57,555 reputation
17140236
bio website en.wikipedia.org/wiki/…
location United Kingdom
age 27
visits member for 3 years, 9 months
seen Jul 15 at 23:36

Pentester, ex-developer, security researcher, reverse engineer, electronics tinkerer, internet activist, zombie eradicator, promulgator of useless facts, shrubbery inspector, bacon aficionado, devourer of donuts.

Strengths: Security, Crypto, Win32 API, C#, .NET, PHP, x86 assembly

All answers and comments are encrypted with ROT256-ECB.

Opinions are my own. Advice provided with no warranty.


Sep
4
comment Cohen's problem
Excellent answer, with a great example too. I hadn't heard of this problem. I guess Turing-completeness factors into this too?
Sep
4
comment Where does SSL encryption take place?
@Bruno I'm not sure I get what you're saying. TCP/IP is a suite of network protocols, whereas TCP and IPv4 are distinct protocols at individual layers in the OSI model. The OSI model makes a good abstraction in this case, because it shows where SSL sits. It doesn't need to be 100% accurate - nothing ever is with such abstractions - it's just there to aid understanding.
Sep
3
comment Is TrueCrypt safe enough to store clear-text-passwords?
Alright, TrueEquineVoltaicCellRivet then! ;)
Sep
3
comment Token-based authentication - Securing the token
Configure the client and server HTTPS implementations to reject weak ciphers and TLS downgrades. It's platform dependant, so you'll need to do some googling.
Sep
3
comment Token-based authentication - Securing the token
Yup, you should be fine if it's over HTTPS and your client refuses invalid certificates / weak ciphers.
Sep
3
comment Token-based authentication - Securing the token
@James Sorry, misunderstood the question. The mechanism you linked is fine for this kind of situation, but it will not protect you against replay attacks. You need to use something like SSL to prevent MitM / replay.
Sep
3
comment Token-based authentication - Securing the token
@James When the user comes to the site and does not have a session, the cookie token is sent to the server. The server validates it, creates a new session as the logged in user, and invalidates the token. It then gives the user a new token. The session identifies them whilst they're using the site, but when they close their browser (or the session expires) the user is no longer logged in. When they come back, they have no session, and the new token you gave them allows you to create a new session (go back to step 1)
Sep
3
comment Bypassing the BIOS password
+1 for that Arduino project. I actually considered that as an option, but it seems someone beat me to it! :)
Sep
3
comment Is TrueCrypt safe enough to store clear-text-passwords?
Or correcthorsebatterystaplecorrecthorsebatterystaple1234
Sep
3
comment Tracking stolen laptop which has a login password
@FrankPresenciaFandos Try switching to TrueCrypt's system encryption. It allows you to completely encrypt the disk, and have it decrypted at boot via the TC bootloader. This ensures that your entire disk is safe, including the OS and any swap file you might have.
Sep
2
comment What is a good practical (and sane) way to manage all your passwords for online sites?
You can store your password archives on DropBox or an equivalent service. Besides, your archive should be backed up along with your data. You do have backups, right? ;)
Sep
2
comment How should I manage my passwords?
Duplicate of What is a good practical (and sane) way to manage all your passwords for online sites? or security.stackexchange.com/questions/1222/…
Sep
2
comment Why is ARP poisoning killing all network activity?
@jkarr It might be that your tool isn't working properly. Try analysing your network with a tool like Wireshark, to see what ARP packets are being broadcast.
Sep
2
comment Are prepared statements 100% safe against SQL injection?
@drjimbob That might actually be one of the most informative comments I've ever read on this site. Now, I'm off to go read about the implementation of SQL parsers...
Sep
2
comment Why don't computers check whether there are memory contents in some memory space?
Great answer. You're starting to rival me for tl;dr-ness these days!
Sep
2
comment Why is php not used for banking sites or for a banking transaction?
@D.W. I'm not saying PHP is blameless here - the certainly could have done a better job with the design of the API and documentation in terms of promoting good security practices - but it's a drop in the ocean compared with the number of bad tutorials there are out there.
Sep
2
comment Why is php not used for banking sites or for a banking transaction?
@D.W. Whilst I somewhat agree with the points made in there, the fact is that PHP makes it very easy to write code, and it scales incredibly well. If you use a proper framework design (MVC-style) it can be really maintainable too. Once you get past its quirks and strangeness, it's actually a great language. However, its biggest failure is not really its own fault - tutorials (W3Schools being the obvious example) have a horrendous track record for teaching awful security practices, e.g. mysql_query with concatenated strings and no sanitization.
Sep
2
comment Why is php not used for banking sites or for a banking transaction?
@HarshalMahajan Encryption is not security. Please don't confuse the two. For example, I might encrypt my data with AES256, using a key derived using PBKDF2, with a perfectly random IV, then put the password on a sticky-note and attach it to my computer. The crypto is strong, the security is weak. There's a huge difference.
Sep
2
comment Webservices exploitation / axis/services/AdminService?Method=AdminService
I removed the link from your post. Whilst it'd be nice if we could all trust arbitrary links in people's questions, this is a security board. I also don't want a spam/malware spider spotting your link and messing up your sandbox.
Sep
2
comment What is the smallest possible Windows shellcode?
The smallest possible is 0x90 - a NOP instruction. It does absolutely nothing.