49,173 reputation
14120210
bio website en.wikipedia.org/wiki/…
location United Kingdom
age 26
visits member for 3 years, 1 month
seen Nov 12 at 0:16

Pentester, ex-developer, security researcher, reverse engineer, electronics tinkerer, internet activist, zombie eradicator, promulgator of useless facts, shrubbery inspector, bacon aficionado, devourer of donuts.

Strengths: Security, Crypto, Win32 API, C#, .NET, PHP, x86 assembly

All answers and comments are encrypted with ROT256-ECB.

Opinions are my own. Advice provided with no warranty.


Sep
23
comment Four-factor authentication
The time is not an authentication factor. It's still a security control, but it has nothing to do with authentication itself, as it doesn't provide evidence that something or someone is authentic.
Sep
23
comment What are lawful network interception tools?
@GriffinNowak Possession of malware by itself, for the mostpart, in jurisdictions I am aware of, is entirely legal. Consider a case where someone is infected by malware; the computer is their property and therefore they are in possession of malware. If simple possession was illegal, then they would be, which makes no sense. The interesting (and muddy) parts of law are the parts that separate incidental possession from possession with intent.
Sep
21
comment How do I hash a password in C#?
I agree with the advice in Angel's link. Salted PBKDF2 as implemented in the Rfc2898DeriveBytes class is pretty much industry standard.
Sep
21
comment ATA security erase on SSD
@cprcrack Those that adhere to the specification (which should be all high-street brand drives) are encrypted internally, yes.
Sep
19
comment ATA security erase on SSD
@cprcrack Usually the term "encrypted SSD" is reserved for SSDs that offer user-selectable keys. The specification for flash devices contains a section for protected area keys, vendor keys, data keys, and user keys. Whether these are externally accessible is implementation specific. In devices marketed as "encrypted", the user-specified key is (usually) used to encrypt the data key which is present in a normal SSD, so that destruction of data is assured during a secure erase operation even if an attacker gains knowledge of the user's password.
Sep
18
comment ATA security erase on SSD
@cprcrack A few: TechRepublic article‌​, Intel SSD booklet, Sophos article, PC World article, and a Kingston article which implies it heavily without saying it.
Sep
8
comment Why is GSM still used?
@user10008 You mean CDMA vs. GSM? Again, money. US carriers decided to go two different ways and now they have a ridiculous split system where different phones don't work on different carriers.
Sep
8
comment Can I scratch off the magnetic strip off a debit card to only allow chip and PIN?
If you have an old tape (audio or VHS) recorder, you can take it apart and use the write heads to wipe cards. It's a nice little project you can do in a few minutes :)
Sep
8
comment Link Layer authenticated encryption vs authentication
I'm confused by your answer. The OP asked whether auth + encrypt is better than auth alone, not whether auth + encrypt is better than encrypt alone. You seem to be focusing on the authentication part, which is a given anyway as both options are authenticated.
Sep
6
comment What hash version is implemented on ThePirateBay.se? SHA-1 or MDA-5?
Note that the BitTorrent protocol, by requirement, hashes all the incoming pieces and checks them against those stored in the .torrent file, so the integrity is guaranteed anyway.
Sep
5
comment What's this type of leak detection method called?
Ha, you beat me to it!
Sep
5
comment Where can I “hide” easter eggs for students learning about Linux security?
@Rook The idea wasn't to exploit it, but rather to hide a file somewhere for a challenge.
Sep
4
comment Where can I “hide” easter eggs for students learning about Linux security?
Another evil trick: unmount /tmp, write a file to the underlying file system (i.e. the /tmp directory in the root filesystem) and then re-mount /tmp. Can only be found by enumerating inodes or guessing the trick and unmounting it.
Sep
2
comment Where can I find good word list for MySQL 5?
Are you sure you mean a wordlist, and not a rainbow table? That being said, if you have a graphics card that's less than 5 years old, I recommend just using oclHashcat or JTR on any hashes you've captured.
Aug
27
comment Is this hash function safe?
@curiousguy I don't follow. Surely using sizeof(char) is the most descriptive term?
Aug
26
comment Is this hash function safe?
@curiousguy Any sane compiler would macro sizeof(char) to 1 and optimise out the imul anyway. I personally think sizeof(char) is a good thing to include, as it implies that the size of the type is relevant. That way, if you move to wchar_t or similar later to gain Unicode support, it's obvious that you need to change that calculation too.
Aug
21
comment New DDos Attack on WordPress website
You could drop requests containing that pattern using iptables or mod_security.
Aug
21
comment Processor microcode manipulation to change opcodes?
@user10008 You're correct - my statements above are a little misleading in hindsight. What I was trying to say is that the BIOS only uses a small subset of the instructions that a modern processor exposes, so you could modify certain extensions (e.g. x87 FPU, MMX, SSE, AES-NI, etc.) without affecting the functionality or execution of the BIOS itself.
Jul
25
comment Questions about common exploits
Would the downvoter like to share their criticisms, rather than just providing abstract disagreement?
Jul
25
comment Could running applets/videos trigger a drive-by download attack?
See also.