52,908 reputation
16125218
bio website en.wikipedia.org/wiki/…
location United Kingdom
age 27
visits member for 3 years, 5 months
seen 6 hours ago

Pentester, ex-developer, security researcher, reverse engineer, electronics tinkerer, internet activist, zombie eradicator, promulgator of useless facts, shrubbery inspector, bacon aficionado, devourer of donuts.

Strengths: Security, Crypto, Win32 API, C#, .NET, PHP, x86 assembly

All answers and comments are encrypted with ROT256-ECB.

Opinions are my own. Advice provided with no warranty.


Feb
19
comment Are secret URLs secure over HTTPS?
@Bruno Are you sure about that? I was under the impression that modern browsers don't leak the referrer between entities as per the Same Origin Policy (SOP).
Feb
2
comment How to perform SQL injection with real_escape_string filter in place?
Yup, if you can inject 1 or 1=1 then you can (probably) inject the union.
Feb
1
comment How does Dropbox actually protect against sharing copyrighted content?
This question isn't really answerable by us, because it's proprietary. I'd imagine they're using locality-sensitive hashing, also known as fuzzy hashing. It's the same kind of technique that Google uses to identify infringing video on YouTube. It won't help against encrypted or compressed (e.g. zipped) files, though.
Feb
1
comment How to perform SQL injection with real_escape_string filter in place?
May I ask why you have chosen to entitle your SQL filtering method "sanitise string XSS 51"? It seems odd to call it XSS.
Feb
1
comment How to perform SQL injection with real_escape_string filter in place?
Except that won't work, due to the single quotes.
Feb
1
comment What is Provable Security?
@Exbury Provably secure, in a general sense, means "empirically secure based upon a number of assumptions". One of those assumptions is a reasonable key size. The RSA algorithm is secure, if you provide sensible parameters. Just the same as AES isn't secure if you use an all-zero key that the attacker knows.
Jan
29
comment How does stored procedure prevents SQL injection?
@Pacerier Yes. Prepared statements are essentially the same thing as stored procedures, at least from this perspective.
Jan
28
comment Encrypting files securely using user supplied password
Yes, that is right.
Jan
25
comment Encrypting files securely using user supplied password
@VivekGhaisas Yes, though convenience isn't really the term I'd use. The security margin of 256-bit keys vs. the security margin of 128-bit keys, at current, is not significant enough to make an impact on your design. Using CBC or CTR mode requires that you add additional complexity, which increases the potential for bugs and design flaws. Sticking with ECB against a 128-bit key in this very specific case is, somewhat counter-intuitively, a likely safer option.
Jan
25
comment WEP man in the middle
@Rhys Yes. They're on the same network, so unless some odd settings are used, the attacker can send packets to the victim. That's all they need to utilise ARP spoofing or DNS hijacking.
Jan
24
comment SOCKS proxy security concerns
@jww You communicate with the target server over HTTPS, via the SOCKS proxy, not the other way round. Since TLS is designed to protect against man-in-the-middle attacks, you're safe against malicious proxies.
Dec
4
comment Is data-remanence a concern in RAM?
Relevant: security.stackexchange.com/questions/29019/… and security.stackexchange.com/questions/7299/…
Dec
4
comment Which forward secrecy cipher suites are supported for TLS1.0 protocols?
@PURE That's a separate question which would be better asked at ServerFault, but you could either use ssl-cipher-suite-enum (free script, but full disclosure: I work there) to test a live instance, or check your config files. I don't know where the TLS config is kept in Tomcat, though.
Dec
4
comment Soundness of GRC.com Haystack padding concept
I'll provide my usual Steve Gibson reference: attrition.org/errata/charlatan/steve_gibson
Dec
1
comment Passing session id in query string to maintain state in third party iframe - good practice?
Yes, it's bad practice. Regardless, the cookie shouldn't be blocked as 3rd party, unless the user has a very overzealous privacy plugin. Your cookie should just get set and sent under the standard same origin policy for your domain.
Nov
27
comment How strong is a simple XOR encryption with random IV?
As soon as you leak P xor K, you immediately lose to known plaintext attacks. Any structured data should result in relatively trivial key recovery in this situation.
Nov
27
comment is it sufficient to convert '(single-quote) to ` ' `
Or, if more than one field is filled out, a simple backslash in the first and ;alert(1)// in the second.
Nov
4
comment Why wouldn't it be great, if HTTP/2 would only allow communication via TLS?
I think that it's important to state categorically that the primary intended benefit isn't to thwart agencies like the NSA, but rather to protect against criminal threats.
Nov
4
comment My college hosts a critically vulnerable service. I warned them 4 years ago. What should I do?
Keep in mind that schools and colleges are notorious for being over-reacting asshats in response to security notices. Kids have been kicked out or even arrested over them. My advice would be to tread very carefully.
Nov
4
comment Domain socket authentication as in MySQL and PostgreSQL secure?
As far as I'm aware, TCP/IP vs. Unix sockets are just seen as different communications layers, which the actual protocol is agnostic to. That being said, I've only taken enough of a look at the protocol to emulate a couple of the packet types, and that was entirely on TCP/IP.