57,545 reputation
17140236
bio website en.wikipedia.org/wiki/…
location United Kingdom
age 27
visits member for 3 years, 9 months
seen Jul 15 at 23:36

Pentester, ex-developer, security researcher, reverse engineer, electronics tinkerer, internet activist, zombie eradicator, promulgator of useless facts, shrubbery inspector, bacon aficionado, devourer of donuts.

Strengths: Security, Crypto, Win32 API, C#, .NET, PHP, x86 assembly

All answers and comments are encrypted with ROT256-ECB.

Opinions are my own. Advice provided with no warranty.


Sep
24
answered AES CBC over TCP - when is new IV needed
Sep
24
answered Windows Vista user logon integrity
Sep
24
comment Windows Vista user logon integrity
@Ramhound So it does! Just seemed to imply a partial delete, for some reason.
Sep
24
comment Can fully homomorphic encryption be practical?
possible duplicate of In what ways does Full or Partial Homomorphic Encryption benefit the cloud?
Sep
24
comment Computational Feasibility of finding 'Good Links' of the following format
Yeah, by "block" I meant they'd prevent you from actually using the service, rather than something as drastic as iptables -A INPUT -s <ip> -j DROP
Sep
24
comment Plausible deniability with TrueCrypt
@Radu It doesn't take any extra steps. When you mount it as a writeable drive, the OS sets a bunch of metadata and start prefetching the files, writing last accessed dates, etc. It's highly likely that such changes would trash the drive.
Sep
24
comment Computational Feasibility of finding 'Good Links' of the following format
Oh, and +1 for the Dilbert randomness.
Sep
24
comment Computational Feasibility of finding 'Good Links' of the following format
After 10^4 or 10^5 tries, they're likely to block you from the servers anyway.
Sep
24
comment Plausible deniability with TrueCrypt
Overwriting is actually the goal. If you start up the outer TC volume without enabling inner volume protection (by entering the inner volume's password) it'll damage the inner volume. This is a scenario used for situations where an attacker forces a password from you. You give them the outer volume password, they mount it, and it kills your inner data before they can read it. Of course, they can mount it read-only, but that's no fun!
Sep
24
comment What are the disadvantages of single sign-on authentication?
Essentially the problem boils down to the fact that you're handing your security mechanisms to an opaque 3rd party. This is, simultaneously, single sign-on's biggest advantage and disadvantage. You sacrifice certainty about security for a range of other security benefits, and a few other benefits (ease of use, implementation overhead reduction, etc.)
Sep
24
revised What are the disadvantages of single sign-on authentication?
formatting, grammar
Sep
23
comment How will security need to be changed if we can crack password hashes in quasi-polynomial time?
<tinfoil> But the NSA might already be doing this! </tinfoil>
Sep
23
comment Stack Overflows - Defeating Canaries, ASLR, DEP, NX
Yes. The NX bit just provides hardware enforcement of the executable memory page protection flag. With NX disabled, it's trivial to execute pages that don't have the executable bit set, because the processor won't recognise the difference. With NX enabled, you cannot execute non-executable pages. However, VirtualProtect alters the protection flags on the page, so it actually is marked as executable, which the CPU will then allow.
Sep
23
comment How to defeat ASLR in linux kernel?
You'd need a privilege escalation to root, or file write privilege check bypass.
Sep
22
reviewed Approve How to create ssh tunnel using netcat?
Sep
22
comment How to achieve interactive shell attack?
@tylerl That's the source of the term, yes. Doesn't mean it still means that, though :)
Sep
22
awarded  Nice Answer
Sep
22
comment Nmap port scan and FTP bounce
Isn't the flag for disabling ping -Pn, rather than -P0?
Sep
22
comment What security settings are likely used in Obama's Blackberry?
@AviD Secret Service likely borrowed someone from the NSA as a consultant.
Sep
22
comment Resources on security risks of NFC
Related: How secure is NFC on mobile devices? and What are the vulnerabilities of using NFC on my SGS3?