Polynomial

32,842 reputation

1067136

bio	website	en.wikipedia.org/wiki/…
	location	United Kingdom
	age	25
visits	member for	1 year, 7 months
	seen	yesterday
stats	profile views	2,043

Pentester, ex-developer, security researcher, reverse engineer, electronics tinkerer, internet activist, zombie eradicator, promulgator of useless facts, shrubbery inspector, bacon aficionado, devourer of donuts.

Strengths: Security, Crypto, Win32 API, C#, .NET, PHP, x86 assembly

All answers and comments are encrypted with ROT256-ECB.

Opinions are my own. Advice provided with no warranty.

	32,842 reputation	bio	website	en.wikipedia.org/wiki/…	visits	member for	1 year, 7 months
1067136 badges		location	United Kingdom		seen	yesterday

summary answers questions tags badges favorites bounties reputation activity

2,742 Actions

suggestions reviews revisions comments badges posts accepts all

Jul 26	awarded	Organizer
Jul 26	revised	Is it possible to MITM between Google voice SMS/TXT Messaging formatting / tags
Jul 26	answered	Is having Steam installed a security risk?
Jul 26	comment	Shall I need to use MD5 algorithm in both JavaScript and PHP for login authentication? -1. There are no known collisions for SHA1. It's insecure for passwords because it's fast, and suffers from length extension problems. You should also not use SHA-2 family for storing passwords, because they're too fast. You should use a slow key derivation function such as bcrypt or PBKDF2.
Jul 26	comment	Fuzzing Android API Yes, that's a viable solution. However, you're still going to need to capture the fault and dig through for info. I'm not telling you not to try it, I'm just saying it might be a good idea to try something local (e.g. Windows / Linux) first.
Jul 26	comment	Shall I need to use MD5 algorithm in both JavaScript and PHP for login authentication? Shameless plug: How to store salt - hopefully should give you a nice long answer on why we use a salt and why MD5 (or any other hash function) is a bad idea.
Jul 26	comment	Shall I need to use MD5 algorithm in both JavaScript and PHP for login authentication? Also, don't use MD5.
Jul 26	comment	How can mini-computers (like Raspberry Pi) be applied to IT security? The PwnPlug is awesome. Saw Kevin Mitnick tweet about it a couple days ago.
Jul 26	answered	Should i use SSL for local access?
Jul 26	comment	Fuzzing Android API I'd suggest playing around with something a little more accessible first. An Android fuzzer requires you to write a lot of code that talks to the target device, which makes the process quite a bit more complex.
Jul 26	awarded	Necromancer
Jul 26	comment	How to devise a security policy? The ISO/IEC 27000-series is essentially a security standard in of itself, focusing on secure storage and handling practices, as well as secure methodologies. I'm not sure you need to be 100% compliant as a small company, since the scope of it is massive. However, it's certainly worth reading through and understanding it. I'm sure there are ways to get accredited, but I've never looked into them.
Jul 25	comment	Trying to understand password hashing It also covers some other aspects, might be useful.
Jul 25	comment	Trying to understand password hashing See this answer for a detailed explanation of why we salt.
Jul 25	comment	How to crack password hashed using SSHA? If you've got a GPU with OpenCL or CUDA support, you should use oclHashcat - it'll be hundreds of times faster than your CPU.
Jul 25	revised	Can anyone provide references for implementing web application self password reset mechanisms properly? removed user ID requirement
Jul 25	comment	Can anyone provide references for implementing web application self password reset mechanisms properly? @martinstoeckli True, but exposing the user ID isn't usually a big deal. You're likely to do it through the interface to your site anyway - look at StackExchange. Question 17542, answer 17547, your comment is 28508, you're user 8343, I'm user 5400, OP is user 10787. Trying to hide that info is difficult and would only introduce obscurity. In this case, though, the tokens should be unique, so the search should always return a single row regardless of whether the user ID is in the link.
Jul 24	answered	Is there an access-control model defined in terms of application structure?
Jul 24	answered	How to devise a security policy?
Jul 24	comment	Electromagnetic induction attacks - reverse TEMPEST? Physically tapping into cables may not be possible. Imagine, for example, a company with strong physical security, but with exposed ethernet wires on the external of their building. If the attacker can't (quite) reach the cables, due to a fence or similar barrier, would it be feasible to target significant electromagnetic energy at the cable in order to at least disrupt a stream, if not inject data semi-reliably?