52,923 reputation
16125218
bio website en.wikipedia.org/wiki/…
location United Kingdom
age 27
visits member for 3 years, 5 months
seen 4 mins ago

Pentester, ex-developer, security researcher, reverse engineer, electronics tinkerer, internet activist, zombie eradicator, promulgator of useless facts, shrubbery inspector, bacon aficionado, devourer of donuts.

Strengths: Security, Crypto, Win32 API, C#, .NET, PHP, x86 assembly

All answers and comments are encrypted with ROT256-ECB.

Opinions are my own. Advice provided with no warranty.


Mar
19
comment Is my data secure in locked screen if I use bitlocker
I think you mean "brute force" rather than "DDOS".
Mar
19
answered Why are unsigned Java applications blocked?
Mar
19
answered Is android's FDE secure from offline attacks?
Mar
19
comment Is android's FDE secure from offline attacks?
Ah, according to this it's a feature new to Android Lollipop (5.x).
Mar
19
comment Sans security courses: How are self study courses certified?
You're probably better off emailing SANS with this kind of question.
Mar
19
comment Is android's FDE secure from offline attacks?
Last I checked, Android doesn't support FDE unless you have passphrase locking enabled. I've tested on KitKat (4.4.2) and Ice Cream Sandwich (4.0.4) and neither supported FDE with a 6-digit PIN; the encryption wizard forced me to switch the lock mode before allowing encryption.
Mar
16
comment Session Fixation - Is that even an issue here?
@Mercious You can never be 100% sure that you didn't miss something. Everything has bugs, and you might not even be responsible for the bug that results in XSS (or a similar impact) on your site. As I noted, SOP bypass bugs in browsers are relatively common, so you should account for them where possible. Besides, the fix for session fixation on login is just to regenerate the token on login - it's not a lot of work.
Mar
16
answered Does changing the default number of iterations in KeePass (or other encryption applications) increase security?
Mar
16
comment Session Fixation - Is that even an issue here?
@Mercious You're also presuming that the user's browser is without bugs. What if there's a same-origin policy violation bug in the user's browser, and an attacker leverages it to create a cookie across origins onto your domain? With your session fixation issue present, your user's account gets hijacked. If you fix that bug, they're not quite so boned.
Mar
16
comment Session Fixation - Is that even an issue here?
@Mercious Major, major flaw in your thinking: XSS doesn't have to be from standard user input. It could be from the Referer, the URI itself, HTTP headers, external content (e.g. included jquery.js), or even DOM-based from some dodgy JavaScript. Your filters may also be defective, ineffective against certain character classes (UTF-8, etc.), or not have 100% coverage. You should never presume that XSS will not be a problem.
Mar
10
comment How can I explain SQL injection without technical jargon?
@Kyralessa Perhaps it houses its charging port ;]
Mar
8
awarded  Nice Answer
Mar
7
awarded  Popular Question
Mar
7
comment Are there / have there ever been viruses that completely evade virus scanners for very long?
Sorry, I should've been more clear. From memory, one of the major internet watch organisations stated that they'd found packets from 2011 which looked like someone trying out the same bug, but they couldn't be sure. Shellshock is thought to have been used by a small botnet in 2012, though the bot developers may not have known how significant their find was.
Mar
7
answered Are there / have there ever been viruses that completely evade virus scanners for very long?
Mar
6
comment How is DDoS possible if you're not listening to the DoS traffic?
CloudFlare also has the benefit of being able to use anycast routing to distribute the load of the attack away from the target - a luxury you don't have at the ISP level, let alone at your router.
Mar
6
answered Can I create an application that can decrypt data but the administrator of the application cannot?
Mar
6
revised How is DDoS possible if you're not listening to the DoS traffic?
Title
Mar
6
revised Why would home routers accept incoming DNS traffic?
Title, tags.
Mar
6
comment How can I securely delete items in a database?
There's no way to recover it from the database itself - there's no UNDELETE or similar. The only way to get at the deleted data is to read the database file on disk and extract latent data.