49,943 reputation
14121210
bio website en.wikipedia.org/wiki/…
location United Kingdom
age 26
visits member for 3 years, 2 months
seen Dec 19 at 18:59

Pentester, ex-developer, security researcher, reverse engineer, electronics tinkerer, internet activist, zombie eradicator, promulgator of useless facts, shrubbery inspector, bacon aficionado, devourer of donuts.

Strengths: Security, Crypto, Win32 API, C#, .NET, PHP, x86 assembly

All answers and comments are encrypted with ROT256-ECB.

Opinions are my own. Advice provided with no warranty.


Dec
19
answered What is investigated after a possible hack on servers?
Dec
19
awarded  Good Answer
Dec
17
awarded  tls
Dec
5
revised Which forward secrecy cipher suites are supported for TLS1.0 protocols?
deleted 140 characters in body
Dec
4
comment Is data-remanence a concern in RAM?
Relevant: security.stackexchange.com/questions/29019/… and security.stackexchange.com/questions/7299/…
Dec
4
comment Which forward secrecy cipher suites are supported for TLS1.0 protocols?
@PURE That's a separate question which would be better asked at ServerFault, but you could either use ssl-cipher-suite-enum (free script, but full disclosure: I work there) to test a live instance, or check your config files. I don't know where the TLS config is kept in Tomcat, though.
Dec
4
answered Which forward secrecy cipher suites are supported for TLS1.0 protocols?
Dec
4
comment Soundness of GRC.com Haystack padding concept
I'll provide my usual Steve Gibson reference: attrition.org/errata/charlatan/steve_gibson
Dec
1
revised Android encryption when phone is on
Fixed typos
Dec
1
comment Passing session id in query string to maintain state in third party iframe - good practice?
Yes, it's bad practice. Regardless, the cookie shouldn't be blocked as 3rd party, unless the user has a very overzealous privacy plugin. Your cookie should just get set and sent under the standard same origin policy for your domain.
Nov
27
comment How strong is a simple XOR encryption with random IV?
As soon as you leak P xor K, you immediately lose to known plaintext attacks. Any structured data should result in relatively trivial key recovery in this situation.
Nov
27
comment is it sufficient to convert '(single-quote) to ` ' `
Or, if more than one field is filled out, a simple backslash in the first and ;alert(1)// in the second.
Nov
27
revised Create a unterminable process in Windows
added 78 characters in body
Nov
18
awarded  Nice Answer
Nov
17
awarded  Famous Question
Nov
14
awarded  Notable Question
Nov
7
awarded  Enlightened
Nov
7
awarded  Nice Answer
Nov
4
comment Why wouldn't it be great, if HTTP/2 would only allow communication via TLS?
I think that it's important to state categorically that the primary intended benefit isn't to thwart agencies like the NSA, but rather to protect against criminal threats.
Nov
4
comment My college hosts a critically vulnerable service. I warned them 4 years ago. What should I do?
Keep in mind that schools and colleges are notorious for being over-reacting asshats in response to security notices. Kids have been kicked out or even arrested over them. My advice would be to tread very carefully.