45,948 reputation
12106195
bio website en.wikipedia.org/wiki/…
location United Kingdom
age 26
visits member for 2 years, 10 months
seen 22 hours ago

Pentester, ex-developer, security researcher, reverse engineer, electronics tinkerer, internet activist, zombie eradicator, promulgator of useless facts, shrubbery inspector, bacon aficionado, devourer of donuts.

Strengths: Security, Crypto, Win32 API, C#, .NET, PHP, x86 assembly

All answers and comments are encrypted with ROT256-ECB.

Opinions are my own. Advice provided with no warranty.


Dec
12
comment ZX Spectrum tape loader: how was copy prevention implemented?
@D.H. It may just have been that the code was obfuscated, to prevent people disassembling the game and stripping out the license checking stuff.
Dec
12
comment Teaching a loved one about secure coding practices
Your question title makes the context sound really weird. You mention she's a loved one, yet the content sounds like you're her teacher. I mean, whatever floats your boat, but... O_o
Dec
12
comment Potential services.exe infected file?
@TheCapn I guess the silver lining is that this box is a great way to promote better security.
Dec
12
answered Potential services.exe infected file?
Dec
12
comment Potential services.exe infected file?
In which case, what are you actually asking?
Dec
12
comment Potential services.exe infected file?
You need additional proof? Having two services.exe processes running, one with a clearly malicious fake name, should be proof enough. Nuke it from orbit.
Dec
12
comment Gold Standard for password hashing
@HenningKlevjer Agreed, I mean 5000 as an absolute minimum. The best way to select your iteration count is to benchmark and calculate what the absolute maximum value you can get away with is.
Dec
12
awarded  Enlightened
Dec
12
comment Gold Standard for password hashing
@fatfredyy That's unrelated to this question.
Dec
12
answered Gold Standard for password hashing
Dec
12
awarded  Nice Answer
Dec
12
comment Password Salts and Randomness
@LieRyan Agreed, but it doesn't need a lot of entropy, it just needs to be hard to guess. Using request time or current system time alone isn't difficult enough to guess, so the introduction of an LCG (or similar) increases the difficulty.
Dec
12
revised ZX Spectrum tape loader: how was copy prevention implemented?
added 1195 characters in body
Dec
12
revised ZX Spectrum tape loader: how was copy prevention implemented?
expanded
Dec
12
answered ZX Spectrum tape loader: how was copy prevention implemented?
Dec
12
comment ZX Spectrum tape loader: how was copy prevention implemented?
Heh, this is actually a really intriguing question. Time to dig out the old tapes!
Dec
12
comment Password Salts and Randomness
@martinstoeckli If the developer does his job correctly (i.e. uses parameterised queries) then the SQL injection vector is moot.
Dec
12
comment Password Salts and Randomness
@martinstoeckli You're quickly heading into murky territory there. A pepper provides a benefit when the attack vector is purely SQL injection (i.e. database only), but does nothing to protect you if the attacker can read your script files.
Dec
12
comment Can I protect against keylogging by using the mouse?
@ewanm89 That's what it used to refer to. These days malware such as Zeus is considered a trojan, despite the fact that the delivery / installation mechanism need not be trojan-like.
Dec
12
comment NX bit causes segfault on NOP slide?
Looks like it's time to ROP to mmap/VirtualProtect then.