45,637 reputation
12105191
bio website en.wikipedia.org/wiki/…
location United Kingdom
age 26
visits member for 2 years, 9 months
seen yesterday

Pentester, ex-developer, security researcher, reverse engineer, electronics tinkerer, internet activist, zombie eradicator, promulgator of useless facts, shrubbery inspector, bacon aficionado, devourer of donuts.

Strengths: Security, Crypto, Win32 API, C#, .NET, PHP, x86 assembly

All answers and comments are encrypted with ROT256-ECB.

Opinions are my own. Advice provided with no warranty.


Apr
9
comment Do I need to worry about my SSH keys if my system was vulnerable to Heartbleed?
It's worth reading this: security.stackexchange.com/questions/55119/…
Apr
4
awarded  Popular Question
Mar
24
awarded  Nice Answer
Mar
21
comment Alternative to security questions for account recovery when email isn't an option
That was the point of what I was saying.
Mar
21
awarded  Nice Question
Mar
21
asked Alternative to security questions for account recovery when email isn't an option
Mar
20
answered Log in security - saving a session
Mar
20
answered Achieving PFS with public key cryptography
Mar
17
answered Suspicious http requests in my logs: *.html/RS=^
Mar
17
comment Secure Communication Between .Net Application and Website
Fiddler shouldn't be able to MitM the connection unless you overrode the default .NET SSL certificate validation. If you did, then you threw away 90% of SSLs security anyway.
Mar
17
answered Safe ways to store passwords without hashing them
Mar
17
answered Best practice for sending IP Addresses
Mar
12
awarded  Notable Question
Mar
11
awarded  Good Question
Mar
9
awarded  php
Mar
8
revised Is my AES/CTR/RIPEMD encryption correctly implemented?
edited tags
Mar
8
answered Is my AES/CTR/RIPEMD encryption correctly implemented?
Mar
8
answered How does my bank knows my second and forth chars of my password
Mar
5
comment Bitlocker on a laptop without carrying around recovery key
TrueCrypt isn't a bad alternative. Or PGP FDE if you want a more enterprisey solution.
Mar
4
comment How do you protect strings in code from users decompiling them and seeing them
You can't. Change your security model so that you don't have to do this, e.g. get each user to input their own API key, or proxy the requests through a web service that handles the API interface itself.