2,325 reputation
1115
bio website
location
age
visits member for 3 years, 11 months
seen Nov 4 '11 at 15:09

Aug
16
awarded  Guru
Mar
3
awarded  Nice Answer
Feb
15
awarded  Taxonomist
Jan
7
awarded  Good Answer
Nov
26
awarded  Yearling
Sep
17
awarded  Nice Question
Apr
15
awarded  Good Answer
Jan
21
awarded  Good Answer
Jan
6
awarded  Notable Question
Nov
26
awarded  Yearling
Sep
4
awarded  Nice Answer
Jan
30
awarded  Popular Question
Nov
26
awarded  Yearling
Oct
7
comment Microsoft Windows RPC (135/tcp) security risks
That did sorta cross the information-content threshhold for a full answer. Unfortunately, it was wrong--139 and 445 were the null enum risks on pre-Windows XP SP2 and Windows 2003 SP1 systems. DCE/RPC endpoint mapping is different, it'll give you information like this: offensive-security.com/metasploit-unleashed/…
Oct
7
comment Microsoft Windows RPC (135/tcp) security risks
Older versions of Windows allowed null enumeration--collection of possibly dangerous information about the server without authenticating. sheetaljoseph.org/scribblings/enumeration.pdf is a decent overview of the dangers from that era.
Oct
7
comment Is it possible to decrypt a SSL/TLS session without doing a MITM-attack?
Depends. SSL & TLS together cover a huge range of ciphers. They all offer different degrees of strength, and sometimes different security guarantees (e.g. perfect forward security).
Sep
20
comment Is this much distrust really necessary?
Good answer. As well as the low-probability, large-scale losses, there's also an economic effect similar to herd immunity at work. If everyone blindly trusted everything, there would be many more criminals exploiting that trust.
Sep
20
comment Are there any statistics about webservers and browsers TLS support?
There are quite a few details here: threatpost.com/en_us/blogs/… Not enough to reproduce the attack, but much more than the Register article.
Sep
13
comment What to do about websites that store plain text passwords
I have the feeling that anyone so negligent about security would, at the most, mark your database entry as inactive. I don't see any way to have assurance that your plaintext password is no longer available to all and sundry--the easiest way would probably be hacking in and deleting it.
Sep
6
awarded  Nice Answer