49,928 reputation
14121210
bio website en.wikipedia.org/wiki/…
location United Kingdom
age 26
visits member for 3 years, 2 months
seen Dec 19 at 18:59

Pentester, ex-developer, security researcher, reverse engineer, electronics tinkerer, internet activist, zombie eradicator, promulgator of useless facts, shrubbery inspector, bacon aficionado, devourer of donuts.

Strengths: Security, Crypto, Win32 API, C#, .NET, PHP, x86 assembly

All answers and comments are encrypted with ROT256-ECB.

Opinions are my own. Advice provided with no warranty.


Aug
21
comment IKEv2 in remote access scenarios
@Moo I'm not exactly sure on the specifics. I would imagine that you could hash the password on the server side, but I'm not exactly sure what hash functions / key derivation functions are supported. There's no length limit that I'm aware of on the PSK, but the point is that the entropy of a password is much lower than that of a certificate. To gain 256 bits of entropy, you need 43 perfectly random upper/lower alphanumeric characters to represent that randomness as a password. Rather difficult to remember!
Aug
21
comment Confusion: Why isn't a passhrase encrypted SSH key two factor auth?
+1 for two things you know not being multi-factor. They have to be distinct types of information, e.g. something you know, something you have, something you are.
Aug
21
answered IKEv2 in remote access scenarios
Aug
21
comment IKEv2 in remote access scenarios
No, the PSK is exchanged using a secure key agreement mechanism.
Aug
21
answered What is the actual security of this login page?
Aug
21
answered Is it safe to store password in PHP session?
Aug
21
comment Is it safe to store password in PHP session?
Possible duplicate of Do you need to encrypt session data?. Also, why not just use a surrogate key and store that instead of the user's password?
Aug
21
comment Shibboleth user attribute encryption
You mean this Shibboleth? There are several computer security concepts/tools/services called Shibboleth.
Aug
21
revised Are there any tools that focus on shellcode analysis?
fixed :)
Aug
21
comment Are there any tools that focus on shellcode analysis?
@Gilles Shellcode has its own challenges that don't fit in with normal disassembly. For example, you need to be able to specify the address of the shellcode for disassembly to be meaningful. Most assembly / disassembly tools assume an IAT to provide obvious access to APIs, whereas shellcode won't have that. They have to recognise techniques such as ROP, which won't be obvious in a normal disassembly scenario.
Aug
21
comment From password to key
Not in the slightest. Computing KDF('hello') is almost exactly as fast as computing KDF('3f8vH5n20H93@r...72$3.A0hello').
Aug
21
awarded  Constituent
Aug
21
comment From password to key
Salts don't make keys stronger. They make it infeasible to compute rainbow tables. See How to store salt?
Aug
21
comment From password to key
That's not actually SSL, it's a generic data encryption function provided by the OpenSSL library. The key derivation function is implementation specific, so I can't tell you what it will be. It's likely configurable in your OpenSSL settings.
Aug
21
comment From password to key
You mean the session key? It's randomly generated and exchanged using asymmetric crypto (public / private keys). No hashes or key derivation functions are involved in generating it. Passwords aren't used to create SSL connections.
Aug
21
answered From password to key
Aug
21
comment Can a SIM card be tracked without cell phone and battery?
The thing about jammers is that they're just powerful transmitters that drown out other signals. In terms of triangulation, this actually makes it easier to find you, or at least find the jammer.
Aug
21
answered Bad planning causing weak passwords
Aug
21
comment How to store chat conversations on my website?
@Kao Yes, key escrow is potentially possible. It would mean that the admin needs to put their password in every time a user wants to reset their password though.
Aug
21
revised Are there any tools that focus on shellcode analysis?
example; added 72 characters in body