52,923 reputation
16125218
bio website en.wikipedia.org/wiki/…
location United Kingdom
age 27
visits member for 3 years, 5 months
seen 21 hours ago

Pentester, ex-developer, security researcher, reverse engineer, electronics tinkerer, internet activist, zombie eradicator, promulgator of useless facts, shrubbery inspector, bacon aficionado, devourer of donuts.

Strengths: Security, Crypto, Win32 API, C#, .NET, PHP, x86 assembly

All answers and comments are encrypted with ROT256-ECB.

Opinions are my own. Advice provided with no warranty.


Nov
26
comment In depth security: splitting key in different places
@Surferonthefall No, it need not be unique. The IV takes care of the uniqueness requirement. Make sure you're using CBC mode for AES though.
Nov
23
comment How is certificate forgery with cheap CA's prevented?
Great question! I'll write an answer for this later.
Nov
23
answered Deny domain admins from steal User files on PCs
Nov
23
answered TCP Peer unexpectedly shrunk window messages in dmesg log
Nov
23
answered Securing a laptop against attacks (article)
Nov
23
comment Principle of asymmetric algorithm in plain english
Great analogy! I'll have to steal this for future use...
Nov
23
reviewed Reject Why most of the Websites supports only Paypal for online transaction?
Nov
22
comment Is social-engineering an actual threat
No, it's not a threat at all. By the way, StackExchange is having database problems, could you all send me your passwords so I can update things? ;)
Nov
22
comment iOS app - hash user password in-app or on-server?
No. You're talking about client certificates, which is a totally different concept entirely. You cannot distribute client certificates (including private key information) in the same way without some serious changes to browsers, or manual installation of client certs by users.
Nov
22
comment Why most of the Websites supports only Paypal for online transaction?
Because PayPal is well-known, accepts most credit cards world wide, has low fees, has good fraud protection, rarely gets breached, and is trusted by consumers.
Nov
22
answered Issuing SSL certificates for device automation software package without domain names
Nov
22
comment iOS app - hash user password in-app or on-server?
Whilst this is reasonably sound advice, it doesn't really answer the question. Certificate distribution and management doesn't fit the standard convenience model that users expect, which is what OP was asking about.
Nov
22
comment Virus won't be picked up by Antivirus tools
New malware is not a 0day. A 0day is an exploitable bug that has no vendor patch.
Nov
22
comment Opinons: To report or not to report? CFAA vs the White Hat
Sound advice. I usually disclose to the vendor anonymously, then disclose it publicly under my own name if it goes well.
Nov
22
comment What is a good way to demonstrate the insecurity of common bad practices?
Also, sqlmap is a much stronger tool than Havij.
Nov
21
comment Why do we ask for a user's existing password when changing their password?
This is called a Cross-Site Request Forgery (CSRF).
Nov
21
answered iOS app - hash user password in-app or on-server?
Nov
21
answered Why block outgoing network traffic with a firewall?
Nov
21
revised anomaly detection: feature calculation problem
formatting
Nov
21
accepted What alternatives are there to the existing Certificate Authority system for SSL?