45,582 reputation
12105191
bio website en.wikipedia.org/wiki/…
location United Kingdom
age 26
visits member for 2 years, 9 months
seen yesterday

Pentester, ex-developer, security researcher, reverse engineer, electronics tinkerer, internet activist, zombie eradicator, promulgator of useless facts, shrubbery inspector, bacon aficionado, devourer of donuts.

Strengths: Security, Crypto, Win32 API, C#, .NET, PHP, x86 assembly

All answers and comments are encrypted with ROT256-ECB.

Opinions are my own. Advice provided with no warranty.


Dec
18
comment How a database connection makes mysqli_real_escape_string more secure?
Ah, my bad, didn't notice the 'i'. I blame procedural-style for looking weird.
Dec
6
comment Is SSL secure enough for a REST API - has anyone used PGP or AES to encrypt the actual data inside SSL?
I agree that double-encrypting for data in transit isn't beneficial, but you opened with "encrypting data with a SSL/TLS stream provides zero security benefit", which is patently untrue. I understand that in the context of the question (i.e. encrypting encrypted data) it's questionable, but SSL/TLS does provide clear security benefits, even with the issues around PKI. For example, "encrypted" data doesn't mandate authenticity or integrity, which SSL/TLS handles just fine when appropriately deployed. Your answer seems to attack SSL/TLS rather than this specific flawed methodology.
Dec
6
comment Is SSL secure enough for a REST API - has anyone used PGP or AES to encrypt the actual data inside SSL?
I'm not sure I agree that PKI is so overwhelmingly broken that it provides "zero security benefit". Even trivial encryption of information provides some security benefit, even if it's just to deter idiots.
Dec
6
comment Does a simple mobile REST API need HTTPS?
Yes, essentially the attacker would be in a privileged network position (e.g. on the same local subnet as the user) and would either sniff the traffic, or perform some kind of spoofing (e.g. ARP / DNS spoofing) to intercept and modify traffic. I still generally recommend HTTPS anyway, because the overhead and cost is minimal - there's not much of a reason not to use HTTPS! But it's not critical in this case.
Dec
6
comment What protection certificates would be required for an application that consists of setup, loading utility and main application?
To whoever downvoted: please explain your reasons for doing so. OP learns nothing if you remain silent.
Dec
5
comment If I send someone a google search results link, am I sending them any information about me?
Please include a summary of the relevant content from those links in your answer. Almost the entire benefit of your post is currently limited to those links, and if they ever go dead (which they will) then your answer becomes useless.
Nov
27
comment Does nmap limit probes when using time limiting on decoy scans?
Are you sure this is correct? Seems this may only apply to IP protocol scans, rather than TCP connect or SYN scans.
Nov
23
comment Reliability of windows OS security for “program files” safe guard
UDP sockets can't have ACLs applied, so any process can send packets to it. Named pipes can be locked down with ACLs.
Nov
18
comment Is it possible to install spyware in password protected android phone?
He can use something like Kies to get access, without using the pin.
Nov
18
comment How to alert webmaster if he does not put contact address
support@ and security@ are also RFC-compliant addresses to send security notices to.
Nov
7
comment Can password-protected zip files be broken without brute force?
@trejder Except that the current best known attack against AES-128 will still finish about the same time as the heat death of the universe, even if we factor Moore's law in. And that's assuming zero cost for the KDF, which will actually be the largest computational factor.
Nov
7
comment How to calculate combined false acceptance/rejection rates of multiple biometrics authentication systems?
Added homework tag as requested :]
Nov
7
comment Why don't banks get hacked?
Oh, and things like PCI-DSS help control the isolation of payment systems, too.
Nov
7
comment Why don't banks get hacked?
Also helps that banks are still running really old hardware like AS/400 for core payment processing, which most regular blackhat folk don't have much experience with ;)
Nov
7
comment Are older viruses removed from virus definition files?
Considering I don't have an MBR, you might struggle ;] even so, a PE file being written to the MBR would just corrupt it entirely.
Nov
4
comment What defines a programming language as useful for hacking?
Main problem I find with Perl libraries is that they're rarely "modern". You can easily find Python stuff for parsing pcap-ng formats, integrating with VLC, manipulating SVGs, etc., but it's usually harder to find well-documented, cleanly designed, and full-featured libraries for Perl that do that kind of thing. Perl is awesome at doing gritty manipulation of primitives, and integrating with nix / bash, but it falls a bit flat when doing more complex work.
Oct
18
comment Possible DOS Attack? And solutions for it?
The average internet-facing IP address receives dozens of attempted attacks per day, let alone random probes and port scans.
Oct
18
comment Altering passwords before storing
@danielAzuelos It's important to note that by 1940s standards the Enigma was an amazing piece of cryptographic engineering. They even knew its limitations when they deployed it, and the Allies couldn't break it without capturing a lot of equipment and messages. Its downfall was in the German soldiers misusing the device (key re-use), and that the Allied soldiers managed to capture several Enigmas and the corresponding code books. A generic attack was eventually discovered, but it took years of hard work and the biggest purpose-built supercomputers of that era.
Oct
17
comment Altering passwords before storing
See Thomas Pornin's answer - he covers everything I'd say anyway.
Oct
17
comment Is this accidental incident considered hacking(illegal)?
I'm pretty sure no legal framework defines running netstat as illegal. Regardless, legal issues are off-topic here.