49,813 reputation
14121210
bio website en.wikipedia.org/wiki/…
location United Kingdom
age 26
visits member for 3 years, 2 months
seen 19 hours ago

Pentester, ex-developer, security researcher, reverse engineer, electronics tinkerer, internet activist, zombie eradicator, promulgator of useless facts, shrubbery inspector, bacon aficionado, devourer of donuts.

Strengths: Security, Crypto, Win32 API, C#, .NET, PHP, x86 assembly

All answers and comments are encrypted with ROT256-ECB.

Opinions are my own. Advice provided with no warranty.


Dec
4
comment Is data-remanence a concern in RAM?
Relevant: security.stackexchange.com/questions/29019/… and security.stackexchange.com/questions/7299/…
Dec
4
comment Which forward secrecy cipher suites are supported for TLS1.0 protocols?
@PURE That's a separate question which would be better asked at ServerFault, but you could either use ssl-cipher-suite-enum (free script, but full disclosure: I work there) to test a live instance, or check your config files. I don't know where the TLS config is kept in Tomcat, though.
Dec
4
comment Soundness of GRC.com Haystack padding concept
I'll provide my usual Steve Gibson reference: attrition.org/errata/charlatan/steve_gibson
Dec
1
comment Passing session id in query string to maintain state in third party iframe - good practice?
Yes, it's bad practice. Regardless, the cookie shouldn't be blocked as 3rd party, unless the user has a very overzealous privacy plugin. Your cookie should just get set and sent under the standard same origin policy for your domain.
Nov
27
comment How strong is a simple XOR encryption with random IV?
As soon as you leak P xor K, you immediately lose to known plaintext attacks. Any structured data should result in relatively trivial key recovery in this situation.
Nov
27
comment is it sufficient to convert '(single-quote) to ` ' `
Or, if more than one field is filled out, a simple backslash in the first and ;alert(1)// in the second.
Nov
4
comment Why wouldn't it be great, if HTTP/2 would only allow communication via TLS?
I think that it's important to state categorically that the primary intended benefit isn't to thwart agencies like the NSA, but rather to protect against criminal threats.
Nov
4
comment My college hosts a critically vulnerable service. I warned them 4 years ago. What should I do?
Keep in mind that schools and colleges are notorious for being over-reacting asshats in response to security notices. Kids have been kicked out or even arrested over them. My advice would be to tread very carefully.
Nov
4
comment Domain socket authentication as in MySQL and PostgreSQL secure?
As far as I'm aware, TCP/IP vs. Unix sockets are just seen as different communications layers, which the actual protocol is agnostic to. That being said, I've only taken enough of a look at the protocol to emulate a couple of the packet types, and that was entirely on TCP/IP.
Nov
4
comment Domain socket authentication as in MySQL and PostgreSQL secure?
Anecdotal evidence: I know that by default MySQL will do some form of challenge-response auth which is difficult to break, but the actual communications after that are not encrypted by default. You also have to have encryption enabled on BOTH the client and server for it to be enabled. There's also no integrity protection - I wrote a small tool for injecting queries into existing connections.
Nov
4
comment Is there a reason to use TrueCrypt over VeraCrypt?
I'm with @CodesInChaos on this one. I may be ill, and it may be a coffee-less Tuesday morning, but I cannot fathom why anyone would think OTP would be even vaguely useful in FDE.
Oct
26
comment When MBR pirates grin as an indication of absolute pleasure!
Just wipe the disk and start over.
Oct
26
comment Is it even possible to hack a television channel?
@EllieKesselman It's from the movie "Hackers", which everyone should definitely see. Cheesy as hell, soundtrack by The Prodigy, stars Angelina Jolie from when she was practically a kid.
Oct
25
comment What attacks, if any, are possible against Security Support Provider Interface (SSPI)?
@paj28 Sorry, yes, I should've been more clear. I guess I'm mainly referring to Negotiate and Digest SSP (SASL) as they're the two most common. But, as well as that, I'm interested in the security of how SSPI as an interface safely decides which protocol to use when there are mismatches in support between two endpoints.
Oct
25
comment Is it even possible to hack a television channel?
I would've thought this would be a better clip to pick :)
Oct
23
comment How “enforcable” are email disclaimers
@CarlosBribiescas That is an amusing thought. Sadly, I don't know the answer. It's probably never been tested in court.
Oct
19
comment How do I use “openssl s_client” to test for (absence of) SSLv3 support?
@RogerLipscombe Right, so what's not working there? SSLv3 is not listed, so it's not supported.
Oct
10
comment Add a file as entropy source for /dev/random
Care to explain what specific requirement you have that /dev/urandom doesn't solve? The term "true-random entropy" doesn't make any sense in this context.
Oct
10
comment Add a file as entropy source for /dev/random
You can't really "consume" entropy. Besides, /dev/urandom is designed to provide an essentially unlimited CSRPNG through the use of AES-CTR keyed from /dev/random, which means you're guaranteed to have strong random numbers as long as you've got even a bare minimum of collected entropy. You'd have to run some kind of tiny cut-down kernel on a low-entropy embedded device and pull gigabytes of random data from /dev/urandom to impact security in a negative way.
Oct
10
comment Add a file as entropy source for /dev/random
Can I just ask... why? What is the problem that you are solving by doing this? I mean, "for funsies" is completely fine, I just want to be sure you're not doing it because you expect some kind of tangible security improvement.