Polynomial

32,802 reputation

1067136

bio	website	en.wikipedia.org/wiki/…
	location	United Kingdom
	age	25
visits	member for	1 year, 7 months
	seen	23 hours ago
stats	profile views	2,043

Pentester, ex-developer, security researcher, reverse engineer, electronics tinkerer, internet activist, zombie eradicator, promulgator of useless facts, shrubbery inspector, bacon aficionado, devourer of donuts.

Strengths: Security, Crypto, Win32 API, C#, .NET, PHP, x86 assembly

All answers and comments are encrypted with ROT256-ECB.

Opinions are my own. Advice provided with no warranty.

	32,802 reputation	bio	website	en.wikipedia.org/wiki/…	visits	member for	1 year, 7 months
1067136 badges		location	United Kingdom		seen	23 hours ago

summary answers questions tags badges favorites bounties reputation activity

1,451 Comments

suggestions reviews revisions comments badges posts accepts all

Apr 8	comment	WPS vulnerability scanning for handshakes to detect the attack I don't agree on the Windows side of things. A promiscuous mode device with supporting drivers, coupled with the pcap filter driver, will work fine. The same is required in Linux. WPS conversations occur over the same basic 802.11 frames as normal traffic.
Apr 7	comment	Forensic Decoding Problem Agreed. We need the raw hex dump in order to get into this.
Apr 5	comment	Why isn't AV software configured to recognize installed program vulnerabilities? We have warnings about vulnerable software. It's called the "Reboot for updates" nag screen.
Apr 5	comment	Security seals and the “perception of safety”? @Ladadadada My point is that there's nothing to stop a rogue CA from issuing a cert for whitehouse.gov, even with an EV for that matter.
Apr 4	comment	SQL Injection - UNION SELECT and returning a 'keyword' to find exploitable columns So, for example, when the error appears for a binding issue your token might appear once, but when your token appears for one issue you'll get one error, and when your token appears for another issue you'll get a different error. By checking that the error changes or that the number of instances of your token in the page changes, you can detect different behaviours.
Apr 4	comment	Are secret URLs secure over HTTPS? Did not know that. Updating answer.
Apr 3	comment	Need a software that can monitor and log network traffic of installed applications This sounds like it'd quickly fill up your disk. What's your end goal? Seems like something an IDS / IPS might be better for.
Apr 3	comment	Need a software that can monitor and log network traffic of installed applications Nagios doesn't seem like it solves the problem. It seems that OP wants to monitor the traffic itself, rather than system state.
Apr 3	comment	isaac random number generator and the type of encryption it is used for (game packet encryption)? Why not just use SSL? It'll give you even better transport security and most languages have built-in support.
Apr 2	comment	What technical reasons are there to have low maximum password lengths? @PPC Password quality != password entropy. Entropy is a purely statistical measure.
Apr 2	comment	Why improvising your own Hash function out of existing hash functions is so bad The primary issue is that you have to introduce more code to parse the encoded output of scrypt / bcrypt so that the salt and round count can be stored separately. Plus it doesn't really offer any increased security - scrypt is more than enough for 99.9% of situations.
Apr 1	comment	Why improvising your own Hash function out of existing hash functions is so bad @thejh It was an example of how ignorance of the internals of an operation can lead to security vulnerabilities. It was not meant to be a direct analogy, hence why I said "Obviously it's more complicated in the case of KDFs, but the same principle applies."
Apr 1	comment	Why improvising your own Hash function out of existing hash functions is so bad @Phil Done. Hopefully it makes sense.
Apr 1	comment	Why improvising your own Hash function out of existing hash functions is so bad My point is that since we don't know what potential problems might exist, why not go with the known safe route and just use scrypt with a decent work factor? It's more than secure enough for almost every purpose.
Apr 1	comment	Why improvising your own Hash function out of existing hash functions is so bad The interaction between the two is undefined, because nobody has studied it. Combining the two might provide more security, but it also might lead to unusual interactions between the internals of those hashes. A good example of this is the one time pad. Computing `c=m^k` gives you a perfect level of security when `k` is truly random and unknown to the attacker. So let's do it twice, for more security! So we end up with `c=m^k^k`, which results in `m`. Oh, whoops. Obviously the interactions are more complex in hashes, but the principle still stands.
Apr 1	comment	Why improvising your own Hash function out of existing hash functions is so bad The security issue isn't really a cryptographic one. You have to write lines of code to produce this implementation, and every line you write brings potential vulnerabilities. Even subtle things like how Unicode is handled on certain machines can be catastrophic from a security perspective. Keep it simple, keep the implementation clean of needless crud, and you'll be safer.
Apr 1	comment	Why improvising your own Hash function out of existing hash functions is so bad @GeorgePowell Your `sha1(md5(bcrypt()))` scheme makes no sense. What does it offer that bcrypt alone doesn't? If you're looking for more security in bcrypt, why not just increase the work factor, or switch to scrypt? Abusing other hash primitives, especially mainly-broken ones like MD5, for an undefined and minuscule benefit (which may actually be a detriment) isn't smart and can only provide you with more complexity.
Mar 31	comment	When hashing passwords, is it ok to use the hashed password as the salt? @ThomasPornin My bad, that's correct.
Mar 31	comment	What technical reasons are there to have low maximum password lengths? @Kaz Nobody said there was.
Mar 30	comment	Can PHI be HIPAA compliant on a cloud? Agreed. This doesn't accurately represent the way that HIPAA works in relation to 3rd party providers.