53,653 reputation
17129220
bio website en.wikipedia.org/wiki/…
location United Kingdom
age 27
visits member for 3 years, 6 months
seen 25 mins ago

Pentester, ex-developer, security researcher, reverse engineer, electronics tinkerer, internet activist, zombie eradicator, promulgator of useless facts, shrubbery inspector, bacon aficionado, devourer of donuts.

Strengths: Security, Crypto, Win32 API, C#, .NET, PHP, x86 assembly

All answers and comments are encrypted with ROT256-ECB.

Opinions are my own. Advice provided with no warranty.


Aug
23
comment Is asymmetric encryption ever recommended for long-term storage?
@CodesInChaos I hadn't considered ECC, but what I said holds true for "classic" asymmetric keys.
Aug
23
comment Is it safer to use less heard of software than popular software?
I'm confused as to how anything after the first paragraph is relevant to the question.
Aug
23
comment I'm currently receiving a targeted attack
Spammers, these days, tend to compromise websites and upload phishing pages. It makes it difficult to trace the hosted page back to them.
Aug
23
comment I'm currently receiving a targeted attack
Are you searchable by email address on Facebook? If so, it's likely they found your profile that way.
Aug
23
comment I'm currently receiving a targeted attack
Possible that they're monitoring conversations through other channels. Faceook? Twitter?
Aug
23
comment How to determine if a browser is using an SSL or TLS connection?
Interesting that the Firefox extension shows the cipher, but not the SSL version.
Aug
23
comment What are the security precautions taken to ensure a virtualized domain can't compromise its host
Sorry, my brain seems to have skipped over the bit where you mentioned hardware emulation. Was just trying to clarify so people weren't confused, but clearly unnecessary
Aug
23
comment What is the actual security of this login page?
@curiousguy File a feature request in your favourite browser's bug tracker system then! I'd certianly second it. :)
Aug
23
comment Stopping users from spoofing an IP
Indeed. Though if he can enable IPsec on his network (which most commercial-grade routers will allow) it'd save the VPN.
Aug
22
comment Mail server (sendmail) sends spam to innocent people
Is the spam still happening? If so, load up Wireshark or a similar tool and look for incoming data that might be related. It may just be that you've misconfigured your mail daemon and it's acting as a relay.
Aug
22
comment how to identify whether my page is phished or normal page?
@eversor Doesn't even need to be that. It could do it during onload. The view source functionality in most browsers shows the markup that was delivered, not the markup that is currently in the document.
Aug
22
comment Is it safer to use less heard of software than popular software?
@pepe Which is fine, until you consider that obscurity is a constant game of chance. You might be fine on any given day, but there is always a small probability of someone reverse engineering or attacking your system. As the system ages, the probability of someone coming across it is increased. Therein lies the problem: these solutions stay in use for years.
Aug
22
comment how to identify whether my page is phished or normal page?
@eversor The action attribute may also have been modified by JavaScript, or the form's post event might be (as you said) hooked.
Aug
22
comment Can the `system` function pose severe security threats on a shared hosting server?
@EdwinDrood If only that were true! A user can still run commands that eat up massive amounts of RAM or CPU cycles, completely killing the server. If the kernel or a privileged command is vulnerable, they might also upload a privilege escalation exploit and jump to root privileges.
Aug
22
comment Is it safer to use less heard of software than popular software?
@MarkHillick I wasn't attacking your answer. I like your answer. I upvoted your answer! I was just saying that your assertions in the above comments are slightly misplaced.
Aug
22
comment Attaching hotspot to existing network - can it be secured?
If their existing network runs off a hub, you could just connect the internet-facing side of the hub to the AP instead, so the reconfiguration would be minimal. i.e. office PCs connect to hub, hub connects to AP, AP connects to the internet. There's not really a way to drop the device into the network without making any changes at all.
Aug
22
comment Is it safer to use less heard of software than popular software?
@ScottPack s/MyAdmin// ;)
Aug
22
comment How much can I trust Tor?
@Pacerier "Hi, I'm <name>, I live at <address>."
Aug
22
comment Is it safer to use less heard of software than popular software?
The same goes for risk. You can argue that something less popular is a lower risk, but that's like saying "ok, here's a gun with 256 barrels, and only one bullet, go play Russian roulette". The probability might be low, but the security implications are high. Probability also does not mean a lower incident count - an unbiased coin might still land on heads 500 times in a row - it's just really unlikely. I'm not discounting your answer, I'm discounting the security of relying on a probability.
Aug
22
comment Is it safer to use less heard of software than popular software?
@MarkHillick My point is that the two are independent. There's zero correlation between popularity and security. You have to use proper security metrics to measure security. By definition it's a difficult thing to measure, so attempting to estimate using arbitrary perceptive and subjective metrics is misplaced.