meta user
network profile
| bio | website | en.wikipedia.org/wiki/… |
|---|---|---|
| location | United Kingdom | |
| age | 25 | |
| visits | member for | 1 year, 7 months |
| seen | 20 mins ago | |
| stats | profile views | 2,033 |
Pentester, ex-developer, security researcher, reverse engineer, electronics tinkerer, internet activist, zombie eradicator, promulgator of useless facts, shrubbery inspector, bacon aficionado, devourer of donuts.
Strengths: Security, Crypto, Win32 API, C#, .NET, PHP, x86 assembly
All answers and comments are encrypted with ROT256-ECB.
Opinions are my own. Advice provided with no warranty.
|
Nov 6 |
comment |
File upload vulnerability: rename solution? @Gilles I don't see how that's the case, since he said it excludes SHA-1 and MD5, which a diversification wouldn't cause an exclusion of. |
|
Nov 6 |
answered | How should permissions be stored? |
|
Nov 6 |
comment |
How should permissions be stored? You certainly don't want 3 columns in a relational table if you want to easily query privileges. You want 2+n, where n is your number of defined privileges. |
|
Nov 6 |
comment |
File upload vulnerability: rename solution? Since when were SHA1 collisions feasible? |
|
Nov 6 |
comment |
File upload vulnerability: rename solution? A common method is to rename it to the SHA1 hash of the file. This ensures unique naming, and saves you space when duplicates are uploaded. |
|
Nov 6 |
comment |
What is HiASLR? @Rook Ah, you're right, I misunderstood. I'd heard somewhere that the high entropy flag requires ForceASLR to be enabled, but it looks like that's not the case. |
|
Nov 6 |
awarded | Enlightened |
|
Nov 5 |
comment |
Which security risks are associated with alternative DNS providers? There's a really nice article by Melissa Elliot (aka. 0xabad1dea) on Veracode's blog that sums up the dangers of 3rd party DNS quite nicely. It's rather cutesy and is mainly aimed at semi-techies, but it does a great job of illustrating both the problem and a common attack vector. |
|
Nov 5 |
comment |
What is HiASLR? @Rook There were limitations in the implementation to maintain backward compatibility with old memory management operations used by various drivers. Also, the HE method has a side-effect of forcing ASLR on for all modules in all processes, which can crash old legacy apps. |
|
Nov 5 |
asked | What alternatives are there to the existing Certificate Authority system for SSL? |
|
Nov 5 |
awarded | Nice Answer |
|
Nov 5 |
comment |
What would be the scenario if P = NP for RSA algorithm? Bowel-based crypto needs more study. I propose a new field: Gastrocryptography |
|
Nov 5 |
comment |
What would be the scenario if P = NP for RSA algorithm? Partial duplicate of How will security need to be changed if P=NP? |
|
Nov 5 |
revised |
Strength of WEP, WPA and WPA 2 PSK added 8 characters in body |
|
Nov 5 |
revised |
What is HiASLR? added 1355 characters in body |
|
Nov 5 |
answered | What is HiASLR? |
|
Nov 5 |
revised |
What is HiASLR? grammar |
|
Nov 5 |
comment |
anti virus acting up/DNS poisoning Both of those sound like generic signatures designed to find obfuscated executables and keygens. |
|
Nov 5 |
revised |
How to check if a port can be accessed from the outside added 36 characters in body |
|
Nov 5 |
answered | anti virus acting up/DNS poisoning |
