45,582 reputation
12105191
bio website en.wikipedia.org/wiki/…
location United Kingdom
age 26
visits member for 2 years, 9 months
seen yesterday

Pentester, ex-developer, security researcher, reverse engineer, electronics tinkerer, internet activist, zombie eradicator, promulgator of useless facts, shrubbery inspector, bacon aficionado, devourer of donuts.

Strengths: Security, Crypto, Win32 API, C#, .NET, PHP, x86 assembly

All answers and comments are encrypted with ROT256-ECB.

Opinions are my own. Advice provided with no warranty.


Aug
13
comment HTTP Basic auth password storage more secure than Digest auth
@curiousguy No, what I meant was that the basic auth dialog could be backed by a script, which does the hashing and other authentication and limitation. Jimbob's answer is much more detailed than mine, as I neglected to consider webforms as an alternative.
Aug
13
comment How do you prevent physical backups from being stolen?
+1 for sharing my pain.
Aug
13
comment Protecting critical state infrastructure from the aftermath of a nuclear blast
For context, the above comment was in reply to a comment that has since been deleted.
Aug
13
awarded  Nice Question
Aug
13
revised Protecting critical state infrastructure from the aftermath of a nuclear blast
edited tags
Aug
13
comment Protecting critical state infrastructure from the aftermath of a nuclear blast
@ThomasPornin That's just what they want you to believe. It's really the bunker where they keep the Stargate ;)
Aug
13
comment Protecting critical state infrastructure from the aftermath of a nuclear blast
My favourite backronym for TEMPEST has to be Tiny ElectroMagnetic Particles Emitting Secret Things.
Aug
13
comment HTTP Basic auth password storage more secure than Digest auth
Good points. I assumed OP had to use standard HTTP auth, and neglected to consider the better alternative.
Aug
13
comment Protecting critical state infrastructure from the aftermath of a nuclear blast
If I were really looking to create my own hyper-resilient network, I would just use the standard DNS system which is already globally resilient to numerous forms of attack, including localised blackouts from disasters and military strikes. If the fact that I'm not looking to actually create such a system eludes you, you've clearly got some serious comprehension issues. This is a theoretical question, for nothing more than academic purposes. People come to Sec.SE to learn, not be fed opinion.
Aug
13
answered HTTP Basic auth password storage more secure than Digest auth
Aug
13
comment Protecting critical state infrastructure from the aftermath of a nuclear blast
Wow. Just... wow.
Aug
13
revised Protecting critical state infrastructure from the aftermath of a nuclear blast
tags
Aug
13
awarded  Civic Duty
Aug
13
asked Protecting critical state infrastructure from the aftermath of a nuclear blast
Aug
13
comment Ideas to build security awareness
I'm aware of Theory X and Theory Y business psychology. In fact, it's the basis for this answer - I'm talking about giving positive feedback, not negative. You phish the users as an eye-opening tactic, then explain what they did wrong. Part of the exercise is to explain to the user that they didn't fail, they just didn't know. No negative feedback is given. However, if a user responds properly, then you provide positive feedback to their line manager, so they know they did a good job.
Aug
13
comment Potential insecurity in not sanitizing variables before INSERT with prepared statement in PDO
The data is stored in a canonical format, i.e. it is byte-for-byte what the user gave you. When the data is outputted, you must escape it for the appropriate format you're outputting into. The link I provided gives some examples for outputting untrusted content into HTML and JavaScript.
Aug
13
answered Potential insecurity in not sanitizing variables before INSERT with prepared statement in PDO
Aug
13
comment Securing a REST API: is api_secret signing and ssl enough?
Nope. MitM is only an issue with fake certs. If you make the client enforce that the HTTP cannot be downgraded to HTTP, and that the server's cert is signed by a known CA, you're safe against MitM attacks such as sslstrip.
Aug
13
comment Securing a REST API: is api_secret signing and ssl enough?
I'm confused. If it's over SSL, and your app doesn't allow downgrades to HTTP, why are you worried about MitM attacks?
Aug
13
asked How do you prevent physical backups from being stolen?