43,587 reputation
1295173
bio website en.wikipedia.org/wiki/…
location United Kingdom
age 26
visits member for 2 years, 6 months
seen yesterday

Pentester, ex-developer, security researcher, reverse engineer, electronics tinkerer, internet activist, zombie eradicator, promulgator of useless facts, shrubbery inspector, bacon aficionado, devourer of donuts.

Strengths: Security, Crypto, Win32 API, C#, .NET, PHP, x86 assembly

All answers and comments are encrypted with ROT256-ECB.

Opinions are my own. Advice provided with no warranty.


Aug
4
comment How does disk encryption mounting work with large disk and low RAM?
For full system disk encryption TC includes a bootloader that decrypts the boot sector and loads the OS. From there, it provides an abstraction layer that transparently encrypts and decrypts all data going to and from the disk.
Aug
4
comment How does disk encryption mounting work with large disk and low RAM?
@LucasKauffman They're from the Wikipedia article. Surprise, surprise, academics steal things too! :o
Aug
4
comment Securely tell the user his password in new WHM/Cpanel account creation?
Pretty much, yeah. The point is that once the link is used, it's used, and the user has set their own password. With a one-time password, you are transmitting a token that is usable for more than one login.
Aug
4
comment Protecting passphrases within an application
That's almost as bad. Implementation is difficult, and easy to get wrong. It's beside the point, though. You cannot solve the DRM problem.
Aug
4
comment Protecting passphrases within an application
This is bad advice. #1 rule of crypto is "crypto is hard". #2 rule of crypto is "don't roll your own". Obfuscation is just obscurity.
Aug
4
comment Are phone calls normally recorded?
Just a quick note: all cell and landline providers store logs of the called numbers, including blocked numbers. In the UK and US, getting these numbers requires a warrant. In some states / circumstances, a second warrant is required to reveal any blocked numbers. The likelyhood of the CPS (or your-country-equivilent) granting a warrant for such a petty misdemeanour is microscopic. (disclaimer: IANAL)
Aug
4
comment Is there an index of all md5 collisions?
Is there a reason you're not using SHA-1 instead? So far there haven't been any practical collisions discovered.
Aug
4
comment Can GPG be a full replacement for PGP?
@ryran Oh, cool. I've missed that feature then. It has been a while since I updated.
Aug
3
comment Is multiple encryption a good idea?
@AndrewSmith your proliferation of misinformation around this subject is damaging. Your views (by evidence of voting) are clearly extreme. Furthermore, your conflictory attitude is becoming a burden to deal with. Please refrain.
Aug
3
comment How insecure are PHP's rand functions?
@D.W. Ah, yes, I didn't consider the seeding issue. I'll defer to your judgement on this one regarding BBS vs. AES-CTR; perhaps I'll open a question so you can express your wisdom on the matter! :)
Aug
3
comment Is multiple encryption a good idea?
@CodesInChaos That's different - you're using one algorithm multiple times in a layered-SSL-type protocol to ensure knowledge of payload and knowledge of identity are mutually exclusive to each node. Also, Tor was written by people with a lot of knowledge and experience in cryptography, and has seen a large amount of peer review.
Aug
3
comment How insecure are PHP's rand functions?
@D.W. Care to clarify? I though BBS was a decent CSPRNG?
Aug
3
comment How insecure are PHP's rand functions?
@AndreyBotalov Not until D.W. explains further. He knows more about this than me.
Aug
3
comment Is multiple encryption a good idea?
Our concerns weren't with the attack surface of the algorithms, but rather the attack surface of the implementations.
Aug
3
comment Is multiple encryption a good idea?
That sounds reasonable, yes.
Aug
3
comment Is .bank owned by banking industry or not?
That would be nice. But I have a feeling that .com is so engrained in people's minds that banks will just stick with that and continue to ignore security recommendations.
Aug
3
comment Can GPG be a full replacement for PGP?
There's no specific commands. GnuPG can create files compatible with PGP 5.x and higher if you select certain options.
Aug
3
comment Can GPG be a full replacement for PGP?
I'm confused. Did you mean every GPG version?
Aug
3
comment Is .bank owned by banking industry or not?
They're just domain names. The banks would be the same as they are today.
Aug
3
comment Virus Encoded in Video
Your final sentence isn't really correct. Neither are encoded in either. It's just an executable with a name designed to trick people.