52,857 reputation
16125218
bio website en.wikipedia.org/wiki/…
location United Kingdom
age 27
visits member for 3 years, 5 months
seen 2 days ago

Pentester, ex-developer, security researcher, reverse engineer, electronics tinkerer, internet activist, zombie eradicator, promulgator of useless facts, shrubbery inspector, bacon aficionado, devourer of donuts.

Strengths: Security, Crypto, Win32 API, C#, .NET, PHP, x86 assembly

All answers and comments are encrypted with ROT256-ECB.

Opinions are my own. Advice provided with no warranty.


Mar
20
comment Help understanding VPN
This doesn't really answer the question, beyond a (pretty poor) definition of the term "VPN", which you've copied verbatim from the site.
Mar
20
comment Cross Origin Resource Sharing question
How are you hosting your local code? If it's just as a direct file path into your browser, it may ignore SOP as you've not got an origin. Keep in mind that the SOP for CORS is browser-enforced, not server-enforced.
Mar
20
comment Is this a sensible way to encrypt user data?
@StuartP.Bentley scrypt will likely be used as a KDF to derive a key from the user's password.
Mar
20
comment is return-to-libc attacks possible Now?
The linker optimisation mentioned there isn't exclusive to Microsoft toolchains. Actually - can you post the disassembly that you've seen? It may be a direct syscall rather than an actual call to system().
Mar
20
answered Attack coming from multiple IPs
Mar
20
comment Are there different degrees of “confidentiality”? What is the best way for a psychologist to maintain confidentiality of communications with patients?
@StanShunpike SMS is cleartext, so using it to transfer patient records is a HIPAA violation. Same goes for standard pagers. Voice communications over cellular networks are encrypted, and their contents are protected legally (wiretapping laws), so I would imagine you'd be ok with that. Though I'd refrain from leaving sensitive information about patient care specifics on voicemail regardless - just ask them to call you back to discuss things.
Mar
20
revised exploiting Heap Overflow in gdb segfaults
added 98 characters in body
Mar
20
comment How Secure is my Application?
It's not as trivial as pulling it off the wire. Note that you can still encrypt the traffic inside HTTPS if you're trying to avoid the user getting access to the binaries. However, it seems you're trying to implement what amounts to a DRM system, which is inherently impossible: the user's machine is their own to do with as they wish, so they will get access if they want. In fact, all they need to do is write their own client that pulls down the binaries and saves them. You can't stop that - you can only make it a little harder.
Mar
20
revised How Secure is my Application?
added 469 characters in body
Mar
20
answered How Secure is my Application?
Mar
20
comment is return-to-libc attacks possible Now?
You're probably running into a linker optimisation.
Mar
20
comment Are there different degrees of “confidentiality”? What is the best way for a psychologist to maintain confidentiality of communications with patients?
HIPAA applies if you're handling or transmitting patient data (assuming you operate in America). Emailing it unencrypted would not be considered compliant.
Mar
20
answered How good is confidentiality with physical mail forwarding companies?
Mar
20
comment Slow torrent speed
Please don't answer questions that are blatantly off-topic here. It just encourages people to post anyway.
Mar
20
comment Are there additional security risks posed by rooting an Android device?
@RockPaperLizard Any standard Android pentesting guide would cover it, but your primary threats are likely to be from poor IPC code.
Mar
19
comment card.io & PCI DSS v3.0
That's useful to know - I wasn't aware there was any ruling on audio recordings of the data. More ammunition for getting people to do it right!
Mar
19
answered Are there additional security risks posed by rooting an Android device?
Mar
19
comment card.io & PCI DSS v3.0
I have come across organisations who attempted to "thwart" PCI-DSS and similar requirements by only storing images of the card front, to use the "we don't store PAN" argument, but (surprise surprise) their QSA did not sign off on it at all. At the end of the day, they are storing payment card information which is covered by regulatory requirements. Doesn't matter whether the PAN is stored as text, a cell in a spreadsheet, a JPEG, or whatever - it's still card information.
Mar
19
comment What email addresses are treated as trusted?
Unfortunately I don't think there's a canonical all-encompassing list - RFC2142 is where I'd have started too. You'd have to ask the major CAs and cross your fingers. Yet another fun facet of PKI.
Mar
19
answered Is my data secure in locked screen if I use bitlocker