131 reputation
4
bio website
location
age
visits member for 4 years
seen Jul 27 at 7:10

I work at Microsoft on the Device Security Services team. Previously I was a security engineer on ASP.NET.


Jul
13
comment ASP.NET Machinekey encryption
@Polynomial The behavior hasn't changed since its introduction in .NET 4.5. I should know - I wrote the code. :)
Jul
12
awarded  Commentator
Jul
12
comment ASP.NET Machinekey encryption
Correction: MachineKey.Protect doesn't use DPAPI by default. It instead uses information derived from the value of <machineKey> stored in Web.config. (This also allows it to work in a server farm, whereas using DPAPI wouldn't allow for this.) The security of MachineKey.Protect depends on the quality of the entropy in <machineKey> and the steps taken to shield that value from unauthorized access, e.g., by employing encrypted config.
Dec
15
answered Is string concatenation vulnerable to null character in aspx?
Oct
3
comment Is Windows BitLocker secure?
I'll bite. Assume for a minute that the U.S. govt did manage to backdoor the systems called out in that presentation. Knowledge of this would be highly classified and wouldn't be shared with some county sheriff's office in Oregon. Your source is highly suspect.
Sep
25
comment Does encrypting a setting in web.config actually provide security?
FWIW, this is the same reason so many people put secrets in environment variables. Sure, if you're able to gain code execution privileges you can read the values directly, but gaining code execution privileges is generally considered more difficult than reading arbitrary files from disk.
Sep
25
comment Why don't sites implement a system where a wrong password causes a 3 second delay?
Attacker: I don't like Campy. Let me go and write a script that tries to log in with "Campy / bad-password" every 2 - 3 seconds. Now he can't log in to the site using his legitimate creds. Ha ha!
Sep
24
awarded  Autobiographer
Mar
21
comment Why is it not standard practice to run password-based KDF's client-side?
Follow-up: I see some other discussion that it's easy to reverse-engineer hashes, and that's why PBKDF2 is used in the first place. This is not correct: hashes are assumed to be difficult to reverse (see "preimage resistance"), so attackers are required to fall back to rainbow tables or brute-forcing the input. Since rainbow tables don't work for high-entropy input (such as the result of a PBKDF2 operation), the attacker must brute-force the hash input, which is equivalent in cost to brute-forcing the PBKDF2 result.
Mar
21
comment Why is it not standard practice to run password-based KDF's client-side?
Why was this downvoted? This seems like a perfectly reasonable answer.
Feb
10
comment Is ASP.net More Secure than PHP in GENERAL?
Not an answer, but an anecdote: I have seen web developers do truly horrific things inside ASP.NET, including purposefully circumventing some of the basic security features we have built in. For example, it's not uncommon for developers to use plaintext authentication cookies simply because they don't want to synchronize across their apps the cryptographic keys which are normally used to protect those cookies. Unskilled developers are always going to find ways to shoot themselves in the foot - even if they have to go out of their way to do so - regardless of the framework they're using.
Dec
6
awarded  Teacher
Dec
5
answered Can a mismatched server encoding on HTTP POST or GET result in a security issue?
Dec
30
awarded  Supporter
Nov
1
comment Is ASP.NET Event Validation completely secure?
The absolute safest thing to do would be to check the incoming data before operating with it. If the user is only allowed to select 1 - 10 from the dropdown, then your application logic should enforce this restriction before consuming the data.
Sep
10
comment Can i get 100% protection from virus by using Deep Freeze?
And lest people think this is only theoretical, there was a concrete example of this at BlackHat a few years back. See semiaccurate.com/2009/07/31/….