48,523 reputation
12118208
bio website en.wikipedia.org/wiki/…
location United Kingdom
age 26
visits member for 3 years
seen 20 hours ago

Pentester, ex-developer, security researcher, reverse engineer, electronics tinkerer, internet activist, zombie eradicator, promulgator of useless facts, shrubbery inspector, bacon aficionado, devourer of donuts.

Strengths: Security, Crypto, Win32 API, C#, .NET, PHP, x86 assembly

All answers and comments are encrypted with ROT256-ECB.

Opinions are my own. Advice provided with no warranty.


Oct
1
comment How does stored procedure prevents SQL injection?
@AnanduMDas No, that's not necessary. The database server, in a traditional string query, has to parse out the query language and data itself. This is why we have to sanitise the data, because it's ambiguous and could be mistaken for query language. When the two are separated out as part of the protocol (i.e. the query string and the data fed into it are split into separate sections of the packet), the data doesn't need to be sanitised because the database already knows that it's data, and won't treat it as query language.
Oct
1
answered Figure out if “correct” encryption algorithm was used
Oct
1
answered What does EMET do for Windows 8.1?
Oct
1
answered How does stored procedure prevents SQL injection?
Sep
30
awarded  Explainer
Sep
25
comment Can't I forge an SSL certificate?
@JavaIsCool Browser updates and OS updates. Here's an example of an MSKB hotfix to deploy new root CAs.
Sep
25
comment Can't I forge an SSL certificate?
@raz 10-30 years is a more accurate range. Most are around 20 years, from looking at my TRCA list.
Sep
25
comment Can't I forge an SSL certificate?
@JavaIsCool To an extent, yes. Operating systems usually push out updated root CA lists in updates (e.g. Windows hotfixes) and browsers usually ship them with updates. Revocation of compromised or replaced certificates is achieved with Certificate Revocation Lists (CRLs) and similar mechanisms.
Sep
25
answered Can't I forge an SSL certificate?
Sep
25
comment Four-factor authentication
@user2813274 Except George Washington's account would be long closed and locked, and your example has nothing to do with time locks in this context.
Sep
25
comment Is it possible to Spoof a TeamViewer ID?
Windows Server 2007 isn't an operating system. Did you mean 2003, 2008, or 2008 R2? ;) (not that it really matters)
Sep
25
comment C++ memset() memory overflow
@Mark It's absolutely on topic here. Whether someone could answer it better elsewhere is irrelevant. In these situations you can advise OP to ask over on another site, because they'd have better expertise, but that's not a valid reason alone to flag something to be closed as off-topic.
Sep
25
revised C++ memset() memory overflow
added 319 characters in body
Sep
25
comment C++ memset() memory overflow
@Mark Ah, yes, so it does - it's a local scope instance. Blame my lack of coffee this morning! Rather odd that this is flagged, then.
Sep
25
comment C++ memset() memory overflow
Come now, who voted this as off-topic? It's about the security of a particular operation in code. If that's not security, I don't know what is. Get some itch cream for your trigger finger.
Sep
25
comment C++ memset() memory overflow
@Mark Admittedly I've not used C++ for a while (I'm more used to C), but my understanding was that MyObject op; alone didn't call the default constructor, whereas MyObject op(); does. Also, surely &op doesn't refer to the object itself (since op is a pointer type) but rather the address of the pointer?
Sep
25
comment How do attackers find the database technology used by a web application?
This is a mess. Can you go through and clean this up to use reasonable formatting please? The spaces in URLs aren't needed. Also, all of part 1 is nonsense and irrelevant to the question.
Sep
25
answered C++ memset() memory overflow
Sep
24
awarded  Guru
Sep
24
answered What will disabling third party cookies block?