49,173 reputation
14120210
bio website en.wikipedia.org/wiki/…
location United Kingdom
age 26
visits member for 3 years, 1 month
seen Nov 12 at 0:16

Pentester, ex-developer, security researcher, reverse engineer, electronics tinkerer, internet activist, zombie eradicator, promulgator of useless facts, shrubbery inspector, bacon aficionado, devourer of donuts.

Strengths: Security, Crypto, Win32 API, C#, .NET, PHP, x86 assembly

All answers and comments are encrypted with ROT256-ECB.

Opinions are my own. Advice provided with no warranty.


Dec
19
answered Bruteforce vs Denial of Service
Dec
19
comment Password protection of encryption and signature keys
@KeithS Not if you're using a proper cipher like AES, rather than a home-brew one.
Dec
19
revised Is my developer's home-brew password security right or wrong, and why?
added 19 characters in body
Dec
19
awarded  Great Answer
Dec
19
comment At what point is password complexity “safe enough”
Agree with AviD here - more details needed!
Dec
19
comment PCI-DSS - one application per server?
+1 for the meme :P
Dec
19
reviewed Reject suggested edit on Resource consumption attacks against algorithms
Dec
19
revised Is my developer's home-brew password security right or wrong, and why?
a few edits
Dec
19
comment Crack plain RSA given p, q and e
@KeithS I'm aware (they don't call me Polynomial for nothing!). The reason I mentioned the alternative form is that most implementations of large number libraries have the ability to raise an integer to an arbitrary exponent, but not as many have explicit division capabilities.
Dec
19
comment Secure query string parameters
Absolutely not. Doing so would constitute a direct object reference bug.
Dec
19
comment Secure query string parameters
Let's say you do dc.Eval(webRequest.Parameters["p"]) - I can pass any column name into p and your code will give me the contents of that column. This is a bad idea, especially when doing JOINs onto user tables, because it essentially amounts to an SQL injection.
Dec
19
comment Secure query string parameters
See my updated answer.
Dec
19
revised Secure query string parameters
added 323 characters in body
Dec
19
comment Secure query string parameters
Is this Eval a method of an object? I'm not familiar with ASP.NET (I'm a WinForms guy) - it may be ok if you're using it to bind to a data controller, but not if you accept user supplied values into your eval parameter.
Dec
19
comment Secure query string parameters
Never. Avoid it like the plague. It's the security equivalent of goto.
Dec
19
answered Secure query string parameters
Dec
19
comment Secure query string parameters
That's a pretty bad idea.
Dec
19
comment Secure query string parameters
No, you have an Eval() call in there. What's that for? Are you putting user parameters into an eval?
Dec
19
comment Secure query string parameters
What's that eval in there for? It worries me.
Dec
19
revised Secure query string parameters
formatting / spelling / title