47,908 reputation
12113201
bio website en.wikipedia.org/wiki/…
location United Kingdom
age 26
visits member for 2 years, 11 months
seen yesterday

Pentester, ex-developer, security researcher, reverse engineer, electronics tinkerer, internet activist, zombie eradicator, promulgator of useless facts, shrubbery inspector, bacon aficionado, devourer of donuts.

Strengths: Security, Crypto, Win32 API, C#, .NET, PHP, x86 assembly

All answers and comments are encrypted with ROT256-ECB.

Opinions are my own. Advice provided with no warranty.


Aug
12
comment For what do I hash user passwords with PDKDF2 when the user data is stored in the same database?
NoSQL injections still exist. In fact, they're probably more prevelant by percentage than SQL injection holes are, since most people don't know anything about them.
Aug
12
comment using truecrypt keyfiles with weak passwords
I'm confused. You seem to have said you disagree with me, then made the same point I did. What?
Aug
11
comment using truecrypt keyfiles with weak passwords
I disagree with the last part. If you're storing the keyfiles in another TrueCrypt volume, it's relatively easy to write forensics heuristics to detect high-entropy files without known headers (e.g. RAR / JPEG) to find the other volume. Then it's just a case of cracking the weak password.
Aug
10
comment How much does network security audit and patch work?
This question is too vague - it's unanswerable. How long is a piece of string? We don't know what the salary is like in your country, or state/city. We don't know what other requirements you're expecting. We don't know about other benefits you provide.
Aug
10
comment How secure is the SRP that Blizzard uses to protect passwords?
This article makes for interesting reading: opine.me/blizzards-battle-net-hack
Aug
10
comment Is using a “Red” and a “Green” browser to balance LOB requirements and security a good approach?
Sounds good to me.
Aug
10
comment Is using a “Red” and a “Green” browser to balance LOB requirements and security a good approach?
If the app doesn't require network resources, disconnect the machine that is running IE from the network completely.
Aug
10
comment Why does the password field not show the entered text?
Cannot count the number of times I've shoulder-surfed people's details. Never used them of course, but be aware of your damn surroundings people!
Aug
10
comment Is it possible to break captcha?
@drjimbob By this point I'm relatively sure that Andrew is just a neural net with a string generator attached. SELECT * FROM words WHERE meaning ~= subject ORDER BY RAND()
Aug
10
comment Is it more or less secure when an entity shares it's security procedures?
@RoryAlsop That's the idea, anyway ;)
Aug
10
comment Appilicability of Theoritical Computer Science/Formal methods in Malware research
@this.josh I've never heard that point stated so well. Mind if I steal that quote? ^_^
Aug
9
comment Information Security is becoming more important, but why is it still so difficult to start off in?
+1 for the completely correct observations about ridiculous government spending, but -1 for not really giving any options for OP to look into.
Aug
9
comment Is it okay to wrap a cryptographic hash with MD5 for storage?
The first option is stronger, since you're not relying on an intermediate hash. Also, SHA256 would be 32 bytes final output, not 64 bytes.
Aug
9
comment Is it okay to wrap a cryptographic hash with MD5 for storage?
PBKDF2 and similar KDFs don't require you to do this at all. You can just explicitly set the derived key length.
Aug
9
comment Is it okay to wrap a cryptographic hash with MD5 for storage?
Your second point doesn't have much merit. Making rainbow tables for the entire output space of a KDF is completely infeasible.
Aug
9
comment Has cryptography reached the development level where social engineering is the only reliable method of attack?
@LordScree Even less if the occupant will let you if you ask nicely.
Aug
9
comment Password resets - what practices should web services follow?
@Gilles I'll have a think on it and write up a few guidelines on human verification. The problem is that the available information for validation is highly dependant on the site itself. For example, there's almost zero private activity on a StackExchange site, so it would be difficult to come up with a strong human validation scheme.
Aug
9
comment unix config scanner / compliance checks
That example isn't even worth a script. Just find or grep.
Aug
9
comment Password resets - what practices should web services follow?
@Gilles I mention it briefly at the end of section 1.4. If a user completely loses everything, they must convince a human that they own the account, by answering questions about recent usage, private info, etc. It's the only solid way to enforce security in the case of entirely lost credentials.
Aug
8
comment Is this logic security / performance wise or not?
This doesn't make much sense. Information sharing between databases wouldn't work. How would a post from user a be shown to user b?