46,153 reputation
12106195
bio website en.wikipedia.org/wiki/…
location United Kingdom
age 26
visits member for 2 years, 10 months
seen yesterday

Pentester, ex-developer, security researcher, reverse engineer, electronics tinkerer, internet activist, zombie eradicator, promulgator of useless facts, shrubbery inspector, bacon aficionado, devourer of donuts.

Strengths: Security, Crypto, Win32 API, C#, .NET, PHP, x86 assembly

All answers and comments are encrypted with ROT256-ECB.

Opinions are my own. Advice provided with no warranty.


Dec
14
awarded  cryptography
Dec
13
comment Disclosure in potential loss-of-life situations, with an uncooperative vendor
@KeithS It was an environmental control unit with an air scrubber built in. You can infer the rest yourself ;)
Dec
13
comment What hardware technology (GPU, FPGA) is fastest at generating RSA keys?
Product recommendations are off-topic here.
Dec
13
comment openssl blowfish key limited to 256 bits?
@CodesInChaos I actually trust Twofish more than Threefish, considering the difference in success that has been had in cryptanalysis of both algorithms. +1 on AES though.
Dec
13
comment openssl blowfish key limited to 256 bits?
Any reason you're not using TwoFish? Same low footprint, no patents, but more secure and more commonly used.
Dec
13
answered How secure are passwords that are set via IRC's /nicksrv?
Dec
13
comment Why don't people hash and salt usernames before storing them
Yeah, I've seen this done. It's more of an obscurity mechanism really, because if the password is hashed strongly then it shouldn't be necessary at all.
Dec
13
comment Why don't people hash and salt usernames before storing them
The snark is strong in this one ;)
Dec
13
reviewed Edit suggested edit on Are there guidelines for application design of HIPAA compliant browser applications?
Dec
13
revised Are there guidelines for application design of HIPAA compliant browser applications?
Fascinating problem, but I had to read the question three times before I found the real question; I hope the edit will raise the profile & make it easier.
Dec
13
reviewed Edit suggested edit on Is it possible to decrypt symmetric key encryption without the key?
Dec
13
revised Is it possible to decrypt symmetric key encryption without the key?
just some cleaning up / removing junk
Dec
13
comment Authentication without saving password
That's exactly how password hashing works.
Dec
13
comment Brute-force an SSH-login that has only a 4-letter password
If you just want a quick hack, use 4 nested loops that go from a-z, and concatenate the values together.
Dec
13
revised Does including decorative HTTP headers into server reply pose extra security risk?
Gotta have a ™ in there! :)
Dec
13
answered Does including decorative HTTP headers into server reply pose extra security risk?
Dec
13
revised What is the difference between Simple Power Analysis and Differential Power Analysis?
added 528 characters in body
Dec
13
answered What is the difference between Simple Power Analysis and Differential Power Analysis?
Dec
13
comment Are there guidelines for application design of HIPAA compliant browser applications?
s/similar/familiar/
Dec
13
comment Is it possible to decrypt symmetric key encryption without the key?
Yep, that's called Rubber Hose Cryptography. Hammers also work equally well, but they do leave rather obvious marks.