46,088 reputation
12106195
bio website en.wikipedia.org/wiki/…
location United Kingdom
age 26
visits member for 2 years, 10 months
seen 3 hours ago

Pentester, ex-developer, security researcher, reverse engineer, electronics tinkerer, internet activist, zombie eradicator, promulgator of useless facts, shrubbery inspector, bacon aficionado, devourer of donuts.

Strengths: Security, Crypto, Win32 API, C#, .NET, PHP, x86 assembly

All answers and comments are encrypted with ROT256-ECB.

Opinions are my own. Advice provided with no warranty.


Aug
6
comment How many possibilities can today's computers check (per second) in a SHA512 hash of a 50-byte-long random entry?
The salt would never be typed in by a person. It's generated randomly and stored in the database with the hash.
Aug
6
comment How many possibilities can today's computers check (per second) in a SHA512 hash of a 50-byte-long random entry?
You're making this a lot more complicated than necessary. I suggest you read through the answer I linked (this one) and improve your understanding of password hashing and salting schemes before continuing.
Aug
6
comment How many possibilities can today's computers check (per second) in a SHA512 hash of a 50-byte-long random entry?
Where are you storing it, then? I sincerely hope that the salt is unique to each user.
Aug
6
comment How many possibilities can today's computers check (per second) in a SHA512 hash of a 50-byte-long random entry?
What do you mean by "the salt will remain in the hash"? If you hash the salt, you cannot retrieve the original salt, so how do you verify that a password is correct?
Aug
6
comment How many possibilities can today's computers check (per second) in a SHA512 hash of a 50-byte-long random entry?
No, that's incorrect. The attacker already knows your salt, because he's breached your database to get the hash. The point of the salt is to make every hash unique, so that a precomputed database cannot be used to look up all hashes and get the plaintext. The reason you should use a large random salt is that it makes the probability of duplicates near zero.
Aug
6
comment Detect changes in /boot when using full disk encryption
+1 for going to the heart of the problem - you can't verify anything absolutely, just do the best you can with the tools and information you have.
Aug
6
comment What CVE identifier will follow after CVE-2012-9999?
+1 for the advice around emailing Mitre. They're curt, professional and accomodating, even in cases where the vendor is being (to put it bluntly) an asshole.
Aug
6
comment My server is being DDoS'ed with 13 gbit and my provider nulled my ip, taking down my server - what can i do
Duplicate of How can a Software application defend against DoS or DDoS? and Accessing a site which is under DDoS?
Aug
6
comment What's the deal with SMS archiving?
There are a number of possibilities, but it's difficult (without knowing internals of your provider's systems) to identify which is the right one. It could be caching / archives, it could be due to an old delivery request stuck in the system, or it could just be that your handset tripped out and sent an old text again.
Aug
5
comment Should I take care of mysql credentials?
Whilst it's not entirely necessary, I take this strategy to near-extremes by running one of my more sensitive webapps over multiple SQL users, each with their own permissions. Each user is tuned to a specific role, and it's selected based on if a user is logged in, and which page they're using. Anonymous (i.e. non-logged-in) users only get SELECT access to certain tables, and INSERT access to log tables. It greatly reduces the attack surface. Of course, proper use of parameterized queries negates any injection possibility.
Aug
5
comment How should I store a password to allow people to enter single characters from it?
They use a HSM, such that the requests go into the device (are character 4, 6 and 7 of 4395092's secret word 'b', 'e' and 's'?) and it spits out a yes / no answer. The HSM is usually configured to prevent extraction of any full ciphertexts or keys.
Aug
4
comment What camera resolution is required to identify human faces?
Haha, I lol'd. Yeah, that acronym doesn't come without certain presuppositions.
Aug
4
comment What camera resolution is required to identify human faces?
@ewanm89 Yeah. Also, verify that the power supply you're testing with is exactly the one that you'll be buying with the device. I've seen great results on a demo, and then found out that the real PSU shipped with the device is an awful full-wave rectified supply with no decoupling, causing horrible noise on the image. I ended up building my own supply for it.
Aug
4
comment How does disk encryption mounting work with large disk and low RAM?
@ewanm89 I should've been more clear - I meant most block sizes were at most 256-bit, not that 256-bit was the most common. Even in the case of Threefish, the amount of RAM required to implement them in CBC mode is minimal.
Aug
4
comment Protecting passphrases within an application
@Gilles In my (admittedly limited) experience, games are usually leaked to crackers in the distribution phase, way before the release date. You have to spend a significant amount of time and effort to delay an attacker longer than even the release date of the game. For an independant developer, I have zero doubt that this would be too much to handle.
Aug
4
comment Is there an index of all md5 collisions?
I'm not sure I'd advocate SHA256 for non-security-sensitive indexing purposes, since SHA1 is much faster. But both will do the job :)
Aug
4
comment How does disk encryption mounting work with large disk and low RAM?
For full system disk encryption TC includes a bootloader that decrypts the boot sector and loads the OS. From there, it provides an abstraction layer that transparently encrypts and decrypts all data going to and from the disk.
Aug
4
comment How does disk encryption mounting work with large disk and low RAM?
@LucasKauffman They're from the Wikipedia article. Surprise, surprise, academics steal things too! :o
Aug
4
comment Securely tell the user his password in new WHM/Cpanel account creation?
Pretty much, yeah. The point is that once the link is used, it's used, and the user has set their own password. With a one-time password, you are transmitting a token that is usable for more than one login.
Aug
4
comment Protecting passphrases within an application
That's almost as bad. Implementation is difficult, and easy to get wrong. It's beside the point, though. You cannot solve the DRM problem.