46,958 reputation
12109197
bio website en.wikipedia.org/wiki/…
location United Kingdom
age 26
visits member for 2 years, 11 months
seen 2 days ago

Pentester, ex-developer, security researcher, reverse engineer, electronics tinkerer, internet activist, zombie eradicator, promulgator of useless facts, shrubbery inspector, bacon aficionado, devourer of donuts.

Strengths: Security, Crypto, Win32 API, C#, .NET, PHP, x86 assembly

All answers and comments are encrypted with ROT256-ECB.

Opinions are my own. Advice provided with no warranty.


Dec
22
comment Basic simple encryption with already installed tools
No need to be rude. And yes, I understand that OP is looking for something simple, but sadly there's not much chance of that beyond 7zip.
Dec
22
comment Basic simple encryption with already installed tools
As I noted, there's not an option that's pre-installed, but PGP is cross-platform and available in standard package repos. I'll make it 100% clear at the start of the answer if that makes you happy.
Dec
22
comment Basic simple encryption with already installed tools
But then "no, there's not" is the answer, not WinRAR, which is exclusively a Windows application.
Dec
22
comment Basic simple encryption with already installed tools
What? Win RAR on Linux? "a tool already installed on these systems by default"?
Dec
22
comment Is it possible that my home ADSL router firmware was hacked?
Never be surprised by poor quality code or typos in embedded firmware. The things I have seen make this look inconsequential.
Dec
22
comment Is it possible that my home ADSL router firmware was hacked?
There are three potential reasons for that. The first is just that your system's DNS cache kept the old IP. The second is that the router firmware contains this mechanism as part of the ISP's branding. The third is that your ISP could be hijacking the DNS requests and modifying them on-the-fly, which would be super douchey, but sadly unsurprising.
Dec
22
comment Cracking passwords after a patteren with ex. John
JTR's munging (a.k.a. permutation) rules let you do the same thing.
Dec
22
comment How to secure a WiFi network?
Major point missing from this answer (and others): disable WPS. No point having a super-secure key if an attacker can just brute-force a 6-digit pin.
Dec
22
comment Testing a hardware random number generator
This is largely untrue - modern systems have many ways of acquiring highly entropic data. On-die HRNGs can utilise truly random phenomena such as Johnson-Nyquist noise and quantum tunnelling to produce strong random numbers to great effect.
Dec
22
comment Testing a hardware random number generator
Not strictly true - it is at least possible to decap the IC and use a microscope to verify that the internal HRNG design is of sufficient quality.
Dec
21
comment How can someone go off-web, and anonymise themselves after a life online?
Side effects may vary.
Dec
21
comment physical access proof smart card for disk encryption
Sorry, what? Why would you "give encryption keys to cloud"? That's not how keyfiles and smart card tokens work...
Dec
21
comment physical access proof smart card for disk encryption
Why not use multi-factor authentication? You can then have a password, token, and/or keyfile. Doing so removes the problem of one device being compromised.
Dec
18
comment How a database connection makes mysqli_real_escape_string more secure?
Ah, my bad, didn't notice the 'i'. I blame procedural-style for looking weird.
Dec
6
comment Is SSL secure enough for a REST API - has anyone used PGP or AES to encrypt the actual data inside SSL?
I agree that double-encrypting for data in transit isn't beneficial, but you opened with "encrypting data with a SSL/TLS stream provides zero security benefit", which is patently untrue. I understand that in the context of the question (i.e. encrypting encrypted data) it's questionable, but SSL/TLS does provide clear security benefits, even with the issues around PKI. For example, "encrypted" data doesn't mandate authenticity or integrity, which SSL/TLS handles just fine when appropriately deployed. Your answer seems to attack SSL/TLS rather than this specific flawed methodology.
Dec
6
comment Is SSL secure enough for a REST API - has anyone used PGP or AES to encrypt the actual data inside SSL?
I'm not sure I agree that PKI is so overwhelmingly broken that it provides "zero security benefit". Even trivial encryption of information provides some security benefit, even if it's just to deter idiots.
Dec
6
comment Does a simple mobile REST API need HTTPS?
Yes, essentially the attacker would be in a privileged network position (e.g. on the same local subnet as the user) and would either sniff the traffic, or perform some kind of spoofing (e.g. ARP / DNS spoofing) to intercept and modify traffic. I still generally recommend HTTPS anyway, because the overhead and cost is minimal - there's not much of a reason not to use HTTPS! But it's not critical in this case.
Dec
6
comment What protection certificates would be required for an application that consists of setup, loading utility and main application?
To whoever downvoted: please explain your reasons for doing so. OP learns nothing if you remain silent.
Dec
5
comment If I send someone a google search results link, am I sending them any information about me?
Please include a summary of the relevant content from those links in your answer. Almost the entire benefit of your post is currently limited to those links, and if they ever go dead (which they will) then your answer becomes useless.
Nov
27
comment Does nmap limit probes when using time limiting on decoy scans?
Are you sure this is correct? Seems this may only apply to IP protocol scans, rather than TCP connect or SYN scans.