56,738 reputation
17138233
bio website en.wikipedia.org/wiki/…
location United Kingdom
age 27
visits member for 3 years, 8 months
seen 3 hours ago

Pentester, ex-developer, security researcher, reverse engineer, electronics tinkerer, internet activist, zombie eradicator, promulgator of useless facts, shrubbery inspector, bacon aficionado, devourer of donuts.

Strengths: Security, Crypto, Win32 API, C#, .NET, PHP, x86 assembly

All answers and comments are encrypted with ROT256-ECB.

Opinions are my own. Advice provided with no warranty.


Jan
25
reviewed Leave Open Is there a true alternative to using CAPTCHA images?
Jan
25
reviewed Leave Open Retrieving saved password from Firefox on Linux
Jan
25
reviewed Approve What should a security audit report include?
Jan
25
asked How does OCSP stapling work?
Jan
25
comment securely destroying data on an external hard drive
Or just cipher /W, which comes with Windows.
Jan
25
answered securely destroying data on an external hard drive
Jan
25
comment securely destroying data on an external hard drive
I'm not going to remove my -1, because I don't think that a couple of product recommendations constitutes a proper answer.
Jan
25
comment securely destroying data on an external hard drive
-1 for recommending CCleaner. Its free space wiping algorithms are awful, and don't guarantee proper wiping of all free sectors.
Jan
24
accepted What should I know about SPDY before enabling it?
Jan
24
accepted Is AES-GCM recommended for SSL?
Jan
24
comment What should I know about SPDY before enabling it?
On the server. SPDY is enabled on most modern browsers by default.
Jan
24
comment Is AES-GCM recommended for SSL?
I guess. I just don't like the idea that someone might do a downgrade through a MitM attack.
Jan
24
comment Is AES-GCM recommended for SSL?
That sounds like a reasonable list. IE7 is almost 7 years old now, so I'd probably avoid 3DES. There's no reason for an end-user to be on IE7 these days, and I'm not too concerned about anyone who still is.
Jan
24
comment What should I know about SPDY before enabling it?
The site will have HTTPS enabled site-wide, so I think I'll avoid SPDY. I'll certainly consider it for future projects though, and I'll keep an eye out for that new protocol update.
Jan
24
comment Is AES-GCM recommended for SSL?
So the best option is to enable AES-GCM and AES-CBC cipher suites on TLS 1.2, and RC4 suites on TLS 1.1? I don't plan on supporting any of the pre-TLS protocols.
Jan
24
comment Is this code harmful? Why?
@absk007 I didn't delete it (a moderator did), but in general an answer like the one you gave is typically done as a comment on the answer that helped you get to the solution, rather than posted as a separate answer.
Jan
24
comment Is AES-GCM recommended for SSL?
Interesting. I'm still interested in GCM though, since it's unusual to see on regular HTTPS sites.
Jan
24
asked What should I know about SPDY before enabling it?
Jan
24
asked Is AES-GCM recommended for SSL?
Jan
24
comment Is encryption of Onion Proxy possible?
Using a Tor hidden service is a good way to mitigate that risk. Either that, or use a VPN with IPsec tunnelling.