57,470 reputation
17139235
bio website en.wikipedia.org/wiki/…
location United Kingdom
age 27
visits member for 3 years, 9 months
seen Jul 15 at 23:36

Pentester, ex-developer, security researcher, reverse engineer, electronics tinkerer, internet activist, zombie eradicator, promulgator of useless facts, shrubbery inspector, bacon aficionado, devourer of donuts.

Strengths: Security, Crypto, Win32 API, C#, .NET, PHP, x86 assembly

All answers and comments are encrypted with ROT256-ECB.

Opinions are my own. Advice provided with no warranty.


Feb
5
comment Firefox pre-downloading
Could someone link to any official documentation on this feature? It'd be very useful to see how / why this is done.
Feb
5
asked Fixing the high-bit problem in PHP's crypt() implementation
Feb
5
revised Is using the md5 hashing algorithm as method for authorization in an HTTP POST request unsafe?
mistake
Feb
5
comment Is using the md5 hashing algorithm as method for authorization in an HTTP POST request unsafe?
Whoops, my bad!
Feb
5
answered Is using the md5 hashing algorithm as method for authorization in an HTTP POST request unsafe?
Feb
4
comment Picking an encryption algorithm for auth tokens passed via AJAX
What's wrong with standard block ciphers like AES? On modern CPUs the overhead is minuscule.
Feb
4
reviewed Edit Securing the SOAP Messages
Feb
4
revised Securing the SOAP Messages
improved formatting / grammar
Feb
3
comment Maltego transform samples
Didn't know you had an account on here Nadeem! Cheers for this. Still interested in more details on how various data types are used in raw transforms though.
Feb
3
answered my site with joomla 1.5.14 got defaced and I'd like to know how he did it and stop it
Feb
3
comment Encrypting user data using password and forgot my password
@CodesInChaos Sure, that works too. It's not really any different in terms of security, just more efficient.
Feb
3
comment Encrypting user data using password and forgot my password
@CodesInChaos Which is why I said "The secret answers option is the easiest, but it's possible to do this with any secret value". Also, secret questions should not be easily attainable public information - they should be things like your first high-school crush's name, or the name of your first stuffed toy as a kid. In reality such things are very difficult to guess or discover. Plus you should always provide soft-security techniques such as requiring a reset email to go to the user with the reset link, before any questions are asked.
Feb
3
comment Encrypting user data using password and forgot my password
There's no reason to use a full encryption method if you're generating two keys of equal length. The xor operation is ideal for the situation - it's essentially a one time pad with a key generated by a KDF, so you can guarantee that the security of that operation is at least as strong as the KDF and therefore at least as strong the password. You're somewhat right about running the expensive KDF twice - you could run a cheap KDF for the second option, but then you're running into a situation where offline cracking from a database dump is relatively easy. I prefer the full KDF.
Feb
3
comment Encrypting user data using password and forgot my password
Sure it does, but isn't that the standard mechanism for most things? You need to know your password, and if you don't know that you need to know your secret answers. The difference is that the latter should always be memorable. If they forget the name of their first schoolteacher and their first pet's name, that's just too bad. Security comes at the price of some usability.
Feb
3
awarded  Custodian
Feb
3
reviewed Needs Improvement Are man-in-the-middle attacks against p2p systems realistic?
Feb
3
reviewed Excellent Security tradeoffs of pathname-based MAC (e.g., TOMOYO, grsecurity, AppArmor, …)
Feb
3
reviewed Needs Improvement Do any DNS registrars support multi factor authentication?
Feb
3
reviewed Satisfactory Is it useful to determine the name of the server software while doing a penetration test?
Feb
3
reviewed Excellent How much should I care about the iOS/Android version when pentesting mobile app?