111 reputation
2
bio website
location
age
visits member for 3 years
seen Jul 25 at 6:21

I work at Microsoft as a security developer on ASP.NET. My job is making sure our frameworks are safe. :)


Mar
21
comment Why is it not standard practice to run password-based KDF's client-side?
Follow-up: I see some other discussion that it's easy to reverse-engineer hashes, and that's why PBKDF2 is used in the first place. This is not correct: hashes are assumed to be difficult to reverse (see "preimage resistance"), so attackers are required to fall back to rainbow tables or brute-forcing the input. Since rainbow tables don't work for high-entropy input (such as the result of a PBKDF2 operation), the attacker must brute-force the hash input, which is equivalent in cost to brute-forcing the PBKDF2 result.
Mar
21
comment Why is it not standard practice to run password-based KDF's client-side?
Why was this downvoted? This seems like a perfectly reasonable answer.
Feb
10
comment Is ASP.net More Secure than PHP in GENERAL?
Not an answer, but an anecdote: I have seen web developers do truly horrific things inside ASP.NET, including purposefully circumventing some of the basic security features we have built in. For example, it's not uncommon for developers to use plaintext authentication cookies simply because they don't want to synchronize across their apps the cryptographic keys which are normally used to protect those cookies. Unskilled developers are always going to find ways to shoot themselves in the foot - even if they have to go out of their way to do so - regardless of the framework they're using.
Dec
6
awarded  Teacher
Dec
5
answered Can a mismatched server encoding on HTTP POST or GET result in a security issue?
Dec
30
awarded  Supporter
Nov
1
comment Is ASP.NET Event Validation completely secure?
The absolute safest thing to do would be to check the incoming data before operating with it. If the user is only allowed to select 1 - 10 from the dropdown, then your application logic should enforce this restriction before consuming the data.
Sep
10
comment Can i get 100% protection from virus by using Deep Freeze?
And lest people think this is only theoretical, there was a concrete example of this at BlackHat a few years back. See semiaccurate.com/2009/07/31/….