48,658 reputation
13118208
bio website en.wikipedia.org/wiki/…
location United Kingdom
age 26
visits member for 3 years
seen yesterday

Pentester, ex-developer, security researcher, reverse engineer, electronics tinkerer, internet activist, zombie eradicator, promulgator of useless facts, shrubbery inspector, bacon aficionado, devourer of donuts.

Strengths: Security, Crypto, Win32 API, C#, .NET, PHP, x86 assembly

All answers and comments are encrypted with ROT256-ECB.

Opinions are my own. Advice provided with no warranty.


Oct
2
comment masking credit cards PAN with zeros
@Timee That makes no sense at all; it's like saying having a database of every number from 0000 to 9999 violates PCI because you're guaranteed to have someone's PIN in there.
Oct
1
comment Where are the user credentials stored when remember password is selected?
If you downvoted this, please leave a comment to explain why.
Oct
1
comment How does stored procedure prevents SQL injection?
@AnanduMDas No, that's not necessary. The database server, in a traditional string query, has to parse out the query language and data itself. This is why we have to sanitise the data, because it's ambiguous and could be mistaken for query language. When the two are separated out as part of the protocol (i.e. the query string and the data fed into it are split into separate sections of the packet), the data doesn't need to be sanitised because the database already knows that it's data, and won't treat it as query language.
Sep
25
comment Can't I forge an SSL certificate?
@JavaIsCool Browser updates and OS updates. Here's an example of an MSKB hotfix to deploy new root CAs.
Sep
25
comment Can't I forge an SSL certificate?
@raz 10-30 years is a more accurate range. Most are around 20 years, from looking at my TRCA list.
Sep
25
comment Can't I forge an SSL certificate?
@JavaIsCool To an extent, yes. Operating systems usually push out updated root CA lists in updates (e.g. Windows hotfixes) and browsers usually ship them with updates. Revocation of compromised or replaced certificates is achieved with Certificate Revocation Lists (CRLs) and similar mechanisms.
Sep
25
comment Four-factor authentication
@user2813274 Except George Washington's account would be long closed and locked, and your example has nothing to do with time locks in this context.
Sep
25
comment Is it possible to Spoof a TeamViewer ID?
Windows Server 2007 isn't an operating system. Did you mean 2003, 2008, or 2008 R2? ;) (not that it really matters)
Sep
25
comment C++ memset() memory overflow
@Mark It's absolutely on topic here. Whether someone could answer it better elsewhere is irrelevant. In these situations you can advise OP to ask over on another site, because they'd have better expertise, but that's not a valid reason alone to flag something to be closed as off-topic.
Sep
25
comment C++ memset() memory overflow
@Mark Ah, yes, so it does - it's a local scope instance. Blame my lack of coffee this morning! Rather odd that this is flagged, then.
Sep
25
comment C++ memset() memory overflow
Come now, who voted this as off-topic? It's about the security of a particular operation in code. If that's not security, I don't know what is. Get some itch cream for your trigger finger.
Sep
25
comment C++ memset() memory overflow
@Mark Admittedly I've not used C++ for a while (I'm more used to C), but my understanding was that MyObject op; alone didn't call the default constructor, whereas MyObject op(); does. Also, surely &op doesn't refer to the object itself (since op is a pointer type) but rather the address of the pointer?
Sep
25
comment How do attackers find the database technology used by a web application?
This is a mess. Can you go through and clean this up to use reasonable formatting please? The spaces in URLs aren't needed. Also, all of part 1 is nonsense and irrelevant to the question.
Sep
24
comment New payment option on Paypal “Enter your online banking ID + password”: Any mechanism that could make this safe?
That's the most creative form of image censoring I've ever seen.
Sep
24
comment Escape from <script> to cause a XSS (XSS when reflection is already under <script>)
@user38257 That's not how StackExchange works. If you didn't get an answer to your question, it's probably because you didn't provide enough information or detail. Editing your question or commenting on it brings it back to the active questions list, where people are more likely to see it. Do not repost old questions.
Sep
23
comment Server situated on two physical networks - Bad idea or not
@makerofthings7 It depends. I think VM separation in ESX is reasonable enough that I'd be reasonably happy putting two different sensitivity level systems on the same box. I don't know about putting them on the same VLAN though - it seems like a bad idea. If it were something that'd be storing regulated data (e.g. PCI DSS) or protectively marked data, I'd want it on a completely separate dedicated box, with appropriate dedicated controls in place.
Sep
23
comment Four-factor authentication
The time is not an authentication factor. It's still a security control, but it has nothing to do with authentication itself, as it doesn't provide evidence that something or someone is authentic.
Sep
23
comment What are lawful network interception tools?
@GriffinNowak Possession of malware by itself, for the mostpart, in jurisdictions I am aware of, is entirely legal. Consider a case where someone is infected by malware; the computer is their property and therefore they are in possession of malware. If simple possession was illegal, then they would be, which makes no sense. The interesting (and muddy) parts of law are the parts that separate incidental possession from possession with intent.
Sep
21
comment How do I hash a password in C#?
I agree with the advice in Angel's link. Salted PBKDF2 as implemented in the Rfc2898DeriveBytes class is pretty much industry standard.
Sep
21
comment ATA security erase on SSD
@cprcrack Those that adhere to the specification (which should be all high-street brand drives) are encrypted internally, yes.