57,470 reputation
17139235
bio website en.wikipedia.org/wiki/…
location United Kingdom
age 27
visits member for 3 years, 9 months
seen Jul 15 at 23:36

Pentester, ex-developer, security researcher, reverse engineer, electronics tinkerer, internet activist, zombie eradicator, promulgator of useless facts, shrubbery inspector, bacon aficionado, devourer of donuts.

Strengths: Security, Crypto, Win32 API, C#, .NET, PHP, x86 assembly

All answers and comments are encrypted with ROT256-ECB.

Opinions are my own. Advice provided with no warranty.


Jul
15
comment
@Ulkoma Absolutely not. It is an integral part of my love of Metal Gear Solid!
Jul
15
comment
@DeerHunter Kilts are acceptable, of course.
Jul
15
comment
@MikeOunsworth To me, professionalism just means wearing pants.
Jul
15
comment ASP.NET Machinekey encryption
@Levi Ah, well I shall defer to your knowledge on the matter. Weird though - I'm sure I got that description of behaviour from RE'ing the assemblies.
Jul
13
comment Can't get rid of “Your connection to website is encrypted with obsolete cryptography”
@StackzOfZtuff Sorry, I conflated the two.
Jul
13
comment Can't get rid of “Your connection to website is encrypted with obsolete cryptography”
"do not forget to define your own DH parameters or all DHE- ciphers are weak" - No, the ciphers are not weak. The use of shared ECDH groups is potentially problematic, and steps should be taken to generate your own parameters, but that doesn't make the cipher weak.
Jul
13
comment ASP.NET Machinekey encryption
@Levi This may depend on which version of the .NET framework you load, and whether you're looking at the desktop or web platform. The info above was derived from reverse engineering the framework assemblies, so I guess we're looking at different versions.
Jul
1
comment How do overlay network nodes communicate without IP addresses?
There isn't one, really. The idea is that the hidden service advertises the introduction node IDs, not its own IP, so they can introduce you to the hidden service without you knowing the IP of the target. There's a directory which holds the onion addresses and their associated introduction node IDs.
Jul
1
comment Handling CSRF tokens on pages longer than the PHP session limit
Right. You can just change session.gc_maxlifetime to a larger timeout. The problem described there is that you shouldn't rely upon the PHP GC to time out your session on the server side, because it may not do so immediately after the configured time. It should never time it out before that time.
Jul
1
comment Handling CSRF tokens on pages longer than the PHP session limit
"PHP session limit"? What session limit? The session cookie expiry can be set at any value, including forever. Besides, if the session no longer exists, they should be logged out, which is a totally different issue.
Jul
1
comment How do overlay network nodes communicate without IP addresses?
Are you essentially asking how Tor hidden services (e.g. onion addresses) hide their IPs? Or are you asking about all individual nodes in the chain for communications?
Jul
1
comment How do overlay network nodes communicate without IP addresses?
Possible duplicate of Why can a Tor exit node decrypt data, but not the entry node? - also, this and this might help.
Jul
1
comment What is the difference between a hash table and a rainbow table, and how are they both used?
Simple answer: rainbow tables chain similar hashes together to save space, by not storing the prefix for every hash. (e.g. f2ca5152b0..., f2ca513a13..., and f2ca5177b8... can be stored as f2ca51 -> 52b0..., 3a13..., 77b8... since they share the same prefix).
Jun
30
comment Why FATCA IDES “protocol” does not use RSA encrytion directly on Zip archive ?
@YvesMartin No, it's not too short at all. Brute-forcing a 256-bit key with conventional computers would take more energy than is thought to exist in the universe. The reason RSA keys are longer in numerical size is that they represent primes rather than just any old random number, and the mathematics involved to crack RSA means we (currently) need keys in the order of 2048-bits or larger to remain safe.
Jun
29
comment DDOS Server Attacks & Domain Names
Assuming you have control over your NS records (e.g. in your domain provider's control panel), you could just use CloudFlare's free DDoS protection.
Jun
18
comment Is it any more or less secure to delete all my cookies vs. individually logging out?
To be clear: deleting your cookies alone (or first) is a bad idea, as the session might still persist on the server. Best option is to log out, then delete any remaining cookies.
Jun
15
comment How to devise a security policy?
@JohnnyUtahh Thanks for the heads up. Fixed the links.
Jun
15
comment How to devise a security policy?
@JohnnyUtahh There's certainly overlap on the Venn diagram, but they're not the same. A usage policy governs how employees should conduct themselves when using IT systems (e.g. no naughty images via work internet access). A security policy also has elements of conduct (e.g. no dodgy sites, cracked software) but is usually much larger in scope, such as giving procedures and contact information for security incidents, and may be broader in scope than just IT (e.g. handling of physical media, documents, etc.)
Jun
15
comment What is the purpose of using different DNS server in nmap?
@biziclop In that particular case I'd be using dig rather than nmap, but you are correct that it can be done that way.
Jun
12
comment How is Gmail susceptible to brute-force attacks?
"so if it didn’t leak from some other site" is the key part here. It's very likely she re-used her password elsewhere and it got compromised.