53,628 reputation
17128220
bio website en.wikipedia.org/wiki/…
location United Kingdom
age 27
visits member for 3 years, 6 months
seen yesterday

Pentester, ex-developer, security researcher, reverse engineer, electronics tinkerer, internet activist, zombie eradicator, promulgator of useless facts, shrubbery inspector, bacon aficionado, devourer of donuts.

Strengths: Security, Crypto, Win32 API, C#, .NET, PHP, x86 assembly

All answers and comments are encrypted with ROT256-ECB.

Opinions are my own. Advice provided with no warranty.


Jan
6
reviewed Reject How to test security of an encryption algorithm?
Jan
6
comment What sort of delay will deter a robot from crawling my site?
This isn't really a security question, it's more about web administration. Probably better off on Webmasters.SE or ServerFault.
Jan
5
comment how strong is AES without salt
@NoviceUser Adding data to the plaintext is a type of cryptographic padding. However, if you're using ECB, you'll still run into the problem that statistical patterns are transferred into the ciphertext, as demonstrated by the above image. Cryptography is hard to get right - you should always use properly tested configurations (i.e. cipher mode, proper IV use, proper key generation, etc.) with a modern cryptographic cipher.
Jan
5
comment Why is it hard to catch cybercriminals?
You can't connect to a wifi network that can't talk back to you. Also, I would imagine NSA / GCHQ would have RF receivers sat around major cities logging signals, so it'd be reasonably easy for a state actor to identify (triangulate) the location of the WiFi traffic and track the vehicle in and out of the city via traffic cameras.
Jan
4
comment Web Application - Cookie Expiry
Please don't cross post. In future, flag your question and ask a moderator to migrate it.
Jan
4
revised Web Application - Cookie Expiry
removed junk
Jan
4
reviewed Approve Find malware in browser extensions
Jan
4
revised What does it actually mean when someone says their website is hacked?
owasp
Jan
4
comment How to Investigate Wi-Fi Intrusion and where to look for evidence?
No idea why it was downvoted. I'd say this is the best answer here so far.
Jan
4
answered What does it actually mean when someone says their website is hacked?
Jan
4
reviewed Edit Security comparsion of 3DES and AES
Jan
4
revised Security comparsion of 3DES and AES
formatting, removed junk
Jan
4
reviewed Edit How do I correctly select and use a modern symmetric block cipher?
Jan
4
revised How do I correctly select and use a modern symmetric block cipher?
fixed various grammar / title issues
Jan
3
comment SSL Bit Length History
SSL isn't a cipher, it's a protocol. The key size is dependant entirely on the cipher being used, e.g. RC4, AES, 3DES, etc.
Jan
3
comment What's the point of using multiple checksum algorithm with “aide”?
Agreed - I think OP's confusion was between using multiple hashes at the same time vs. having a choice of hash.
Jan
3
comment How isolated are files on a VirtualBox virtual machine from the host filesystem?
All modern SSDs use that mechanism. It's transparent to the OS.
Jan
3
comment What are the security implications of Digital Lifeboat (or other p2p storage solutions)
Just keep in mind that you should fact-check anything said by Steve Gibson, since he has a history of making false claims. That's the primary reason I avoid the Security Now podcast these days (well, that and his endless pimping of SpinRite).
Jan
3
comment Is this code vulnerable?
@pgolen I agree that the snippet alone doesn't show it as injectable or not, but the standard pattern is to set $_SESSION['id'] to an internal ID, based on the username given as a login. Allowing the user ID to be passed manually wouldn't be very secure, since someone could just change it to a different ID and authenticate as them.
Jan
3
answered Is this code vulnerable?