45,582 reputation
12105191
bio website en.wikipedia.org/wiki/…
location United Kingdom
age 26
visits member for 2 years, 9 months
seen 2 days ago

Pentester, ex-developer, security researcher, reverse engineer, electronics tinkerer, internet activist, zombie eradicator, promulgator of useless facts, shrubbery inspector, bacon aficionado, devourer of donuts.

Strengths: Security, Crypto, Win32 API, C#, .NET, PHP, x86 assembly

All answers and comments are encrypted with ROT256-ECB.

Opinions are my own. Advice provided with no warranty.


Dec
12
answered Can I safely trust my Anti-virus protection?
Dec
12
comment Password Salts and Randomness
Yup, store them in plaintext. No need to obfuscate them, since they're not really meant to be secret information (though it helps in certain cases; see the answer I linked). They're just there to make pre-computed rainbow table attacks infeasible.
Dec
12
revised Password Salts and Randomness
added 28 characters in body
Dec
12
comment Password Salts and Randomness
Concatenation. Sorry, should've specified that. In general for security, though, you'll see people use || to mean concatenate, and | to mean a bitwise OR operation.
Dec
12
answered Password Salts and Randomness
Dec
11
comment Windows 7 EFS - connot decrypt
Technically the key isn't lost; it's in the master header. However, the master header is encrypted with a key derived from a password. This is how multiple users can have access to one encrypted file.
Dec
11
comment How do I prevent this type of SQL injection attack?
@drjimbob Hrrrrrrk, I wouldn't ever trust that regex. For a start, what about cases where you want to store content that might have apostrophes and other punctuation? Even if you're just sticking to alphanumeric content, you can still alter the behaviour of a query via injection of unexpected content, causing subtle potentially-exploitable bugs. Parameterised queries are the only proper solution, since they treat data as data and query language as query language; they're separate entitites entirely. If your DBMS or driver can't handle them, switch to one that can immediately.
Dec
11
comment Can I protect against keylogging by using the mouse?
@gerrit Trojan is probably the best term, since it (usually) refers to anything that steals content these days. The original term was for any type of malware that masqueraded as or inside something legitimate, but that covers most malware these days.
Dec
11
comment Vulnerabilities of Secure Shells
Neither does SSH. You have to configure X11 forwarding on both sides.
Dec
11
comment Trust linux images burned from untrusted systems
@lynks And even then you'll do something wrong and get pwned. There's no perfect security end of discussion. Anyone who claims to be able to attain such a thing is fraudulent or delusional.
Dec
11
comment Trust linux images burned from untrusted systems
+1, there's no such thing as perfect security. Attempting to attain it will reduce in frustration and stress-related brain tumours. Accept the absolutely minuscule risk and get on with your life.
Dec
11
comment Can I protect against keylogging by using the mouse?
90% of the time these days, no. They usually have various other features: remote access trojans, session / cookie stealers, file stealers, etc.
Dec
11
answered Can I protect against keylogging by using the mouse?
Dec
11
comment Banking application login leaks information
@AJHenderson Unlikely to be useful. Regex can easily match image tags, and the parent element can be trivially identified from that.
Dec
11
comment Banking application login leaks information
@GdD See my answer. If the bank's web page can get the images using only a valid username, what's to stop a 3rd party page from doing the same?
Dec
11
answered Banking application login leaks information
Dec
11
comment Banking application login leaks information
@GdD From the sounds of it, the attacker may not even need to do that.
Dec
11
comment Banking application login leaks information
It allows an attacker to enumerate all usernames and "security" images. Even easier for targeted attacks. Not secure at all; in fact it's giving users a false sense of security.
Dec
11
comment Rainbow table concept for Prime numbers
Precisely. It's a catch 22.
Dec
11
comment Rainbow table concept for Prime numbers
@lynks A rainbow table reduces its space via chaining inputs, through a reduction function. As Jeff Ferland pointed out, there is no reduction function for such values. If we stick to pure chaining, you need to store both of the factors, which will exceed n bits anyway.