett's Secure GRUB Bootloader on UEFI Secure Boot The enforced UEFI secure boot as microsoft is trying to enforce it's not how it's designed anyway. It's originally designed for the administrators of a system to configure and control. Not OEMs.
Nov 28	comment	How to safely synchronize time over Internet? @Iszi That was only an issue on systems that didn't implement full NTP spec. Like windows which only uses SNTP.
Nov 26	comment	TOR and sniffing data Technically TOR nodes are proxy servers.
Nov 25	answered	sanesecurity - clamav - getting a false positive - should I bother?
Nov 25	comment	sanesecurity - clamav - getting a false positive - should I bother? Also the sanesecurity signature files are freely available, so you could try to run them yourself.
Nov 25	comment	sanesecurity - clamav - getting a false positive - should I bother? ClamAV is an opensource antivirus scanning engine: clamav.net/lang/en SaneSecurity provide third party signature files for it that are designed to pickup phishing emails and other similar spam. You should probably report false positives but only if you are sure that's the issue. He should be able to check his mail server logs to see that.
Nov 24	comment	If a port is closed how come you can still use it? Or a NAT router which is even more likely. And has the same effect.
Nov 24	comment	If a port is closed how come you can still use it? By any chance is it the public IP of a NAT router you tested against?
Nov 24	comment	How secure is aSSL (javascript)? Does it effectively mimic SSL? The already like to stick padlock icons on the page uselessly, oh and a button that says "log in to our secure server" is no better.
Nov 22	comment	Is Visa PayWave secure? And there are apps available for android for grabbing track data from RFID credit cards.
Nov 21	comment	Is Android's Password Screen Lock Enough Data Theft Protection? @CyrilN Yeah, do that too, it's the first that always counts. Smudges are an issue for pin and password too though, as they can see which "keys" were pressed, just not the order.
Nov 20	comment	Is snail mail or HTTPS webmail safer for sensitive information? SpellingD: I'm surprised it doesn't specify government courier?
Nov 20	comment	Are password reset links that don't expire a security risk? @AustinDeVinney you must store them somewhere, a file on the system is still a form of database. Also there is no guarantee that the user doesn't wipe session cookies (browser set to automatically on exit and user exits it before loading mail client?) or other session information so session specific memory is going to cause issues.
Nov 20	comment	Are password reset links that don't expire a security risk? 1) Hash the reset token when storing it in the database. 2) Add an expiration date so that a 5 year old one still in someone's mailbox isn't still valid.
Nov 20	comment	Are password reset links that don't expire a security risk? You should salt and hash the reset link while it's stored in the database anyway, treat it as a temporary password that way. Anything that acts as a password should be treated like one in your storage.
Nov 20	comment	Is Android's Password Screen Lock Enough Data Theft Protection? @D.W. depends, if they are using custom ROMS and such, or if they do use it for development from time to time. Most the time I use mine as an end user, doesn't mean I never use the USB debug. No it's not all users but there are some. Developers should be warned not to leave USB debug turned on.
Nov 20	comment	Is Android's Password Screen Lock Enough Data Theft Protection? It does between 4 and 16 characters, certain characters aren't allowed.
Nov 20	comment	Is Android's Password Screen Lock Enough Data Theft Protection? @CyrilN. easiest method to counter that is to move your finger around in other patters after unlocking or clean the screen...
Nov 20	comment	How do you explain the necessity of “nuke it from orbit” to management and users? @BruceEdiger There is proof of concept malware that can even hid in the laptop battery making a reinstall from scratch ineffective, luckily it's proof of concept. All it takes is a little fiddling with the MBR and it's very difficult to detect and will be able to reinstall itself each boot. There are numerous other places in the system for malware to hide, the problem is and always has been finding them all.
Nov 19	comment	What sort of security method is this called (if it has a name)? Hmm, bruteforce likely gets authenticated in one attempt... After all the first answer it's likely to give is probably wrong.