45,582 reputation
12105191
bio website en.wikipedia.org/wiki/…
location United Kingdom
age 26
visits member for 2 years, 9 months
seen yesterday

Pentester, ex-developer, security researcher, reverse engineer, electronics tinkerer, internet activist, zombie eradicator, promulgator of useless facts, shrubbery inspector, bacon aficionado, devourer of donuts.

Strengths: Security, Crypto, Win32 API, C#, .NET, PHP, x86 assembly

All answers and comments are encrypted with ROT256-ECB.

Opinions are my own. Advice provided with no warranty.


Jan
31
comment How do we know if the hard disk we just bought is “clean”?
Exactly my point. You can't ever 100% verify the security of anything. Trying to do so is an exercise in futility. Like it or not, you have to rely upon implicit social constructs like trust and faith. There's nothing to stop the guy at Starbucks from filling your morning coffee with cyanide, but we have faith in the fact that he is deterred by the consequences, and faith that the judicial system would rightly prosecute him if he did poison you. Conversely, he trusts that you won't try to steal his cash register or throw your piping hot Grande Macchiato in his face after he serves you.
Jan
31
comment How do we know if the hard disk we just bought is “clean”?
If your adversary can modify your hard disk's firmware or hardware between the time that you order it from Amazon and the time that you plug it into your system, I suggest quitting your job, taking out a large loan, and flying out to somewhere sunny like the Bahamas, because you'll be glad that your last few days on earth were comfortable.
Jan
31
comment How do we know if the hard disk we just bought is “clean”?
No link to mainstream malware, but that's a moot point - you should protect against unknown and future threats. It's possible, though. Give this a read: spritesmods.com/?art=hddhack&page=1
Jan
31
comment How do we know if the hard disk we just bought is “clean”?
That still doesn't cover other attacks, like firmware modification.
Jan
31
comment How do we know if the hard disk we just bought is “clean”?
You can't assume that the boot sector will be clean, and if you're using the drive for data rather than an OS then the boot sector probably won't get replaced. Then all it takes is for your BIOS to attempt to boot from it.
Jan
31
comment RSA vs ECDSA for VANET Security
Does the downvoter feel like gracing us with a comment, are are they just intent on being an unhelpful asshat?
Jan
31
comment How to Protect JSON Data
Protect it from who? The user? People sniffing the network? Protect it against what type of attacks? How, specifically, is the JSON being used in the application?
Jan
25
comment Is there a way to split up my SSH Key using Shamir's Secret Sharing?
Excellent, thanks. I figured Lagrange polynomials might be involved in some way, though I didn't expect it to be so direct.
Jan
24
comment Bank cards - chips vs mag stripe security
RFID is about contactless payments. Chip & Pin is a different technology.
Jan
24
comment Is there a way to split up my SSH Key using Shamir's Secret Sharing?
Slight side question (sorry for hijacking this a little) - is this similar to the concept of Lagrange polynomials, whereby given n-1 points on the curve (where n is the number of terms in the polynomial) you can calculate another target point?
Jan
23
comment How does IP Spoofing increase the upload speed?
DNS, NTP, SNMP, etc. are all potential vectors for amplification.
Jan
23
comment What are the benefits of having multiple overwriting patterns for secure deletion?
To be clear, disks bigger than 15GB manufactured after 2001 will not be vulnerable to MFM analysis after a single wipe pass. Older and smaller disks may be, so you should use the DoD spec overwrite procedure if you want to be secure against state-level threats. Note that MFM technology isn't exactly something your average hobbyist keeps in his shed.
Jan
23
comment Can isolated forms be dangerous for my server security?
Oh jeebus. Yeah there's no hope here.
Jan
23
comment Can isolated forms be dangerous for my server security?
Filter the input so that XSS isn't possible. Take a look at this and this for more info.
Jan
23
comment How to process or manage Key-Encryption-Key using HSM?
Usually the HSM does all the crypto without the KEK ever leaving the device - you feed it an encrypted DEK and it gives you an unencrypted DEK back.
Jan
22
comment How many possibilities can today's computers check (per second) in a SHA512 hash of a 50-byte-long random entry?
@Pacerier Fixed.
Jan
22
comment Bank accepts different password to the one that I set
Have you tried this for passwords shorter than 7 characters? It may well be something like the old DES crypt hash that truncates longer passwords.
Jan
21
comment Is authorisation with token secure?
We seem to have a problem with new users being put off by people who downvote needlessly, without explanation. Whilst you clearly took it in your stride, many don't, and it can be frustrating for both them and moderators to deal with. I like people to stick around here because it's genuinely a good place to be, hence my interest. Anyway, glad you got the answers you needed! :]
Jan
21
comment Is authorisation with token secure?
Are the downvoters going to bother leaving a comment, or should our new guy just sit here thinking "wow these guys are assholes!"?
Jan
20
comment Preventing softwares from leaving traces in Windows | deleting the traces easily
VirtualBox is a free VM solution you can use. I don't know of any open-source alternatives to Sandboxie, but as I noted in my answer it's not a solid solution anyway.