48,003 reputation
12113203
bio website en.wikipedia.org/wiki/…
location United Kingdom
age 26
visits member for 2 years, 11 months
seen 36 mins ago

Pentester, ex-developer, security researcher, reverse engineer, electronics tinkerer, internet activist, zombie eradicator, promulgator of useless facts, shrubbery inspector, bacon aficionado, devourer of donuts.

Strengths: Security, Crypto, Win32 API, C#, .NET, PHP, x86 assembly

All answers and comments are encrypted with ROT256-ECB.

Opinions are my own. Advice provided with no warranty.


Dec
18
accepted Is behavioural analysis (e.g. keystroke dynamics) a reliable security mechanism for MFA?
Dec
18
accepted How are CVE identifiers assigned and managed?
Dec
18
accepted Disclosure in potential loss-of-life situations, with an uncooperative vendor
Dec
18
revised Is my developer's home-brew password security right or wrong, and why?
deleted 1 characters in body
Dec
18
revised Is my developer's home-brew password security right or wrong, and why?
added link to k's principle
Dec
18
comment Is my developer's home-brew password security right or wrong, and why?
@ChrisB.Behrens Otherwise known as Kerckhoff's Principle.
Dec
18
comment Is this a reasonable approach to “generating” passwords?
@Evgeni Often it's not difficult to determine word boundaries and guess the scheme. Granted a lot of attackers won't bother trying (unless it's trivial) but it's better to avoid such schemes entirely.
Dec
18
answered Is this a reasonable approach to “generating” passwords?
Dec
18
comment Is my developer's home-brew password security right or wrong, and why?
@nallenscott To be fair, I went through the same phase when I was learning to code - I wanted to do everything myself, and quickly fell into the trap of writing my own "encryption" and hashing. Then I actually learnt about real security, and discovered much of what I'd previously written was horribly broken. Massive wakeup call!
Dec
18
awarded  Nice Answer
Dec
18
revised Is my developer's home-brew password security right or wrong, and why?
added 151 characters in body
Dec
18
comment Is my developer's home-brew password security right or wrong, and why?
@jdm I'd guess he stores $time and $rand as the salt in the db. If not, this is clearly broken.
Dec
18
comment Is my developer's home-brew password security right or wrong, and why?
@jdm The "BAD BAD BAD" part refers to the pointless shuffling of the MD5 hash, since it offers zero extra security, but in this case the "repeated" hashing is badly designed. It relies on MD5, crypt (whatever that ends up being configured to) and SHA1 all at once, but only really does 3 computations. That's nowhere near enough to defeat GPU-based bruteforce. The whole thing brings nothing but obscurity, and is probably less secure than sha1(md5(pass+salt)) with a decent salt. It's important to use a proper key derivation algorithm (see the first link).
Dec
18
answered Is my developer's home-brew password security right or wrong, and why?
Dec
18
reviewed Edit suggested edit on How to spoof an ATM transaction?
Dec
18
revised How to spoof an ATM transaction?
Tried to clarify the question; I'm not entirely sure what is being asked.
Dec
18
revised What responsibility do I have in continuing another developer's work?
typo
Dec
18
answered What responsibility do I have in continuing another developer's work?
Dec
18
revised What responsibility do I have in continuing another developer's work?
deleted 11 characters in body
Dec
18
revised How valid is this statement “SSL sit between application layer and network layer”
Removed bold.