49,873 reputation
14121210
bio website en.wikipedia.org/wiki/…
location United Kingdom
age 26
visits member for 3 years, 2 months
seen Dec 19 at 18:59

Pentester, ex-developer, security researcher, reverse engineer, electronics tinkerer, internet activist, zombie eradicator, promulgator of useless facts, shrubbery inspector, bacon aficionado, devourer of donuts.

Strengths: Security, Crypto, Win32 API, C#, .NET, PHP, x86 assembly

All answers and comments are encrypted with ROT256-ECB.

Opinions are my own. Advice provided with no warranty.


Oct
10
revised wireshark wiki description
Complete re-write.
Oct
10
reviewed Close Is “HTTPS” ~100% secure?
Oct
10
comment With RSA, can one ensure that two entities will not have the same private key?
@RickyDemer That is true, though when I said "isn't really defined" I was referring to the fact that (as Stephen pointed out) we don't have a defined, agreed upon function for calculating its true value, short of actually counting all the primes, which defeats the point of the PCF in the first place.
Oct
10
comment Password resets - what practices should web services follow?
@ThomasEyde I'd suggest against that from a usability angle. Not everyone has internet access on their phone.
Oct
10
awarded  Nice Answer
Oct
10
awarded  Favorite Question
Oct
7
answered With RSA, can one ensure that two entities will not have the same private key?
Oct
7
awarded  Excavator
Oct
7
comment What would one need to do in order to hijack a satellite?
While this link may answer the question, it is better to include the essential parts of the answer here and provide the link for reference. Link-only answers can become invalid if the linked page changes.
Oct
7
reviewed Edit What would one need to do in order to hijack a satellite?
Oct
7
revised What would one need to do in order to hijack a satellite?
Added some key highlights from the link.
Oct
7
reviewed Close Reconnaissance countermeasures
Oct
7
reviewed Close Is OWASP ESAPI .NET Edition really used? Is this project still alive?
Oct
6
comment Can AES encryption prevent modifying bits in a wireless protocol?
To be specific, if you choose AES-CBC you'll have block-level malleability allowing you to apply any arbitrary xor tweak to a block (and thus giving you arbitrary modification if you know any plaintext) with the side-effect of corrupting the adjacent block. Or, if you can modify the IV arbitrarily, you can gain xor malleability on the first block with no side-effects. If you choose AES-CTR or any other stream mode, you'll have full xor malleability across the whole stream. So you need authenticity either through MAC or an authenticated mode (e.g. GCM).
Oct
6
awarded  Popular Question
Oct
5
awarded  Nice Question
Oct
3
awarded  Guru
Oct
2
comment Does dual boot hurt security?
Easiest references are the malleability article on Wikipedia and this great article on practical exploitation of LUKS in Ubuntu.
Oct
2
comment Does dual boot hurt security?
According to Wikipedia dm-crypt uses CBC by default, so it's vulnerable. There are two main attacks. The first is to just corrupt data blocks, which is possible for any block. The second is to xor ciphertext blocks with a tweak, and that results in the target block's plaintext also being xor'ed with that tweak, and the adjacent block being totally corrupted. This can be useful if you know that a particular bootloader or kernel image is in a specific location on the encrypted disk, because you might be able to modify code.
Oct
2
comment How can I recover files encrypted by Android ransomware?
That's only for CryptoLocker, not any arbitrary ransomware.