user502

1,880 reputation

713

bio	website
	location
	age
visits	member for	2 years, 5 months
	seen	Nov 4 '11 at 15:09
stats	profile views	49

	1,880 reputation	bio	website		visits	member for	2 years, 5 months
713 badges		location			seen	Nov 4 '11 at 15:09

summary answers questions tags badges favorites bounties reputation activity

110 Actions

suggestions reviews revisions comments badges posts accepts all

Apr 15	awarded	Good Answer
Jan 21	awarded	Good Answer
Jan 6	awarded	Notable Question
Nov 26	awarded	Yearling
Sep 4	awarded	Nice Answer
Jan 30	awarded	Popular Question
Nov 26	awarded	Yearling
Oct 7	comment	Microsoft Windows RPC (135/tcp) security risks That did sorta cross the information-content threshhold for a full answer. Unfortunately, it was wrong--139 and 445 were the null enum risks on pre-Windows XP SP2 and Windows 2003 SP1 systems. DCE/RPC endpoint mapping is different, it'll give you information like this: offensive-security.com/metasploit-unleashed/…
Oct 7	comment	Microsoft Windows RPC (135/tcp) security risks Older versions of Windows allowed null enumeration--collection of possibly dangerous information about the server without authenticating. sheetaljoseph.org/scribblings/enumeration.pdf is a decent overview of the dangers from that era.
Oct 7	comment	Is it possible to decrypt a SSL/TLS session without doing a MITM-attack? Depends. SSL & TLS together cover a huge range of ciphers. They all offer different degrees of strength, and sometimes different security guarantees (e.g. perfect forward security).
Sep 20	comment	Is this much distrust really necessary? Good answer. As well as the low-probability, large-scale losses, there's also an economic effect similar to herd immunity at work. If everyone blindly trusted everything, there would be many more criminals exploiting that trust.
Sep 20	comment	Are there any statistics about webservers and browsers TLS support? There are quite a few details here: threatpost.com/en_us/blogs/… Not enough to reproduce the attack, but much more than the Register article.
Sep 13	comment	What to do about websites that store plain text passwords I have the feeling that anyone so negligent about security would, at the most, mark your database entry as inactive. I don't see any way to have assurance that your plaintext password is no longer available to all and sundry--the easiest way would probably be hacking in and deleting it.
Sep 6	awarded	Nice Answer
Aug 17	revised	Which encryption algorithms will be used to replace RSA when quantum computers become common? added 368 characters in body
Aug 17	answered	Which encryption algorithms will be used to replace RSA when quantum computers become common?
Aug 17	comment	Password auditing Using SHA1 hashes will help avoid pre-image attacks (compared to md5) but that's not really your concern with a password database. Since they're just as fast as md5, they won't help you if your password hashes get taken. Luckily, the Unix crypt implementation is more secure than NTLM hashes by default; although real durability enters the picture when you switch to bcrypt, pbkdf2, or scrypt.
Aug 16	comment	SSD (Flash Memory) security when data is encrypted in place I agree that the myth perpetuation deserved a -1, but I'm +1'ing it back up because "consider any drive that has ever held sensitive data in an unencrypted state to be tainted" is exactly correct. It's not that the physical HDD bits have a memory longer than 1 overwrite, it's that the data can exist in many places you didn't expect.
Aug 12	comment	Amount of simple operations that is safely out of reach for all humanity? Mightily impressive answer, wish I could upvote more than once. But even assuming hypercomputing is out of reach, don't forget reversible computing--if you can perform 2^31 of your operations reversibly, you might be able to to reach that 2^256 operations on a classical computer, using a black hole for negentropy and throwing in the whole solar system piece by piece.
Aug 11	comment	XKCD #936: Short complex password, or long dictionary passphrase? Tyr, if the password field allows full unicode, you could generate similar complexity by switching language keyboards after each character and doing, say, [emoji][Cyrillic][Kanji][Greek].