48,503 reputation
12118208
bio website en.wikipedia.org/wiki/…
location United Kingdom
age 26
visits member for 3 years
seen 1 hour ago

Pentester, ex-developer, security researcher, reverse engineer, electronics tinkerer, internet activist, zombie eradicator, promulgator of useless facts, shrubbery inspector, bacon aficionado, devourer of donuts.

Strengths: Security, Crypto, Win32 API, C#, .NET, PHP, x86 assembly

All answers and comments are encrypted with ROT256-ECB.

Opinions are my own. Advice provided with no warranty.


Sep
25
answered C++ memset() memory overflow
Sep
24
awarded  Guru
Sep
24
answered What will disabling third party cookies block?
Sep
24
answered How could SSL certificate affect the symmetric key length?
Sep
24
comment New payment option on Paypal “Enter your online banking ID + password”: Any mechanism that could make this safe?
That's the most creative form of image censoring I've ever seen.
Sep
24
comment Escape from <script> to cause a XSS (XSS when reflection is already under <script>)
@user38257 That's not how StackExchange works. If you didn't get an answer to your question, it's probably because you didn't provide enough information or detail. Editing your question or commenting on it brings it back to the active questions list, where people are more likely to see it. Do not repost old questions.
Sep
24
awarded  Good Answer
Sep
24
awarded  malware
Sep
24
awarded  Good Answer
Sep
23
answered Secure shuffles and the rand() function
Sep
23
comment Server situated on two physical networks - Bad idea or not
@makerofthings7 It depends. I think VM separation in ESX is reasonable enough that I'd be reasonably happy putting two different sensitivity level systems on the same box. I don't know about putting them on the same VLAN though - it seems like a bad idea. If it were something that'd be storing regulated data (e.g. PCI DSS) or protectively marked data, I'd want it on a completely separate dedicated box, with appropriate dedicated controls in place.
Sep
23
awarded  Nice Answer
Sep
23
awarded  Nice Answer
Sep
23
answered Server situated on two physical networks - Bad idea or not
Sep
23
answered Four-factor authentication
Sep
23
comment Four-factor authentication
The time is not an authentication factor. It's still a security control, but it has nothing to do with authentication itself, as it doesn't provide evidence that something or someone is authentic.
Sep
23
answered Password verification scheme (used in eg. MS Office) - more secure than just a hash?
Sep
23
answered Why does malware periodically check google.com
Sep
23
answered Is it a security threat to have food or drink next to computers
Sep
23
comment What are lawful network interception tools?
@GriffinNowak Possession of malware by itself, for the mostpart, in jurisdictions I am aware of, is entirely legal. Consider a case where someone is infected by malware; the computer is their property and therefore they are in possession of malware. If simple possession was illegal, then they would be, which makes no sense. The interesting (and muddy) parts of law are the parts that separate incidental possession from possession with intent.