43,437 reputation
1294172
bio website en.wikipedia.org/wiki/…
location United Kingdom
age 26
visits member for 2 years, 6 months
seen Apr 11 at 12:45

Pentester, ex-developer, security researcher, reverse engineer, electronics tinkerer, internet activist, zombie eradicator, promulgator of useless facts, shrubbery inspector, bacon aficionado, devourer of donuts.

Strengths: Security, Crypto, Win32 API, C#, .NET, PHP, x86 assembly

All answers and comments are encrypted with ROT256-ECB.

Opinions are my own. Advice provided with no warranty.


Jan
20
comment Is Java relevant to Information Security?
Not just that, but the fact that most security flaw types are agnostic to the underlying programming language. You could equally have buffer overflows in C, C++, and Delphi. You might have poor password storage in any application, regardless of the languages and technologies involved. Even SQL injection is not limited to a particular dialect of SQL.
Jan
20
comment How to know if connection is encrypted
I think they're referring to HTTPS, i.e. HTTP over SSL/TLS.
Jan
20
comment Password stretching using concatenation of hashes
It's a bit of both. Assuming that your code is secret is a bad move (crypto 101 stuff!) and the actual key derivation you're using is weird and may have flaws. Stick to PBKDF2 and other known-good mechanisms.
Jan
20
comment Does sending two different hashes of the same password reduce security?
+1 on the remarks about SSL. It really is a negligible overhead, and the costs (even for a non-free SSL cert) are low.
Jan
19
comment A fake phone tech changed my start up password.
My advice is to report this to the police. Unauthorised access is a violation of most countries' computer law (e.g. Computer Misuse Act in the US, Computer Fraud & Abuse Act in the UK). Call your local police station and ask who you should talk to about cyber-crime (that's usually what govm't types call it), and explain the situation. Whilst they won't fix your computer, they can at least pull phone records to identify the perpetrators.
Jan
16
comment Meaning of webpage link containing www23
I personally disagree with the downvoting of this question. It may not be requesting advice on rocket surgery, but it's still a valid concern that I'm sure many people have had.
Dec
22
comment Basic simple encryption with already installed tools
No need to be rude. And yes, I understand that OP is looking for something simple, but sadly there's not much chance of that beyond 7zip.
Dec
22
comment Basic simple encryption with already installed tools
As I noted, there's not an option that's pre-installed, but PGP is cross-platform and available in standard package repos. I'll make it 100% clear at the start of the answer if that makes you happy.
Dec
22
comment Basic simple encryption with already installed tools
But then "no, there's not" is the answer, not WinRAR, which is exclusively a Windows application.
Dec
22
comment Basic simple encryption with already installed tools
What? Win RAR on Linux? "a tool already installed on these systems by default"?
Dec
22
comment Is it possible that my home ADSL router firmware was hacked?
Never be surprised by poor quality code or typos in embedded firmware. The things I have seen make this look inconsequential.
Dec
22
comment Is it possible that my home ADSL router firmware was hacked?
There are three potential reasons for that. The first is just that your system's DNS cache kept the old IP. The second is that the router firmware contains this mechanism as part of the ISP's branding. The third is that your ISP could be hijacking the DNS requests and modifying them on-the-fly, which would be super douchey, but sadly unsurprising.
Dec
22
comment Cracking passwords after a patteren with ex. John
JTR's munging (a.k.a. permutation) rules let you do the same thing.
Dec
22
comment How to secure a WiFi network?
Major point missing from this answer (and others): disable WPS. No point having a super-secure key if an attacker can just brute-force a 6-digit pin.
Dec
22
comment Testing a hardware random number generator
This is largely untrue - modern systems have many ways of acquiring highly entropic data. On-die HRNGs can utilise truly random phenomena such as Johnson-Nyquist noise and quantum tunnelling to produce strong random numbers to great effect.
Dec
22
comment Testing a hardware random number generator
Not strictly true - it is at least possible to decap the IC and use a microscope to verify that the internal HRNG design is of sufficient quality.
Dec
21
comment How can someone go off-web, and anonymise themselves after a life online?
Side effects may vary.
Dec
21
comment physical access proof smart card for disk encryption
Sorry, what? Why would you "give encryption keys to cloud"? That's not how keyfiles and smart card tokens work...
Dec
21
comment physical access proof smart card for disk encryption
Why not use multi-factor authentication? You can then have a password, token, and/or keyfile. Doing so removes the problem of one device being compromised.
Dec
18
comment How a database connection makes mysqli_real_escape_string more secure?
Ah, my bad, didn't notice the 'i'. I blame procedural-style for looking weird.