43,472 reputation
1294172
bio website en.wikipedia.org/wiki/…
location United Kingdom
age 26
visits member for 2 years, 6 months
seen 2 days ago

Pentester, ex-developer, security researcher, reverse engineer, electronics tinkerer, internet activist, zombie eradicator, promulgator of useless facts, shrubbery inspector, bacon aficionado, devourer of donuts.

Strengths: Security, Crypto, Win32 API, C#, .NET, PHP, x86 assembly

All answers and comments are encrypted with ROT256-ECB.

Opinions are my own. Advice provided with no warranty.


Dec
7
reviewed Approve suggested edit on Is WordPress a security vulnerability inside a corporate intranet?
Dec
7
answered How can an outsider tap into communications between two physical sites?
Dec
7
comment Is WordPress a security vulnerability inside a corporate intranet?
+1, though in my experience most CVEs come out of Wordpress plugins, which tend to get patched significantly less quickly.
Dec
7
answered Encrypting data for Android mobile app
Dec
5
comment Is behavioural analysis (e.g. keystroke dynamics) a reliable security mechanism for MFA?
Did you mean to write more in this answer? It seems to end mid-sentence.
Dec
5
comment Is behavioural analysis (e.g. keystroke dynamics) a reliable security mechanism for MFA?
@AviD Will read through them later today. You might want to drop an answer on here with a few choice excerpts from the papers, so I can upvote you :)
Dec
5
comment ESET warns: Skype attempting to communicate with unknown remote computer
@Shaul Could just be supernodes, but I fail to see why various foreign servers would be supernodes, unless you're actually in Ukraine and most of them are from there. It doesn't really make sense. Skype also happens to be a big attack surface for remote exploits, so you might not have to even do anything in order to get compromised.
Dec
5
answered ESET warns: Skype attempting to communicate with unknown remote computer
Dec
5
comment How can I detect if someone is sniffing network packets on the LAN?
There's also always the social aspect: produce false information and wait for someone to act on it.
Dec
5
asked Is behavioural analysis (e.g. keystroke dynamics) a reliable security mechanism for MFA?
Dec
5
comment Given a large enough sampling of public keys could one begin to identify a private key?
Plus you don't get multiple public keys for one private key.
Dec
5
comment What to do about companies that refuse to fix their security vulnerabilities
+1 on this. Be civil, be careful, explain the issue fully, give them time, but be firm. If they take a while, give them an exact date on which you will disclose. Also offer to extend the deadline if and only if they can convince you that they're incapable of fixing it by then, but don't let them string you along.
Dec
5
answered Any way to use Java (sun micro) without any concern of infection
Dec
5
comment Any way to use Java (sun micro) without any concern of infection
Are you sure you're not getting Java and JavaScript mixed up? ADVFN doesn't seem to use a Java applet at all.
Dec
4
comment Storing account credentials for spouse/loved one?
Of course. Any "cloud storage" service would work.
Dec
4
comment Storing account credentials for spouse/loved one?
If it's a shared account, you should both have legal access anyway. But Callum is right; for personal accounts you must get power of attorney. However, I disagree with not getting the password. If you've got power of attorney, you're legally allowed to access it. Having the password just makes it easier.
Dec
4
comment Storing account credentials for spouse/loved one?
Yes, I forgot to mention that. The Android app is very good. In fact, I don't think I know of any other app that works as well as its desktop counterpart.
Dec
4
answered Storing account credentials for spouse/loved one?
Dec
4
comment Self sign SSL certificate for my mobile app?
Wasn't aware that Comodo was selling certs for $10 these days. I was considering discount CAs like CACert and InstantSSL. And you're right in saying the cert itself gives no extra security; I was referring to the security of the CA itself.
Dec
4
comment Self sign SSL certificate for my mobile app?
Precisely. A lot of less-reputable CAs don't make it into some devices, whereas the big CAs (e.g. Verisign / Globalsign) are highly likely to be in all of them. Plus you'd figure that the big authorities are the ones to be throwing lots of money at HSMs and other expensive security measures.