52,923 reputation
16125218
bio website en.wikipedia.org/wiki/…
location United Kingdom
age 27
visits member for 3 years, 5 months
seen yesterday

Pentester, ex-developer, security researcher, reverse engineer, electronics tinkerer, internet activist, zombie eradicator, promulgator of useless facts, shrubbery inspector, bacon aficionado, devourer of donuts.

Strengths: Security, Crypto, Win32 API, C#, .NET, PHP, x86 assembly

All answers and comments are encrypted with ROT256-ECB.

Opinions are my own. Advice provided with no warranty.


Sep
4
revised How can an admin choose which Snort rules to enable?
formatting / tags / title
Sep
4
comment Cohen's problem
Excellent answer, with a great example too. I hadn't heard of this problem. I guess Turing-completeness factors into this too?
Sep
4
comment Where does SSL encryption take place?
@Bruno I'm not sure I get what you're saying. TCP/IP is a suite of network protocols, whereas TCP and IPv4 are distinct protocols at individual layers in the OSI model. The OSI model makes a good abstraction in this case, because it shows where SSL sits. It doesn't need to be 100% accurate - nothing ever is with such abstractions - it's just there to aid understanding.
Sep
3
answered Where does SSL encryption take place?
Sep
3
comment Is TrueCrypt safe enough to store clear-text-passwords?
Alright, TrueEquineVoltaicCellRivet then! ;)
Sep
3
comment Token-based authentication - Securing the token
Configure the client and server HTTPS implementations to reject weak ciphers and TLS downgrades. It's platform dependant, so you'll need to do some googling.
Sep
3
comment Token-based authentication - Securing the token
Yup, you should be fine if it's over HTTPS and your client refuses invalid certificates / weak ciphers.
Sep
3
revised Token-based authentication - Securing the token
update
Sep
3
comment Token-based authentication - Securing the token
@James Sorry, misunderstood the question. The mechanism you linked is fine for this kind of situation, but it will not protect you against replay attacks. You need to use something like SSL to prevent MitM / replay.
Sep
3
comment Token-based authentication - Securing the token
@James When the user comes to the site and does not have a session, the cookie token is sent to the server. The server validates it, creates a new session as the logged in user, and invalidates the token. It then gives the user a new token. The session identifies them whilst they're using the site, but when they close their browser (or the session expires) the user is no longer logged in. When they come back, they have no session, and the new token you gave them allows you to create a new session (go back to step 1)
Sep
3
comment Bypassing the BIOS password
+1 for that Arduino project. I actually considered that as an option, but it seems someone beat me to it! :)
Sep
3
answered SOCKS proxy security concerns
Sep
3
revised SOCKS proxy security concerns
formatting / spelling / title
Sep
3
answered Token-based authentication - Securing the token
Sep
3
comment Is TrueCrypt safe enough to store clear-text-passwords?
Or correcthorsebatterystaplecorrecthorsebatterystaple1234
Sep
3
asked Bypassing the BIOS password
Sep
3
comment Tracking stolen laptop which has a login password
@FrankPresenciaFandos Try switching to TrueCrypt's system encryption. It allows you to completely encrypt the disk, and have it decrypted at boot via the TC bootloader. This ensures that your entire disk is safe, including the OS and any swap file you might have.
Sep
3
answered Why is tunneling so important in pen testing?
Sep
2
revised Tracking stolen laptop which has a login password
Various typos.
Sep
2
answered Scanning A Subnet Externaly