46,193 reputation
12106195
bio website en.wikipedia.org/wiki/…
location United Kingdom
age 26
visits member for 2 years, 10 months
seen yesterday

Pentester, ex-developer, security researcher, reverse engineer, electronics tinkerer, internet activist, zombie eradicator, promulgator of useless facts, shrubbery inspector, bacon aficionado, devourer of donuts.

Strengths: Security, Crypto, Win32 API, C#, .NET, PHP, x86 assembly

All answers and comments are encrypted with ROT256-ECB.

Opinions are my own. Advice provided with no warranty.


Mar
20
answered Achieving PFS with public key cryptography
Mar
17
answered Suspicious http requests in my logs: *.html/RS=^
Mar
17
comment Secure Communication Between .Net Application and Website
Fiddler shouldn't be able to MitM the connection unless you overrode the default .NET SSL certificate validation. If you did, then you threw away 90% of SSLs security anyway.
Mar
17
answered Safe ways to store passwords without hashing them
Mar
17
answered Best practice for sending IP Addresses
Mar
12
awarded  Notable Question
Mar
11
awarded  Good Question
Mar
9
awarded  php
Mar
8
revised Is my AES/CTR/RIPEMD encryption correctly implemented?
edited tags
Mar
8
answered Is my AES/CTR/RIPEMD encryption correctly implemented?
Mar
8
answered How does my bank knows my second and forth chars of my password
Mar
5
comment Bitlocker on a laptop without carrying around recovery key
TrueCrypt isn't a bad alternative. Or PGP FDE if you want a more enterprisey solution.
Mar
4
comment How do you protect strings in code from users decompiling them and seeing them
You can't. Change your security model so that you don't have to do this, e.g. get each user to input their own API key, or proxy the requests through a web service that handles the API interface itself.
Mar
4
comment Whole system ACK flood attack making internet slow
What's the question?
Mar
4
comment .NET provides 8+ ways to encode data to prevent XSS attacks. Which one should I use when?
It's worth looking at the OWASP ESAPI project, which contains a whole bunch of filtering utilities designed to help prevent XSS in output destined for HTML (inside tags, attributes, etc.), JavaScript, and CSS. Sadly the .NET version isn't quite up-to-speed yet, but it's still usable.
Mar
4
comment How to prevent DHCP Starvation attack?
The trick is to cycle MACs, so that you aren't using more than one at once, but get different leases.
Mar
4
comment How to prevent DHCP Starvation attack?
+1 on this. Often DHCP servers are reluctant to issue a new lease to a new MAC address when a DHCP release has just taken place. This is usually to help keep a device on the same IP if it just glitched out for a moment. By repeatedly cycling request/release across MACs your port only ever has one assigned MAC at any one point in time, but the IPs end up getting thrown into a temporary wait pool until they eventually dry up. It won't be 100% effective, but it'll probably mess the network up a bit.
Mar
4
answered Which is the Best Cipher Mode and Padding Mode for AES Encryption?
Feb
28
awarded  Nice Question
Feb
23
awarded  Nice Answer