57,510 reputation
17139235
bio website en.wikipedia.org/wiki/…
location United Kingdom
age 27
visits member for 3 years, 9 months
seen Jul 15 at 23:36

Pentester, ex-developer, security researcher, reverse engineer, electronics tinkerer, internet activist, zombie eradicator, promulgator of useless facts, shrubbery inspector, bacon aficionado, devourer of donuts.

Strengths: Security, Crypto, Win32 API, C#, .NET, PHP, x86 assembly

All answers and comments are encrypted with ROT256-ECB.

Opinions are my own. Advice provided with no warranty.


Jan
26
answered Is a company responsible for a spam which mentions it?
Jan
26
accepted Content hashes to help protect resources being fetched from a CDN
Jan
26
comment Content hashes to help protect resources being fetched from a CDN
@Matrix If it's encrypted on the CDN server, the client has to know how to decrypt it. Therefore anyone who visits the site has to know the key to decrypt the file, including anyone from the CDN company that visits the site.
Jan
25
comment Content hashes to help protect resources being fetched from a CDN
@AJHenderson That's a naive view. Web servers like IIS and Apache have quite high overheads for sending small static files, whereas servers like nginx are optimised for serving static files extremely efficiently. Furthermore, configuring the server for high performance on both content delivery, database access, and web applications is difficult. For performance on a large site, it makes sense to split those functions out, so that the system configuration and server daemons can be optimised for a single function. Caching is already done on dynamic pages, but some things just can't be cached.
Jan
25
comment How Involved Should a Developer Be in Designing a Security Policy?
Look at a protocol like SSL. There are a hundred different flags that alter a hundred different behaviours, with a hundred different cipher suites. All of those have to work, and all of them need to be fully configurable. Getting that right is a software architecture exercise, not a security exercise.
Jan
25
comment How Involved Should a Developer Be in Designing a Security Policy?
That's a tricky situation, and it works with features and product behaviour too. In fact, it's not really a security issue. For example, one customer might want a set of records in an ERP app to be consolidated into a report with one particular rounding discrepancy calculation, whereas another customer might want to use a different calculation. Your job is to architect the software in a way that enables you to provide modular functionality that can be enabled, disabled or altered based on per-customer config switches. It's about strong and flexible architecture.
Jan
25
comment Content hashes to help protect resources being fetched from a CDN
@Matrix That wouldn't work. If the client can decrypt it, the CDN operators can decrypt it too. Also, HTTPS for transport security is often avoided on CDNs due to performance and caching issues.
Jan
25
answered How Involved Should a Developer Be in Designing a Security Policy?
Jan
25
comment How to lure a Hacker?
I have no idea why con organisers seem to think that Club Mate should be the drink of choice for hackers. It's not exactly tasty.
Jan
25
comment Content hashes to help protect resources being fetched from a CDN
Nice idea with the length, and some other great points.
Jan
25
asked Content hashes to help protect resources being fetched from a CDN
Jan
25
comment Is there a true alternative to using CAPTCHA images?
Nope. If you change the colour, a saturation filter will remove it. If you add colour and a background, the foreground colours can be isolated and used to perform a notch filter. If you use different fonts that might make it a little more difficult, but a decent OCR engine could compensate by doing pattern matching against known fonts and looking for >95% correlations. You need to actively warp the text and provide noise that significantly distorts both the background and text. It's a difficult thing to get right without destroying readability.
Jan
25
comment Is there a true alternative to using CAPTCHA images?
The problem is that you've now restricted your CAPTCHA content to a small set of characters, so OCR could be used to break it.
Jan
25
comment Is there a true alternative to using CAPTCHA images?
Try not to use bold so much. It hurts my eyes, and makes the answer look unprofessional.
Jan
25
reviewed Leave Open Is there a true alternative to using CAPTCHA images?
Jan
25
reviewed Leave Open Retrieving saved password from Firefox on Linux
Jan
25
reviewed Approve What should a security audit report include?
Jan
25
asked How does OCSP stapling work?
Jan
25
comment securely destroying data on an external hard drive
Or just cipher /W, which comes with Windows.
Jan
25
answered securely destroying data on an external hard drive