46,973 reputation
12109197
bio website en.wikipedia.org/wiki/…
location United Kingdom
age 26
visits member for 2 years, 11 months
seen 8 hours ago

Pentester, ex-developer, security researcher, reverse engineer, electronics tinkerer, internet activist, zombie eradicator, promulgator of useless facts, shrubbery inspector, bacon aficionado, devourer of donuts.

Strengths: Security, Crypto, Win32 API, C#, .NET, PHP, x86 assembly

All answers and comments are encrypted with ROT256-ECB.

Opinions are my own. Advice provided with no warranty.


Oct
30
comment Conceptual design of vulnerability scanning program in global retail network (PCI DSS)
@RoryAlsop Not to mention that they'll be discoverable by an FOIA request during any civil suits. Do you really want your old vulnerability scan logs becoming part of evidence if you get sued after a breach? Maintain evidence that a scan took place, and keep the reports, but ditch the detailed scan logs.
Oct
30
comment Conceptual design of vulnerability scanning program in global retail network (PCI DSS)
@Iszi Routers drop most malformed packets. A proper security scan involves a lot of those kinds of packets. The point is that your critical systems have to remain stable even if the attacker can send packets from within your network.
Oct
30
comment Conceptual design of vulnerability scanning program in global retail network (PCI DSS)
"However, this also requires there be no network protections between the scanner and the device. So no firewalls, no IDPs, hell they don't even want any routers involved." - It's mildly amusing that the conditions required for performing such a scan remotely automatically negate the possibility of being PCI compliant.
Oct
30
comment Conceptual design of vulnerability scanning program in global retail network (PCI DSS)
Since you're new around these parts, please familiarise yourself with the FAQ - we have some requirements for question content on StackExchange.
Oct
30
comment Conceptual design of vulnerability scanning program in global retail network (PCI DSS)
It's rather difficult to tell what you're looking for here. Questions about the logistics of communicating with all of those devices are off-topic here, since they're about networking rather than security. If you're asking for ways to actually test the security of the devices once you've managed to talk to them, I think we need a clearer scope - it's the kind of thing that one could write a book about. If you're looking at the managerial aspects of this, e.g. vulnerability management, you need to give us some more information about the scope and scenario you're looking at.
Oct
30
comment Which factors should I consider for devices that accept handwritten digital signatures?
Yeah, that's what I figured. The problem is that in order to assume that such a signature is legitimate, you must assume no possibility of malintent by the courier. In a perfect world, that'd be fine, but there's no way to make such a guarantee in reality. I've personally had a case where a courier has signed for my package because he couldn't be bothered to deliver it that day.
Oct
30
revised Which factors should I consider for devices that accept handwritten digital signatures?
title
Oct
30
comment Which factors should I consider for devices that accept handwritten digital signatures?
Very interesting question. What use-cases are you looking at? I'd personally like to see if anyone knows how well these work as authenticity verification measures in court, especially in recorded postage scenarios with couriers.
Oct
30
reviewed Approve suggested edit on Are there any strange things with google.com over HTTPS?
Oct
30
reviewed Reject suggested edit on Security of passwords remembered by Windows
Oct
30
revised CSRF protection with custom headers (and without validating token)
added 355 characters in body
Oct
30
answered CSRF protection with custom headers (and without validating token)
Oct
30
comment Can my WIFI Home router be brought down to cause me to connect to a fake AP?
Add this to the recent Broadcom flaw (CVE / Research) and it's pretty trivial to deauth you from your AP.
Oct
29
comment Keyboard sniffing through audio recorded typing patterns
@MarkC.Wallace Your answer has been converted to a comment. Please don't write answers with only links. In a few years time, someone would come back to it and find that the links are dead and your answer is devoid of useful content. If you're going to write answers based on links, you must include appropriate excerpts of content, and you should include your own opinion and interpretation of the content.
Oct
29
comment Does the salt need to be unique or not predictable?
@StephenTouset The pass + pepper section is simple a combination operation. HMAC is a valid combination, as is concatenation. It depends on what you feel more secure with.
Oct
29
comment Unmasking passwords during sign up, is it a good idea?
I agree. Was just pointing out that, at the end of the day, the root cause is the keypad itself.
Oct
29
comment Unmasking passwords during sign up, is it a good idea?
@AviD I'd argue that that's a usability issue with the keypad, not the password box.
Oct
29
answered Unmasking passwords during sign up, is it a good idea?
Oct
29
revised What is the HTTP “Server” response-header field used for?
fixed formatting and arbitrary RFC reference
Oct
29
comment Keyboard sniffing through audio recorded typing patterns
This has been studied. I remember reading a paper on it, and seeing it done in a video. It works reasonably well in ideal conditions, but it's very flaky in reality. I'll try to dig out the links.