46,153 reputation
12106195
bio website en.wikipedia.org/wiki/…
location United Kingdom
age 26
visits member for 2 years, 10 months
seen yesterday

Pentester, ex-developer, security researcher, reverse engineer, electronics tinkerer, internet activist, zombie eradicator, promulgator of useless facts, shrubbery inspector, bacon aficionado, devourer of donuts.

Strengths: Security, Crypto, Win32 API, C#, .NET, PHP, x86 assembly

All answers and comments are encrypted with ROT256-ECB.

Opinions are my own. Advice provided with no warranty.


1d
comment Is this hash function safe?
@curiousguy I don't follow. Surely using sizeof(char) is the most descriptive term?
2d
comment Is this hash function safe?
@curiousguy Any sane compiler would macro sizeof(char) to 1 and optimise out the imul anyway. I personally think sizeof(char) is a good thing to include, as it implies that the size of the type is relevant. That way, if you move to wchar_t or similar later to gain Unicode support, it's obvious that you need to change that calculation too.
Aug
21
comment Delay time clicking of contextual menu on the mouse
This is not a security question at all.
Aug
21
comment New DDos Attack on WordPress website
You could drop requests containing that pattern using iptables or mod_security.
Aug
21
comment Processor microcode manipulation to change opcodes?
@user10008 You're correct - my statements above are a little misleading in hindsight. What I was trying to say is that the BIOS only uses a small subset of the instructions that a modern processor exposes, so you could modify certain extensions (e.g. x87 FPU, MMX, SSE, AES-NI, etc.) without affecting the functionality or execution of the BIOS itself.
Jul
25
comment Questions about common exploits
Would the downvoter like to share their criticisms, rather than just providing abstract disagreement?
Jul
25
comment Could running applets/videos trigger a drive-by download attack?
See also.
Jul
9
comment How to store salt?
@cooky451 I'm not sure what you're asking, but I suggest creating a new question.
Jun
10
comment RSA verification time
@TomLeek While you're correct, I think this is a homework question, considering the fact that he's asking for those three specific CPUs and they all happen to have benchmark scores for 1024-bit key generation in those tables. From what I can tell, the tutor is trying to get them to do clock * ticks to get time.
Jun
10
comment RSA verification time
This looks like homework, and seems to be entirely based around calculating times from clock frequencies rather than security (just do clock * ticks = seconds)
Jun
10
comment Is cryptography possible without volatile memory?
CPU registers and cache are certainly volatile.
Jun
9
comment If md5 is only insecure because of its speed, why doesn't this workaround make it reasonably secure?
Salts and peppers do not change the computational complexity of a hash-based system significantly. They are designed to prevent against precomputation attacks such as Rainbow Tables.
Jun
6
comment How to detect the so-called “undetectable” Gameover Zeus?
I like that you linked the five "publications" I'd avoid for any balanced and sane view on the matter. Especially the Daily Mail... seriously? I direct you to the Daily Mail Song.
Jun
6
comment XSS prevention by black-listing
Why not just use an actual content filtering function from your web language? Or OWASP's filter engine?
May
30
comment Who can carry out Man-in-the-Middle (MITM) attacks?
MitM is usually limited to people on the same local network as you, but that might be anyone if you're using open wifi (guy with a laptop at Starbucks), or are in a work environment (malicious insider). But anyone can do a MitM across the internet if they happen to luck out on poorly configured DNS servers or bad passwords on the registrar account. Also, the WiFi hijacking one is trivial - you can buy off-the-shelf devices that do it.
May
27
comment Does using the same encryption algorithm multiple times make a difference?
ROT256-ECB is vastly superior. It's what I encrypt all of my answers with.
May
27
comment libraries alternative to gcc stack-protector / fortity source feature on linux
Surely those features aren't reliant on linking a library? I was under the impression that they're features of the compiler rather than features of libc.
May
27
comment Ethical question regarding accessible sensitive data at school
@Anonymous I'd say deliver it to the administrative head for the school (e.g. headteacher / principal). They'll forward it on to tech once they've decided how to handle it. Sending it direct to tech feels like you're going "around" the system a bit.
May
26
comment Does using the same encryption algorithm multiple times make a difference?
@drjimbob You are correct; I made the assumption that AES-CBC was being performed three times, and therefore the padding could be verified.
May
26
comment libraries alternative to gcc stack-protector / fortity source feature on linux
What requirements do you have that aren't satisfied by the built-in functionality?