53,653 reputation
17129220
bio website en.wikipedia.org/wiki/…
location United Kingdom
age 27
visits member for 3 years, 6 months
seen 21 mins ago

Pentester, ex-developer, security researcher, reverse engineer, electronics tinkerer, internet activist, zombie eradicator, promulgator of useless facts, shrubbery inspector, bacon aficionado, devourer of donuts.

Strengths: Security, Crypto, Win32 API, C#, .NET, PHP, x86 assembly

All answers and comments are encrypted with ROT256-ECB.

Opinions are my own. Advice provided with no warranty.


Mar
20
answered How Secure is my Application?
Mar
20
comment is return-to-libc attacks possible Now?
You're probably running into a linker optimisation.
Mar
20
comment Are there different degrees of “confidentiality”? What is the best way for a psychologist to maintain confidentiality of communications with patients?
HIPAA applies if you're handling or transmitting patient data (assuming you operate in America). Emailing it unencrypted would not be considered compliant.
Mar
20
answered How good is confidentiality with physical mail forwarding companies?
Mar
20
comment Are there additional security risks posed by rooting an Android device?
@RockPaperLizard Any standard Android pentesting guide would cover it, but your primary threats are likely to be from poor IPC code.
Mar
19
comment card.io & PCI DSS v3.0
That's useful to know - I wasn't aware there was any ruling on audio recordings of the data. More ammunition for getting people to do it right!
Mar
19
answered Are there additional security risks posed by rooting an Android device?
Mar
19
comment card.io & PCI DSS v3.0
I have come across organisations who attempted to "thwart" PCI-DSS and similar requirements by only storing images of the card front, to use the "we don't store PAN" argument, but (surprise surprise) their QSA did not sign off on it at all. At the end of the day, they are storing payment card information which is covered by regulatory requirements. Doesn't matter whether the PAN is stored as text, a cell in a spreadsheet, a JPEG, or whatever - it's still card information.
Mar
19
comment What email addresses are treated as trusted?
Unfortunately I don't think there's a canonical all-encompassing list - RFC2142 is where I'd have started too. You'd have to ask the major CAs and cross your fingers. Yet another fun facet of PKI.
Mar
19
answered Is my data secure in locked screen if I use bitlocker
Mar
19
comment Is my data secure in locked screen if I use bitlocker
I think you mean "brute force" rather than "DDOS".
Mar
19
answered Why are unsigned Java applications blocked?
Mar
19
answered Is android's FDE secure from offline attacks?
Mar
19
comment Is android's FDE secure from offline attacks?
Ah, according to this it's a feature new to Android Lollipop (5.x).
Mar
19
comment Sans security courses: How are self study courses certified?
You're probably better off emailing SANS with this kind of question.
Mar
19
comment Is android's FDE secure from offline attacks?
Last I checked, Android doesn't support FDE unless you have passphrase locking enabled. I've tested on KitKat (4.4.2) and Ice Cream Sandwich (4.0.4) and neither supported FDE with a 6-digit PIN; the encryption wizard forced me to switch the lock mode before allowing encryption.
Mar
16
comment Session Fixation - Is that even an issue here?
@Mercious You can never be 100% sure that you didn't miss something. Everything has bugs, and you might not even be responsible for the bug that results in XSS (or a similar impact) on your site. As I noted, SOP bypass bugs in browsers are relatively common, so you should account for them where possible. Besides, the fix for session fixation on login is just to regenerate the token on login - it's not a lot of work.
Mar
16
answered Does changing the default number of iterations in KeePass (or other encryption applications) increase security?
Mar
16
comment Session Fixation - Is that even an issue here?
@Mercious You're also presuming that the user's browser is without bugs. What if there's a same-origin policy violation bug in the user's browser, and an attacker leverages it to create a cookie across origins onto your domain? With your session fixation issue present, your user's account gets hijacked. If you fix that bug, they're not quite so boned.
Mar
16
comment Session Fixation - Is that even an issue here?
@Mercious Major, major flaw in your thinking: XSS doesn't have to be from standard user input. It could be from the Referer, the URI itself, HTTP headers, external content (e.g. included jquery.js), or even DOM-based from some dodgy JavaScript. Your filters may also be defective, ineffective against certain character classes (UTF-8, etc.), or not have 100% coverage. You should never presume that XSS will not be a problem.