48,523 reputation
12118208
bio website en.wikipedia.org/wiki/…
location United Kingdom
age 26
visits member for 3 years
seen 1 hour ago

Pentester, ex-developer, security researcher, reverse engineer, electronics tinkerer, internet activist, zombie eradicator, promulgator of useless facts, shrubbery inspector, bacon aficionado, devourer of donuts.

Strengths: Security, Crypto, Win32 API, C#, .NET, PHP, x86 assembly

All answers and comments are encrypted with ROT256-ECB.

Opinions are my own. Advice provided with no warranty.


Dec
20
comment Are mail-servers removed from security concerns in contrast with cloud storage?
Keep in mind that if your "cloud" mail service is hosted in the United States, the emails may be considered a business record, which you automatically lose all rights to.
Dec
20
comment Are we concentrating too much on password complexity?
Keep in mind that I'm not in favour of bad complexity requirements like "must have 1 letter, 1 number and 1 symbol" - these are pointless. A lowercase alphabetical password with 25 characters is much more secure than abc123!, yet it wouldn't pass validation. A better solution is to blacklist known common passwords, and impose relaxed minimum strength requirements based upon both length and character types.
Dec
20
reviewed Reject suggested edit on waf tag wiki excerpt
Dec
20
comment Are we concentrating too much on password complexity?
For two reasons: First, because "exponentially impossible to reverse" doesn't make any sense in the context of password cracking - an attacker can always buy more GPUs, or attack the weak passwords first. Having PBKDF2 hashes with ten million iterations is great, but it's useless if your users have a common password like "monkey". Second, because you will get hacked. It's inevitable. Even if your web app is 100% secure, with no bugs, you can't possibly prevent every 0day for your OS and services. Security is about defence in depth and risk reduction, not 100% guaranteed protection.
Dec
20
reviewed Reject suggested edit on server tag wiki excerpt
Dec
20
comment Are we concentrating too much on password complexity?
@DrewLex That's the point: you can't rely on the rate limiting because you will get popped at some point, and you can't artificially rate-limit hash cracking. Plus an attacker using Tor or a botnet has a huge supply of IPs, so can attack a large list of users with a set of common weak passwords. Complexity requirements are mandatory.
Dec
20
answered Are we concentrating too much on password complexity?
Dec
19
answered Bruteforce vs Denial of Service
Dec
19
comment Password protection of encryption and signature keys
@KeithS Not if you're using a proper cipher like AES, rather than a home-brew one.
Dec
19
revised Is my developer's home-brew password security right or wrong, and why?
added 19 characters in body
Dec
19
awarded  Great Answer
Dec
19
comment At what point is password complexity “safe enough”
Agree with AviD here - more details needed!
Dec
19
comment PCI-DSS - one application per server?
+1 for the meme :P
Dec
19
reviewed Reject suggested edit on Resource consumption attacks against algorithms
Dec
19
revised Is my developer's home-brew password security right or wrong, and why?
a few edits
Dec
19
comment Crack plain RSA given p, q and e
@KeithS I'm aware (they don't call me Polynomial for nothing!). The reason I mentioned the alternative form is that most implementations of large number libraries have the ability to raise an integer to an arbitrary exponent, but not as many have explicit division capabilities.
Dec
19
comment Secure query string parameters
Absolutely not. Doing so would constitute a direct object reference bug.
Dec
19
comment Secure query string parameters
Let's say you do dc.Eval(webRequest.Parameters["p"]) - I can pass any column name into p and your code will give me the contents of that column. This is a bad idea, especially when doing JOINs onto user tables, because it essentially amounts to an SQL injection.
Dec
19
comment Secure query string parameters
See my updated answer.
Dec
19
revised Secure query string parameters
added 323 characters in body