1,394 reputation
310
bio website ewanm89.co.uk
location United Kingdom
age 24
visits member for 2 years, 10 months
seen yesterday

I code for fun, mostly self taught, both high and low level. Also self taught in various aspects of information security. Love the puzzles.


Mar
1
comment How can I Hide my Public IP Address
I would like to add that in the case of a proxy the proxy itself must know the ip address. 2 of the isp's records/logs are good enough then it is technical possible to the physical endpoint of the cable. Wireless networks are a little less accurate but down to the cell/access point location is possible.
Jan
28
comment Should login pages be cacheable?
Only issue I see is if one is injecting a random unique anti CSRF token/nonce onto the page. In that case, part of the login information is the token embedded in the form html.
Jan
14
comment Forward secrecy for kids
Agreed but who said scouts needed 1024 bit security, as a learning tool it wouldn't be bad. I doubt they are using something like AES at the moment.
Jan
14
comment Forward secrecy for kids
Hmm, why couldn't scouts do a difi-hellman key exchange? It isn't actually all that hard to calculate require only raising to the power and modulo other than the initial random integer generations.
Jan
8
comment Is data exposed in a CSRF attack?
All this is assuming there isn't a same origin policy exploit available on that users browser. Exploiting same origin policy makes it a cross site scripting attack.
Nov
21
comment How does HSBC's “Secure Key” actually work?
@scorpion there are two different types in user in the UK by various banks. They look similar but work it different ways. 1) put there card in type in the pin, card verifies it and spots out a cryptographical prng generated output only valid for given nonce. Server runs same algorithm and verifies answers match. 2) works the same way but smartcard chip already embedded doing away with the external card reader.
Oct
10
comment How secure is automatic authentication in Skype?
Inventing your own and keeping it hidden even with a good group of cryptographers is not a good thing. All cryptographers make mistakes, this leads to axiom 1, don't invent your own crypto, just ask don't about ps3 issues. The fact they won't publicly disclose is suggesting they are relying on security through obscurity, axiom 2, security should rely entirely on a single secret key not that the whole process is kept secret.
Oct
10
comment How secure is automatic authentication in Skype?
"top most security algorithms", what do you mean by throw? Do you mean best, most secure... Microsoft invents there own crypto and then keeps the details secret, therefore it is not as well vetted by the security community. There could be make weaknesses in the latest NTLM algorithm for example.
Sep
17
comment How should I defend against TightVNC brute-force attacks?
@broiyan With physical access and all bets are off anyway.
Jul
11
comment Taking password letters not whole one, is this secure?
@lynks HSM is one part of a system as a whole. asking for individual characters to stop keylogging, then having to use a HSM as it's the only maybe secure method to store the password so it can still be broken into individual parts, I have nothing against HSMs in general. What I am against is using one as the only means of any defence to fix another problem and failing to fix that original problem anyway.
Jul
11
comment Taking password letters not whole one, is this secure?
@lynks Yet you still have failed to show it is any better than crypto at stopping keylogging attacks, which is what such systems banks are using pretend to do.
Jul
11
comment Taking password letters not whole one, is this secure?
@lynks, and you can guarantee 100% that there is no physical way to extract them. In fact, my experience of these things is that the manufacturers keep it secret how they actually store the data. However the point of the system is to stop keylogger getting password fails anyway, one just has to log multiple login attempts.
Jul
11
comment Taking password letters not whole one, is this secure?
@Polynomial not all, NatWest for example asks characters x, y and z from password and digits n, m and o from a separate pin. The idea is to stop key loggers getting the pass, but it is total fail for multiple reasons. 1) it doesn't take many logs to piece together most or the whole of the pass, 2) even using black box hardware storage, the pass needs to be either encrypted, plaintext or individual characters hashed. How long does it take to generate hash for all characters of 7 bit ANSI at 2.75 million sha1 hashes a second?
Jun
30
comment Security of running openpgp.js in a browser with the private key in HTML5 localStorage
Key management is also a problem, there is nothing in javascript to make it possible to deliberately write to a specific section of memory, meaning keys may remain in active memory long after they are no longer required.
Jun
29
comment If hashing is one way, why can we decrypt MD5 hashes?
@drjimbob I'm sure I can find a collision before that with rainbow tables. Used to be a time when Google had indexed at least one collision of most md5 hashes until the modified their search input to ignore hex strings of certain lengths.
Jun
16
comment Licensing/selling digital certificate to another company
Why can't the large software company go to microsoft/apple... and get there own digital certificate? There is no reason ever to sell such a certificate that is in your name/your companies name unless you are selling full control of the company and name. Even then, revoke and let them get a new one under the name is a better option.
Jun
9
comment Stopping spam and worms with SPF
I would point out that perfectly legitimate emails can be erroneously caught by SPF too, say registration confirmation or password reset email sent direct from webserver that has different IP address than the mail server).
Jun
9
comment Who can view my https browsing habbits?
you missed off good sslstrip attacks, who cares about encryption when the browser will even connect just fine without it. And most users wouldn't notice.
Jun
3
comment How can a system enforce a minimum number of changed characters in passwords, without storing or processing old passwords in cleartext?
One could generate and save the hashes of "similar" passwords, or run such an algorithm on the new pass and see if it figures the old pass is similar. More likely they are saving the last n passwords and checking the hash doesn't match any of them.j
May
27
comment the Informix password crack
hash_type== sha-256 there is the hashing algorithm used, not sure exactly how they are appending salt, but trying various common methods would probaby gain that information. Finally, the output looks like it is base64 encoded.