45,582 reputation
12105191
bio website en.wikipedia.org/wiki/…
location United Kingdom
age 26
visits member for 2 years, 9 months
seen yesterday

Pentester, ex-developer, security researcher, reverse engineer, electronics tinkerer, internet activist, zombie eradicator, promulgator of useless facts, shrubbery inspector, bacon aficionado, devourer of donuts.

Strengths: Security, Crypto, Win32 API, C#, .NET, PHP, x86 assembly

All answers and comments are encrypted with ROT256-ECB.

Opinions are my own. Advice provided with no warranty.


Dec
13
reviewed Edit suggested edit on Are there guidelines for application design of HIPAA compliant browser applications?
Dec
13
revised Are there guidelines for application design of HIPAA compliant browser applications?
Fascinating problem, but I had to read the question three times before I found the real question; I hope the edit will raise the profile & make it easier.
Dec
13
reviewed Edit suggested edit on Is it possible to decrypt symmetric key encryption without the key?
Dec
13
revised Is it possible to decrypt symmetric key encryption without the key?
just some cleaning up / removing junk
Dec
13
comment Authentication without saving password
That's exactly how password hashing works.
Dec
13
comment Brute-force an SSH-login that has only a 4-letter password
If you just want a quick hack, use 4 nested loops that go from a-z, and concatenate the values together.
Dec
13
revised Does including decorative HTTP headers into server reply pose extra security risk?
Gotta have a ™ in there! :)
Dec
13
answered Does including decorative HTTP headers into server reply pose extra security risk?
Dec
13
revised What is the difference between Simple Power Analysis and Differential Power Analysis?
added 528 characters in body
Dec
13
answered What is the difference between Simple Power Analysis and Differential Power Analysis?
Dec
13
comment Are there guidelines for application design of HIPAA compliant browser applications?
s/similar/familiar/
Dec
13
comment Is it possible to decrypt symmetric key encryption without the key?
Yep, that's called Rubber Hose Cryptography. Hammers also work equally well, but they do leave rather obvious marks.
Dec
13
comment Encrypting data for Android mobile app
@ThusithaNuwan Anything "business records" stored on a server in the US is open to theft by the government, and they recently ruled that customer data on cloud storage is a business record.
Dec
12
asked Disclosure in potential loss-of-life situations, with an uncooperative vendor
Dec
12
comment Is there an asymmetric encryption algorithm that maintains the length of the plaintext?
-1. AES is symmetric, and using registers has nothing to do with preserving the length of the data in ciphertext.
Dec
12
revised Gold Standard for password hashing
deleted 1 characters in body
Dec
12
comment Gold Standard for password hashing
@CodesInChaos I'll edit, but the Microsoft thing is close enough.
Dec
12
comment ZX Spectrum tape loader: how was copy prevention implemented?
@AJHenderson As a kid, my dad and I actually built a custom bit of hardware to strip Macrovision from video signals. Essentially it was a comparator, ADC, sample buffer, DAC and notch filter. The signal would go through the ADC, sit in a sample buffer for ~250µs, go back through an DAC, and finally though the notch filter. When comparator spotted the Macrovision peaks, it would enable the notch filter and cut off everything but the tracking. After a fair amount of tweaking (and a lot of maths that I didn't understand back then) we got it to record a pay-per-view movie onto VHS :)
Dec
12
awarded  Nice Answer
Dec
12
comment Teaching a loved one about secure coding practices
Oh dear $deity, what have I started? *gets mind out of gutter*