48,583 reputation
12118208
bio website en.wikipedia.org/wiki/…
location United Kingdom
age 26
visits member for 3 years
seen 2 days ago

Pentester, ex-developer, security researcher, reverse engineer, electronics tinkerer, internet activist, zombie eradicator, promulgator of useless facts, shrubbery inspector, bacon aficionado, devourer of donuts.

Strengths: Security, Crypto, Win32 API, C#, .NET, PHP, x86 assembly

All answers and comments are encrypted with ROT256-ECB.

Opinions are my own. Advice provided with no warranty.


Sep
24
comment Escape from <script> to cause a XSS (XSS when reflection is already under <script>)
@user38257 That's not how StackExchange works. If you didn't get an answer to your question, it's probably because you didn't provide enough information or detail. Editing your question or commenting on it brings it back to the active questions list, where people are more likely to see it. Do not repost old questions.
Sep
24
awarded  Good Answer
Sep
24
awarded  malware
Sep
24
awarded  Good Answer
Sep
23
answered Secure shuffles and the rand() function
Sep
23
comment Server situated on two physical networks - Bad idea or not
@makerofthings7 It depends. I think VM separation in ESX is reasonable enough that I'd be reasonably happy putting two different sensitivity level systems on the same box. I don't know about putting them on the same VLAN though - it seems like a bad idea. If it were something that'd be storing regulated data (e.g. PCI DSS) or protectively marked data, I'd want it on a completely separate dedicated box, with appropriate dedicated controls in place.
Sep
23
awarded  Nice Answer
Sep
23
awarded  Nice Answer
Sep
23
answered Server situated on two physical networks - Bad idea or not
Sep
23
answered Four-factor authentication
Sep
23
comment Four-factor authentication
The time is not an authentication factor. It's still a security control, but it has nothing to do with authentication itself, as it doesn't provide evidence that something or someone is authentic.
Sep
23
answered Password verification scheme (used in eg. MS Office) - more secure than just a hash?
Sep
23
answered Why does malware periodically check google.com
Sep
23
answered Is it a security threat to have food or drink next to computers
Sep
23
comment What are lawful network interception tools?
@GriffinNowak Possession of malware by itself, for the mostpart, in jurisdictions I am aware of, is entirely legal. Consider a case where someone is infected by malware; the computer is their property and therefore they are in possession of malware. If simple possession was illegal, then they would be, which makes no sense. The interesting (and muddy) parts of law are the parts that separate incidental possession from possession with intent.
Sep
23
answered What are lawful network interception tools?
Sep
23
comment Intermediate certificate not sent to clients?
This question would probably be more appropriate over at ServerFault. I've flagged for a moderator to take a look.
Sep
23
answered What is the difference between XSS and Cross Site Flashing?
Sep
23
answered Understanding Diffie-Hellman key exchange
Sep
23
answered I have a unlimited vpn and a 2GB isp. can i use my vpn without using the 2 gig limit on my ISP?