49,848 reputation
14121210
bio website en.wikipedia.org/wiki/…
location United Kingdom
age 26
visits member for 3 years, 2 months
seen 2 days ago

Pentester, ex-developer, security researcher, reverse engineer, electronics tinkerer, internet activist, zombie eradicator, promulgator of useless facts, shrubbery inspector, bacon aficionado, devourer of donuts.

Strengths: Security, Crypto, Win32 API, C#, .NET, PHP, x86 assembly

All answers and comments are encrypted with ROT256-ECB.

Opinions are my own. Advice provided with no warranty.


Aug
14
comment How “enforcable” are email disclaimers
Just reply to the email and state that you do not agree to the terms in their informal agreement, and that actions in contrary to those terms should not be considered a breach of good faith in any further emails.
Aug
13
comment Protecting critical state infrastructure from the aftermath of a nuclear blast
The ionosphere does a good job of deflecting most of it, and the water in our atmosphere absorbs a lot too. It'd have to be one hell of a solar flare to induce significant currents in ground-level wiring.
Aug
13
comment HTTP Basic auth password storage more secure than Digest auth
@curiousguy No, what I meant was that the basic auth dialog could be backed by a script, which does the hashing and other authentication and limitation. Jimbob's answer is much more detailed than mine, as I neglected to consider webforms as an alternative.
Aug
13
comment How do you prevent physical backups from being stolen?
+1 for sharing my pain.
Aug
13
comment Protecting critical state infrastructure from the aftermath of a nuclear blast
For context, the above comment was in reply to a comment that has since been deleted.
Aug
13
comment Protecting critical state infrastructure from the aftermath of a nuclear blast
@ThomasPornin That's just what they want you to believe. It's really the bunker where they keep the Stargate ;)
Aug
13
comment Protecting critical state infrastructure from the aftermath of a nuclear blast
My favourite backronym for TEMPEST has to be Tiny ElectroMagnetic Particles Emitting Secret Things.
Aug
13
comment HTTP Basic auth password storage more secure than Digest auth
Good points. I assumed OP had to use standard HTTP auth, and neglected to consider the better alternative.
Aug
13
comment Protecting critical state infrastructure from the aftermath of a nuclear blast
If I were really looking to create my own hyper-resilient network, I would just use the standard DNS system which is already globally resilient to numerous forms of attack, including localised blackouts from disasters and military strikes. If the fact that I'm not looking to actually create such a system eludes you, you've clearly got some serious comprehension issues. This is a theoretical question, for nothing more than academic purposes. People come to Sec.SE to learn, not be fed opinion.
Aug
13
comment Protecting critical state infrastructure from the aftermath of a nuclear blast
Wow. Just... wow.
Aug
13
comment Ideas to build security awareness
I'm aware of Theory X and Theory Y business psychology. In fact, it's the basis for this answer - I'm talking about giving positive feedback, not negative. You phish the users as an eye-opening tactic, then explain what they did wrong. Part of the exercise is to explain to the user that they didn't fail, they just didn't know. No negative feedback is given. However, if a user responds properly, then you provide positive feedback to their line manager, so they know they did a good job.
Aug
13
comment Potential insecurity in not sanitizing variables before INSERT with prepared statement in PDO
The data is stored in a canonical format, i.e. it is byte-for-byte what the user gave you. When the data is outputted, you must escape it for the appropriate format you're outputting into. The link I provided gives some examples for outputting untrusted content into HTML and JavaScript.
Aug
13
comment Securing a REST API: is api_secret signing and ssl enough?
Nope. MitM is only an issue with fake certs. If you make the client enforce that the HTTP cannot be downgraded to HTTP, and that the server's cert is signed by a known CA, you're safe against MitM attacks such as sslstrip.
Aug
13
comment Securing a REST API: is api_secret signing and ssl enough?
I'm confused. If it's over SSL, and your app doesn't allow downgrades to HTTP, why are you worried about MitM attacks?
Aug
13
comment How “enforcable” are email disclaimers
@m1ke An informal contract is implied, not explicit. If it's explicitly accepted by both parties, it becomes a formal explicit contract. This falls under "good faith", whereby if you don't reject the contract the other user assumes that you are operating in good faith and are not violating the informal contract. It's a legal grey area, but if the sender can convince a judge that you didn't operate in good faith then you may be liable for civil penalties.
Aug
13
comment How can I prevent my son accessing my PC?
@Andyrea Haha, thanks ^_^
Aug
13
comment How can I prevent my son accessing my PC?
No problem. Remember to accept the answer if it's been helpful! :)
Aug
13
comment How can I prevent my son accessing my PC?
Not sure what you mean. If he tries to enter the wrong password, it'll refuse to boot. There's no way round it. Some BIOSes will reboot the machine after 3 failed attempts, forcing you to wait ~10s whilst it runs through the initial POST hardware checks, but it won't prevent him from trying as many passwords as he likes. Just pick a strong one that he can't guess.
Aug
13
comment How can I prevent my son accessing my PC?
That's fair enough, gaming can be compulsive! :D
Aug
13
comment How can I prevent my son accessing my PC?
What OS? WinXP, Vista, Win7, Mac OSX, Ubuntu?