55,300 reputation
17132226
bio website en.wikipedia.org/wiki/…
location United Kingdom
age 27
visits member for 3 years, 7 months
seen May 22 at 19:58

Pentester, ex-developer, security researcher, reverse engineer, electronics tinkerer, internet activist, zombie eradicator, promulgator of useless facts, shrubbery inspector, bacon aficionado, devourer of donuts.

Strengths: Security, Crypto, Win32 API, C#, .NET, PHP, x86 assembly

All answers and comments are encrypted with ROT256-ECB.

Opinions are my own. Advice provided with no warranty.


Jan
24
accepted What should I know about SPDY before enabling it?
Jan
24
accepted Is AES-GCM recommended for SSL?
Jan
24
comment What should I know about SPDY before enabling it?
On the server. SPDY is enabled on most modern browsers by default.
Jan
24
comment Is AES-GCM recommended for SSL?
I guess. I just don't like the idea that someone might do a downgrade through a MitM attack.
Jan
24
comment Is AES-GCM recommended for SSL?
That sounds like a reasonable list. IE7 is almost 7 years old now, so I'd probably avoid 3DES. There's no reason for an end-user to be on IE7 these days, and I'm not too concerned about anyone who still is.
Jan
24
comment What should I know about SPDY before enabling it?
The site will have HTTPS enabled site-wide, so I think I'll avoid SPDY. I'll certainly consider it for future projects though, and I'll keep an eye out for that new protocol update.
Jan
24
comment Is AES-GCM recommended for SSL?
So the best option is to enable AES-GCM and AES-CBC cipher suites on TLS 1.2, and RC4 suites on TLS 1.1? I don't plan on supporting any of the pre-TLS protocols.
Jan
24
comment Is this code harmful? Why?
@absk007 I didn't delete it (a moderator did), but in general an answer like the one you gave is typically done as a comment on the answer that helped you get to the solution, rather than posted as a separate answer.
Jan
24
comment Is AES-GCM recommended for SSL?
Interesting. I'm still interested in GCM though, since it's unusual to see on regular HTTPS sites.
Jan
24
asked What should I know about SPDY before enabling it?
Jan
24
asked Is AES-GCM recommended for SSL?
Jan
24
comment Is encryption of Onion Proxy possible?
Using a Tor hidden service is a good way to mitigate that risk. Either that, or use a VPN with IPsec tunnelling.
Jan
24
comment Disadvantages of HTTP GET/POST Flooding Attack?
Sure, but OP asked about disadvantages.
Jan
24
answered Is encryption of Onion Proxy possible?
Jan
24
answered Disadvantages of HTTP GET/POST Flooding Attack?
Jan
24
revised Disadvantages of HTTP GET/POST Flooding Attack?
removed cruft
Jan
24
comment Disadvantages of HTTP GET/POST Flooding Attack?
Disadvantages in what sense? I would consider such a DoS attack to be a bad thing in pretty much every sense.
Jan
23
reviewed Close Best Practice: “One per-user ssh key” or “multiple per-host ssh keys”
Jan
23
reviewed Close Penetration testing against an ignorant target - Is it legal?
Jan
23
reviewed Close Foolproof Jailbreak detection?