131 reputation
3
bio website
location
age
visits member for 3 years, 5 months
seen Dec 17 at 22:40

I work at Microsoft as a security developer on ASP.NET. My job is making sure our frameworks are safe. :)


Dec
15
answered Is string concatenation vulnerable to null character in aspx?
Oct
3
comment Is Windows BitLocker secure?
I'll bite. Assume for a minute that the U.S. govt did manage to backdoor the systems called out in that presentation. Knowledge of this would be highly classified and wouldn't be shared with some county sheriff's office in Oregon. Your source is highly suspect.
Sep
25
comment Does encrypting a setting in web.config actually provide security?
FWIW, this is the same reason so many people put secrets in environment variables. Sure, if you're able to gain code execution privileges you can read the values directly, but gaining code execution privileges is generally considered more difficult than reading arbitrary files from disk.
Sep
25
comment Why don't sites implement a system where a wrong password causes a 3 second delay?
Attacker: I don't like Campy. Let me go and write a script that tries to log in with "Campy / bad-password" every 2 - 3 seconds. Now he can't log in to the site using his legitimate creds. Ha ha!
Sep
24
awarded  Autobiographer
Mar
21
comment Why is it not standard practice to run password-based KDF's client-side?
Follow-up: I see some other discussion that it's easy to reverse-engineer hashes, and that's why PBKDF2 is used in the first place. This is not correct: hashes are assumed to be difficult to reverse (see "preimage resistance"), so attackers are required to fall back to rainbow tables or brute-forcing the input. Since rainbow tables don't work for high-entropy input (such as the result of a PBKDF2 operation), the attacker must brute-force the hash input, which is equivalent in cost to brute-forcing the PBKDF2 result.
Mar
21
comment Why is it not standard practice to run password-based KDF's client-side?
Why was this downvoted? This seems like a perfectly reasonable answer.
Feb
10
comment Is ASP.net More Secure than PHP in GENERAL?
Not an answer, but an anecdote: I have seen web developers do truly horrific things inside ASP.NET, including purposefully circumventing some of the basic security features we have built in. For example, it's not uncommon for developers to use plaintext authentication cookies simply because they don't want to synchronize across their apps the cryptographic keys which are normally used to protect those cookies. Unskilled developers are always going to find ways to shoot themselves in the foot - even if they have to go out of their way to do so - regardless of the framework they're using.
Dec
6
awarded  Teacher
Dec
5
answered Can a mismatched server encoding on HTTP POST or GET result in a security issue?
Dec
30
awarded  Supporter
Nov
1
comment Is ASP.NET Event Validation completely secure?
The absolute safest thing to do would be to check the incoming data before operating with it. If the user is only allowed to select 1 - 10 from the dropdown, then your application logic should enforce this restriction before consuming the data.
Sep
10
comment Can i get 100% protection from virus by using Deep Freeze?
And lest people think this is only theoretical, there was a concrete example of this at BlackHat a few years back. See semiaccurate.com/2009/07/31/….