48,463 reputation
12118208
bio website en.wikipedia.org/wiki/…
location United Kingdom
age 26
visits member for 3 years
seen 27 mins ago

Pentester, ex-developer, security researcher, reverse engineer, electronics tinkerer, internet activist, zombie eradicator, promulgator of useless facts, shrubbery inspector, bacon aficionado, devourer of donuts.

Strengths: Security, Crypto, Win32 API, C#, .NET, PHP, x86 assembly

All answers and comments are encrypted with ROT256-ECB.

Opinions are my own. Advice provided with no warranty.


3h
answered Windows: Any method to enforce user confirmation before the browser opens a URL requested by an external desktop app?
3h
comment How “enforcable” are email disclaimers
@CarlosBribiescas That is an amusing thought. Sadly, I don't know the answer. It's probably never been tested in court.
Oct
19
awarded  Good Question
Oct
19
comment How do I use “openssl s_client” to test for (absence of) SSLv3 support?
@RogerLipscombe Right, so what's not working there? SSLv3 is not listed, so it's not supported.
Oct
16
awarded  Good Question
Oct
14
awarded  Nice Answer
Oct
12
awarded  Yearling
Oct
10
comment Add a file as entropy source for /dev/random
Care to explain what specific requirement you have that /dev/urandom doesn't solve? The term "true-random entropy" doesn't make any sense in this context.
Oct
10
comment Add a file as entropy source for /dev/random
You can't really "consume" entropy. Besides, /dev/urandom is designed to provide an essentially unlimited CSRPNG through the use of AES-CTR keyed from /dev/random, which means you're guaranteed to have strong random numbers as long as you've got even a bare minimum of collected entropy. You'd have to run some kind of tiny cut-down kernel on a low-entropy embedded device and pull gigabytes of random data from /dev/urandom to impact security in a negative way.
Oct
10
comment Add a file as entropy source for /dev/random
Can I just ask... why? What is the problem that you are solving by doing this? I mean, "for funsies" is completely fine, I just want to be sure you're not doing it because you expect some kind of tangible security improvement.
Oct
10
reviewed Edit suggested edit on wireshark tag wiki
Oct
10
revised wireshark wiki description
Complete re-write.
Oct
10
reviewed Close Is “HTTPS” ~100% secure?
Oct
10
comment With RSA, can one ensure that two entities will not have the same private key?
@RickyDemer That is true, though when I said "isn't really defined" I was referring to the fact that (as Stephen pointed out) we don't have a defined, agreed upon function for calculating its true value, short of actually counting all the primes, which defeats the point of the PCF in the first place.
Oct
10
comment Password resets - what practices should web services follow?
@ThomasEyde I'd suggest against that from a usability angle. Not everyone has internet access on their phone.
Oct
10
awarded  Nice Answer
Oct
10
awarded  Favorite Question
Oct
7
answered With RSA, can one ensure that two entities will not have the same private key?
Oct
7
awarded  Excavator
Oct
7
comment What would one need to do in order to hijack a satellite?
While this link may answer the question, it is better to include the essential parts of the answer here and provide the link for reference. Link-only answers can become invalid if the linked page changes.