1,434 reputation
510
bio website ewanm89.co.uk
location United Kingdom
age 25
visits member for 3 years, 5 months
seen 11 hours ago

I code for fun, mostly self taught, both high and low level. Also self taught in various aspects of information security. Love the puzzles.


Nov
4
comment Read-Only Hard Drives
So booting from a CD will be good enough? Linux Live CDs have been a poor man's read only OS for write some time.
Nov
4
comment Is there a reason to use TrueCrypt over VeraCrypt?
In years from now, the basic integrity of the hard drive is likely to be suspect anyway, it does depend on drive type and model, but they all break down with time.
Jun
3
comment Why is it difficult to break RSA?
I thought shors algorithm did efficiently allow factorisation, of course it can't be run on classical computers and quantum machines running it have managed to factorise the number 21 before decoherence set in. So i think 2048 numbers are safe for a while.
Mar
1
comment How can I Hide my Public IP Address
I would like to add that in the case of a proxy the proxy itself must know the ip address. 2 of the isp's records/logs are good enough then it is technical possible to the physical endpoint of the cable. Wireless networks are a little less accurate but down to the cell/access point location is possible.
Jan
28
comment Should login pages be cacheable?
Only issue I see is if one is injecting a random unique anti CSRF token/nonce onto the page. In that case, part of the login information is the token embedded in the form html.
Jan
14
comment Forward secrecy for kids
Agreed but who said scouts needed 1024 bit security, as a learning tool it wouldn't be bad. I doubt they are using something like AES at the moment.
Jan
14
comment Forward secrecy for kids
Hmm, why couldn't scouts do a difi-hellman key exchange? It isn't actually all that hard to calculate require only raising to the power and modulo other than the initial random integer generations.
Jan
8
comment Is data exposed in a CSRF attack?
All this is assuming there isn't a same origin policy exploit available on that users browser. Exploiting same origin policy makes it a cross site scripting attack.
Nov
21
comment How does HSBC's “Secure Key” actually work?
@scorpion there are two different types in user in the UK by various banks. They look similar but work it different ways. 1) put there card in type in the pin, card verifies it and spots out a cryptographical prng generated output only valid for given nonce. Server runs same algorithm and verifies answers match. 2) works the same way but smartcard chip already embedded doing away with the external card reader.
Oct
10
comment How secure is automatic authentication in Skype?
Inventing your own and keeping it hidden even with a good group of cryptographers is not a good thing. All cryptographers make mistakes, this leads to axiom 1, don't invent your own crypto, just ask don't about ps3 issues. The fact they won't publicly disclose is suggesting they are relying on security through obscurity, axiom 2, security should rely entirely on a single secret key not that the whole process is kept secret.
Oct
10
comment How secure is automatic authentication in Skype?
"top most security algorithms", what do you mean by throw? Do you mean best, most secure... Microsoft invents there own crypto and then keeps the details secret, therefore it is not as well vetted by the security community. There could be make weaknesses in the latest NTLM algorithm for example.
Sep
17
comment How should I defend against TightVNC brute-force attacks?
@broiyan With physical access and all bets are off anyway.
Jul
11
comment Taking password letters not whole one, is this secure?
@lynks HSM is one part of a system as a whole. asking for individual characters to stop keylogging, then having to use a HSM as it's the only maybe secure method to store the password so it can still be broken into individual parts, I have nothing against HSMs in general. What I am against is using one as the only means of any defence to fix another problem and failing to fix that original problem anyway.
Jul
11
comment Taking password letters not whole one, is this secure?
@lynks Yet you still have failed to show it is any better than crypto at stopping keylogging attacks, which is what such systems banks are using pretend to do.
Jul
11
comment Taking password letters not whole one, is this secure?
@lynks, and you can guarantee 100% that there is no physical way to extract them. In fact, my experience of these things is that the manufacturers keep it secret how they actually store the data. However the point of the system is to stop keylogger getting password fails anyway, one just has to log multiple login attempts.
Jul
11
comment Taking password letters not whole one, is this secure?
@Polynomial not all, NatWest for example asks characters x, y and z from password and digits n, m and o from a separate pin. The idea is to stop key loggers getting the pass, but it is total fail for multiple reasons. 1) it doesn't take many logs to piece together most or the whole of the pass, 2) even using black box hardware storage, the pass needs to be either encrypted, plaintext or individual characters hashed. How long does it take to generate hash for all characters of 7 bit ANSI at 2.75 million sha1 hashes a second?
Jun
30
comment Security of running openpgp.js in a browser with the private key in HTML5 localStorage
Key management is also a problem, there is nothing in javascript to make it possible to deliberately write to a specific section of memory, meaning keys may remain in active memory long after they are no longer required.
Jun
29
comment If hashing is one way, why can we decrypt MD5 hashes?
@drjimbob I'm sure I can find a collision before that with rainbow tables. Used to be a time when Google had indexed at least one collision of most md5 hashes until the modified their search input to ignore hex strings of certain lengths.
Jun
16
comment Licensing/selling digital certificate to another company
Why can't the large software company go to microsoft/apple... and get there own digital certificate? There is no reason ever to sell such a certificate that is in your name/your companies name unless you are selling full control of the company and name. Even then, revoke and let them get a new one under the name is a better option.
Jun
9
comment Stopping spam and worms with SPF
I would point out that perfectly legitimate emails can be erroneously caught by SPF too, say registration confirmation or password reset email sent direct from webserver that has different IP address than the mail server).