53,623 reputation
17128220
bio website en.wikipedia.org/wiki/…
location United Kingdom
age 27
visits member for 3 years, 6 months
seen 11 hours ago

Pentester, ex-developer, security researcher, reverse engineer, electronics tinkerer, internet activist, zombie eradicator, promulgator of useless facts, shrubbery inspector, bacon aficionado, devourer of donuts.

Strengths: Security, Crypto, Win32 API, C#, .NET, PHP, x86 assembly

All answers and comments are encrypted with ROT256-ECB.

Opinions are my own. Advice provided with no warranty.


Sep
3
answered SOCKS proxy security concerns
Sep
3
revised SOCKS proxy security concerns
formatting / spelling / title
Sep
3
answered Token-based authentication - Securing the token
Sep
3
comment Is TrueCrypt safe enough to store clear-text-passwords?
Or correcthorsebatterystaplecorrecthorsebatterystaple1234
Sep
3
asked Bypassing the BIOS password
Sep
3
comment Tracking stolen laptop which has a login password
@FrankPresenciaFandos Try switching to TrueCrypt's system encryption. It allows you to completely encrypt the disk, and have it decrypted at boot via the TC bootloader. This ensures that your entire disk is safe, including the OS and any swap file you might have.
Sep
3
answered Why is tunneling so important in pen testing?
Sep
2
revised Tracking stolen laptop which has a login password
Various typos.
Sep
2
answered Scanning A Subnet Externaly
Sep
2
comment What is a good practical (and sane) way to manage all your passwords for online sites?
You can store your password archives on DropBox or an equivalent service. Besides, your archive should be backed up along with your data. You do have backups, right? ;)
Sep
2
comment How should I manage my passwords?
Duplicate of What is a good practical (and sane) way to manage all your passwords for online sites? or security.stackexchange.com/questions/1222/…
Sep
2
comment Why is ARP poisoning killing all network activity?
@jkarr It might be that your tool isn't working properly. Try analysing your network with a tool like Wireshark, to see what ARP packets are being broadcast.
Sep
2
answered Why is ARP poisoning killing all network activity?
Sep
2
answered Hide web.xml file from public view
Sep
2
comment Are prepared statements 100% safe against SQL injection?
@drjimbob That might actually be one of the most informative comments I've ever read on this site. Now, I'm off to go read about the implementation of SQL parsers...
Sep
2
comment Why don't computers check whether there are memory contents in some memory space?
Great answer. You're starting to rival me for tl;dr-ness these days!
Sep
2
comment Why is php not used for banking sites or for a banking transaction?
@D.W. I'm not saying PHP is blameless here - the certainly could have done a better job with the design of the API and documentation in terms of promoting good security practices - but it's a drop in the ocean compared with the number of bad tutorials there are out there.
Sep
2
comment Why is php not used for banking sites or for a banking transaction?
@D.W. Whilst I somewhat agree with the points made in there, the fact is that PHP makes it very easy to write code, and it scales incredibly well. If you use a proper framework design (MVC-style) it can be really maintainable too. Once you get past its quirks and strangeness, it's actually a great language. However, its biggest failure is not really its own fault - tutorials (W3Schools being the obvious example) have a horrendous track record for teaching awful security practices, e.g. mysql_query with concatenated strings and no sanitization.
Sep
2
comment Why is php not used for banking sites or for a banking transaction?
@HarshalMahajan Encryption is not security. Please don't confuse the two. For example, I might encrypt my data with AES256, using a key derived using PBKDF2, with a perfectly random IV, then put the password on a sticky-note and attach it to my computer. The crypto is strong, the security is weak. There's a huge difference.
Sep
2
comment Webservices exploitation / axis/services/AdminService?Method=AdminService
I removed the link from your post. Whilst it'd be nice if we could all trust arbitrary links in people's questions, this is a security board. I also don't want a spam/malware spider spotting your link and messing up your sandbox.