49,848 reputation
14121210
bio website en.wikipedia.org/wiki/…
location United Kingdom
age 26
visits member for 3 years, 2 months
seen 2 days ago

Pentester, ex-developer, security researcher, reverse engineer, electronics tinkerer, internet activist, zombie eradicator, promulgator of useless facts, shrubbery inspector, bacon aficionado, devourer of donuts.

Strengths: Security, Crypto, Win32 API, C#, .NET, PHP, x86 assembly

All answers and comments are encrypted with ROT256-ECB.

Opinions are my own. Advice provided with no warranty.


Aug
23
comment How to determine if a browser is using an SSL or TLS connection?
Interesting that the Firefox extension shows the cipher, but not the SSL version.
Aug
23
comment What are the security precautions taken to ensure a virtualized domain can't compromise its host
Sorry, my brain seems to have skipped over the bit where you mentioned hardware emulation. Was just trying to clarify so people weren't confused, but clearly unnecessary
Aug
23
comment What is the actual security of this login page?
@curiousguy File a feature request in your favourite browser's bug tracker system then! I'd certianly second it. :)
Aug
23
comment Stopping users from spoofing an IP
Indeed. Though if he can enable IPsec on his network (which most commercial-grade routers will allow) it'd save the VPN.
Aug
22
comment Mail server (sendmail) sends spam to innocent people
Is the spam still happening? If so, load up Wireshark or a similar tool and look for incoming data that might be related. It may just be that you've misconfigured your mail daemon and it's acting as a relay.
Aug
22
comment how to identify whether my page is phished or normal page?
@eversor Doesn't even need to be that. It could do it during onload. The view source functionality in most browsers shows the markup that was delivered, not the markup that is currently in the document.
Aug
22
comment Is it safer to use less heard of software than popular software?
@pepe Which is fine, until you consider that obscurity is a constant game of chance. You might be fine on any given day, but there is always a small probability of someone reverse engineering or attacking your system. As the system ages, the probability of someone coming across it is increased. Therein lies the problem: these solutions stay in use for years.
Aug
22
awarded  Good Answer
Aug
22
answered How to prove a password guessing theory from Matt Bishop's book “Introduction to Computer Security”
Aug
22
comment how to identify whether my page is phished or normal page?
@eversor The action attribute may also have been modified by JavaScript, or the form's post event might be (as you said) hooked.
Aug
22
comment Can the `system` function pose severe security threats on a shared hosting server?
@EdwinDrood If only that were true! A user can still run commands that eat up massive amounts of RAM or CPU cycles, completely killing the server. If the kernel or a privileged command is vulnerable, they might also upload a privilege escalation exploit and jump to root privileges.
Aug
22
revised how to identify whether my page is phished or normal page?
Formatting / grammar
Aug
22
comment Is it safer to use less heard of software than popular software?
@MarkHillick I wasn't attacking your answer. I like your answer. I upvoted your answer! I was just saying that your assertions in the above comments are slightly misplaced.
Aug
22
comment Attaching hotspot to existing network - can it be secured?
If their existing network runs off a hub, you could just connect the internet-facing side of the hub to the AP instead, so the reconfiguration would be minimal. i.e. office PCs connect to hub, hub connects to AP, AP connects to the internet. There's not really a way to drop the device into the network without making any changes at all.
Aug
22
answered Attaching hotspot to existing network - can it be secured?
Aug
22
comment Is it safer to use less heard of software than popular software?
@ScottPack s/MyAdmin// ;)
Aug
22
awarded  Nice Answer
Aug
22
comment How much can I trust Tor?
@Pacerier "Hi, I'm <name>, I live at <address>."
Aug
22
comment Is it safer to use less heard of software than popular software?
The same goes for risk. You can argue that something less popular is a lower risk, but that's like saying "ok, here's a gun with 256 barrels, and only one bullet, go play Russian roulette". The probability might be low, but the security implications are high. Probability also does not mean a lower incident count - an unbiased coin might still land on heads 500 times in a row - it's just really unlikely. I'm not discounting your answer, I'm discounting the security of relying on a probability.
Aug
22
comment Is it safer to use less heard of software than popular software?
@MarkHillick My point is that the two are independent. There's zero correlation between popularity and security. You have to use proper security metrics to measure security. By definition it's a difficult thing to measure, so attempting to estimate using arbitrary perceptive and subjective metrics is misplaced.