56,845 reputation
17138233
bio website en.wikipedia.org/wiki/…
location United Kingdom
age 27
visits member for 3 years, 9 months
seen 20 hours ago

Pentester, ex-developer, security researcher, reverse engineer, electronics tinkerer, internet activist, zombie eradicator, promulgator of useless facts, shrubbery inspector, bacon aficionado, devourer of donuts.

Strengths: Security, Crypto, Win32 API, C#, .NET, PHP, x86 assembly

All answers and comments are encrypted with ROT256-ECB.

Opinions are my own. Advice provided with no warranty.


Jul
1
comment How do overlay network nodes communicate without IP addresses?
There isn't one, really. The idea is that the hidden service advertises the introduction node IDs, not its own IP, so they can introduce you to the hidden service without you knowing the IP of the target. There's a directory which holds the onion addresses and their associated introduction node IDs.
Jul
1
comment Handling CSRF tokens on pages longer than the PHP session limit
Right. You can just change session.gc_maxlifetime to a larger timeout. The problem described there is that you shouldn't rely upon the PHP GC to time out your session on the server side, because it may not do so immediately after the configured time. It should never time it out before that time.
Jul
1
comment Handling CSRF tokens on pages longer than the PHP session limit
"PHP session limit"? What session limit? The session cookie expiry can be set at any value, including forever. Besides, if the session no longer exists, they should be logged out, which is a totally different issue.
Jul
1
comment How do overlay network nodes communicate without IP addresses?
Are you essentially asking how Tor hidden services (e.g. onion addresses) hide their IPs? Or are you asking about all individual nodes in the chain for communications?
Jul
1
comment How do overlay network nodes communicate without IP addresses?
Possible duplicate of Why can a Tor exit node decrypt data, but not the entry node? - also, this and this might help.
Jul
1
revised Tor website HPKP (key pinning) failure
Title / grammar / various edits
Jul
1
comment What is the difference between a hash table and a rainbow table, and how are they both used?
Simple answer: rainbow tables chain similar hashes together to save space, by not storing the prefix for every hash. (e.g. f2ca5152b0..., f2ca513a13..., and f2ca5177b8... can be stored as f2ca51 -> 52b0..., 3a13..., 77b8... since they share the same prefix).
Jun
30
awarded  Popular Question
Jun
30
reviewed Edit Is the SanDisk ULLtraDIMM secure after power-down?
Jun
30
revised Is the SanDisk ULLtraDIMM secure after power-down?
Making it more readable by creating paragraphs
Jun
30
comment Why FATCA IDES “protocol” does not use RSA encrytion directly on Zip archive ?
@YvesMartin No, it's not too short at all. Brute-forcing a 256-bit key with conventional computers would take more energy than is thought to exist in the universe. The reason RSA keys are longer in numerical size is that they represent primes rather than just any old random number, and the mathematics involved to crack RSA means we (currently) need keys in the order of 2048-bits or larger to remain safe.
Jun
29
answered Why FATCA IDES “protocol” does not use RSA encrytion directly on Zip archive ?
Jun
29
comment DDOS Server Attacks & Domain Names
Assuming you have control over your NS records (e.g. in your domain provider's control panel), you could just use CloudFlare's free DDoS protection.
Jun
18
comment Is it any more or less secure to delete all my cookies vs. individually logging out?
To be clear: deleting your cookies alone (or first) is a bad idea, as the session might still persist on the server. Best option is to log out, then delete any remaining cookies.
Jun
18
answered Safely sharing session accross sub-domains
Jun
15
revised How to distinguish between a scam and a genuine call?
edited tags
Jun
15
comment How to devise a security policy?
@JohnnyUtahh Thanks for the heads up. Fixed the links.
Jun
15
revised How to devise a security policy?
fixed dead links
Jun
15
comment How to devise a security policy?
@JohnnyUtahh There's certainly overlap on the Venn diagram, but they're not the same. A usage policy governs how employees should conduct themselves when using IT systems (e.g. no naughty images via work internet access). A security policy also has elements of conduct (e.g. no dodgy sites, cracked software) but is usually much larger in scope, such as giving procedures and contact information for security incidents, and may be broader in scope than just IT (e.g. handling of physical media, documents, etc.)
Jun
15
comment What is the purpose of using different DNS server in nmap?
@biziclop In that particular case I'd be using dig rather than nmap, but you are correct that it can be done that way.