Polynomial

32,547 reputation

1066135

bio	website	en.wikipedia.org/wiki/…
	location	United Kingdom
	age	25
visits	member for	1 year, 7 months
	seen	May 18 at 10:45
stats	profile views	2,030

Pentester, ex-developer, security researcher, reverse engineer, electronics tinkerer, internet activist, zombie eradicator, promulgator of useless facts, shrubbery inspector, bacon aficionado, devourer of donuts.

Strengths: Security, Crypto, Win32 API, C#, .NET, PHP, x86 assembly

All answers and comments are encrypted with ROT256-ECB.

Opinions are my own. Advice provided with no warranty.

	32,547 reputation	bio	website	en.wikipedia.org/wiki/…	visits	member for	1 year, 7 months
1066135 badges		location	United Kingdom		seen	May 18 at 10:45

summary answers questions tags badges favorites bounties reputation activity

1,450 Comments

suggestions reviews revisions comments badges posts accepts all

Apr 29	comment	What clubs exist for IT security? The ones that stand out in my mind are BSides (more of a conference than a local meetup thing) and DefCon chapters (e.g. DC4420 in London, DC612 in Minneapolis, etc. - the numbers are phone area codes).
Apr 26	comment	Configure SSL Mutual (Two-way) Authentication I'm all for downvoting questions you don't feel are of sufficient quality for StackExchange, but please leave an explanatory comment! A downvote alone leaves no constructive feedback, which is especially important for new users.
Apr 26	comment	Odd user registered and strange behavior. Is it sinister? If it helps, my (very brief) research shows that it's related to pharma spam, mainly for cheap Chinese antibiotics. A few of his links point to `ibuyamoxil.com`.
Apr 26	comment	how secure is passwordcard.org? +1 for accepting constructive criticism, unlike certain other people.
Apr 26	comment	Security precautions for shared iPads in a customer facing corporate environment It's likely possible with a combination of tools, but probably more hassle than it's worth to continually restore the devices to a known state between users. Why not just set up a centralised repository for this kind of shared information and have a web-app that the staff can use from any device, iPad or otherwise?
Apr 26	comment	Facebook user data fetch This is not a security question, so it is off-topic here. Normally we'd migrate the question to StackOverflow, but it would be closed there too due to a lack of research and previous work shown. Please read the FAQ for more information on the requirements here.
Apr 23	comment	IT Security professional or software developer.. which is a better career option? @geek_ji No problems, we all make mistakes. just remember to keep things on topic in future.
Apr 23	comment	IT Security professional or software developer.. which is a better career option? @geek_ji Career advice is off topic on StackExchange in general. We require questions to be objective and definitively answerable. See the FAQ for more details on the quality requirements here.
Apr 23	comment	has my website been hacked Please don't post direct URLs to live infections. Hiding the URL behind a short URL service like goo.gl is even worse, because people don't know what they're clicking.
Apr 22	comment	Switching to new encryption method (without losing data?) @anaximander Also, are you the same Anax from xkcd-pub? if so, hi! :)
Apr 22	comment	Switching to new encryption method (without losing data?) @anaximander Yup. Though you could double-hash or double-encrypt as a temporary measure and then migrate after a login.
Apr 22	comment	how is BAT_VOBFUS (or similar) dangerous? @ChrisO'Kelly Precisely. It's an indicator of infection.
Apr 22	comment	“Please Enter Nth Character” without HSM Lagrange polynomials might be an interesting avenue to look into, but I'm not exactly clear on how they can be applied. I think in general you're going to run into the problem of cheap bruteforcing.
Apr 17	comment	Using MD5 for file integrity checks? If we're looking for a way to prove integrity in secure way, a better way is a PGP signature.
Apr 11	comment	What's the most secure technique for authenticating user in a website? A single cryptographic hash is incredibly weak. You should switch to a strong KDF such as bcrypt. See this question for details on how/why.
Apr 10	comment	Is it illegal to test a website and report the security bugs to them? Yup. Largely depends on how much the government (dis)likes you.
Apr 10	comment	What's the most secure technique for authenticating user in a website? Are you hashing the passwords using a strong KDF such as bcrypt or PBKDF2? Single-round solutions using salted SHA1 or MD5 are considered very weak these days.
Apr 9	comment	Does excluding username letters from passwords increase security? This does sound pretty dumb. Not allowing the full username in the password is fine, but not allowing any letter from the username is ridiculous.
Apr 8	comment	Is there additional security value in using passwords with words or phrases in non-English languages? By that logic, "Passw0rd" is a good password.
Apr 8	comment	WPS vulnerability scanning for handshakes to detect the attack I don't agree on the Windows side of things. A promiscuous mode device with supporting drivers, coupled with the pcap filter driver, will work fine. The same is required in Linux. WPS conversations occur over the same basic 802.11 frames as normal traffic.