49,133 reputation
14120210
bio website en.wikipedia.org/wiki/…
location United Kingdom
age 26
visits member for 3 years, 1 month
seen Nov 12 at 0:16

Pentester, ex-developer, security researcher, reverse engineer, electronics tinkerer, internet activist, zombie eradicator, promulgator of useless facts, shrubbery inspector, bacon aficionado, devourer of donuts.

Strengths: Security, Crypto, Win32 API, C#, .NET, PHP, x86 assembly

All answers and comments are encrypted with ROT256-ECB.

Opinions are my own. Advice provided with no warranty.


Dec
21
reviewed Reject suggested edit on debugging tag wiki excerpt
Dec
21
reviewed Edit suggested edit on web-scanners tag wiki excerpt
Dec
21
revised web-scanners wiki excerpt
Typo.
Dec
21
reviewed Reject suggested edit on reverse-engineering tag wiki excerpt
Dec
21
reviewed Approve suggested edit on x86 tag wiki excerpt
Dec
20
awarded  Great Answer
Dec
20
revised How can I explain SQL injection without technical jargon?
Added explanation of what happens when we fix the problem.
Dec
20
comment How can I explain SQL injection without technical jargon?
@CrisStringfellow Heh, thanks. Coincidentally, I am writing an eBook, but not about that.
Dec
20
revised How can I explain SQL injection without technical jargon?
deleted 1 characters in body
Dec
20
awarded  Good Answer
Dec
20
awarded  Nice Answer
Dec
20
reviewed Reject suggested edit on memory tag wiki excerpt
Dec
20
answered How can I explain SQL injection without technical jargon?
Dec
20
comment Are mail-servers removed from security concerns in contrast with cloud storage?
Keep in mind that if your "cloud" mail service is hosted in the United States, the emails may be considered a business record, which you automatically lose all rights to.
Dec
20
comment Are we concentrating too much on password complexity?
Keep in mind that I'm not in favour of bad complexity requirements like "must have 1 letter, 1 number and 1 symbol" - these are pointless. A lowercase alphabetical password with 25 characters is much more secure than abc123!, yet it wouldn't pass validation. A better solution is to blacklist known common passwords, and impose relaxed minimum strength requirements based upon both length and character types.
Dec
20
reviewed Reject suggested edit on waf tag wiki excerpt
Dec
20
comment Are we concentrating too much on password complexity?
For two reasons: First, because "exponentially impossible to reverse" doesn't make any sense in the context of password cracking - an attacker can always buy more GPUs, or attack the weak passwords first. Having PBKDF2 hashes with ten million iterations is great, but it's useless if your users have a common password like "monkey". Second, because you will get hacked. It's inevitable. Even if your web app is 100% secure, with no bugs, you can't possibly prevent every 0day for your OS and services. Security is about defence in depth and risk reduction, not 100% guaranteed protection.
Dec
20
reviewed Reject suggested edit on server tag wiki excerpt
Dec
20
comment Are we concentrating too much on password complexity?
@DrewLex That's the point: you can't rely on the rate limiting because you will get popped at some point, and you can't artificially rate-limit hash cracking. Plus an attacker using Tor or a botnet has a huge supply of IPs, so can attack a large list of users with a set of common weak passwords. Complexity requirements are mandatory.
Dec
20
answered Are we concentrating too much on password complexity?