network profile
| bio | website | |
|---|---|---|
| location | United Kingdom | |
| age | 21 | |
| visits | member for | 1 year, 3 months |
| seen | May 15 at 9:06 | |
| stats | profile views | 16 |
I am currently employed as an apprentice mechanical engineer. I frequently code in my spare time and have been deeply involved in computing for as long as I can remember (my earliest memories are navigating my full 4 GB hard drive on Windows 95 and thinking, what is all this junk occupying C:\windows\ and taking up room for all my games? Delete!).
I'd like to share my tips and tricks and anything else I've picked up over the years with the StackExchange community, so I look forward to helping!
|
Mar 7 |
comment |
Compute the AES-encryption key given the plaintext and its ciphertext? According to your definition, AES is broken, since the computational complexity has been reduced by ~3 bits: schneier.com/blog/archives/2011/08/new_attack_on_a_1.html |
|
Mar 6 |
comment |
Is it possible to locate Tor/proxy users? Spam is getting on my nerves +1 for CAPTCHA suggestion. |
|
Feb 22 |
comment |
How to proceed if a new hash algorithm for passwords is introduced? This is poor practice. They could just upgrade the hashes transparently on the next user login, then if it was determined your current password didn't conform to the new policy, taken you to a page where you could change it. |
|
Feb 22 |
comment |
What is the difference in security between a VPN- and a SSL-connection? To add to the above, given the fact that many applications do not properly implement SSL libraries, resulting in serious security compromises, it may be wise to consider using VPN to ensure you don't rely on each applications individual SSL implementation, rather on one that has been well audited (open-source VPN solutions like OpenVPN). |
|
Feb 22 |
comment |
Can I determine which algorithm was used if I know the matching hash of a given input? It's possible but I would say unlikely, as many compression algorithms will introduce a level of overhead which would produce an output larger than this, in addition to including a plain-text header which states what compression was used (unless this has been omitted on purpose as part of an exercise - context matters here). |
|
Feb 22 |
comment |
What are the security risks when users upload their html & javascript to AWS S3 and the content is used in a webapp Just bare this in mind if that's ever something you want to provide for your clients. :) |
|
Feb 22 |
revised |
Can I determine which algorithm was used if I know the matching hash of a given input? added 350 characters in body |
|
Feb 22 |
answered | Can I determine which algorithm was used if I know the matching hash of a given input? |
|
Feb 22 |
answered | Methods for uploading shell to a website |
|
Feb 22 |
comment |
What are the security risks when users upload their html & javascript to AWS S3 and the content is used in a webapp I'm talking about if the user wants to do something like: <% @artists=('Foo','Bar') %><h2>Artists</h2><ul><% foreach @artists $artist %><li><%=$artist%></li><% end %>. |
|
Feb 22 |
awarded | Commentator |
|
Feb 22 |
comment |
What are the security risks when users upload their html & javascript to AWS S3 and the content is used in a webapp OK so in terms of risk from exploitation in your templating system, if you're just doing straight text-replacement there is not much of a risk in that, as long as you always know you're replacing with safe values. But consider you might want to provide functionality such as looping in your template system - in that case you're going to be accepting parameters for execution such as your loop start-end limits. This represents an attack surface so make sure these data are properly validated. |
|
Feb 22 |
answered | What are the security risks when users upload their html & javascript to AWS S3 and the content is used in a webapp |
|
Feb 20 |
comment |
How to not reveal that you are using PHP? If anything, you might want to continue to advertise your versions, so a) you remain highly aware of keeping tight version control in your infrastructure and b) maybe some nice white hat will alert you if you are vuln to some 0day attack. :-) |
|
Feb 13 |
awarded | Yearling |
|
Feb 6 |
comment |
how to mitigate a DDoS from botnet on your website that comes from random IPs It only needs to be implemented for the duration of the attack. Make sure it's something you can easily remove when the attack is over. |
|
Dec 6 |
comment |
Windows 7 Password Hash Security @Eric G as regards physical coercion, TrueCrypt implements a decoy OS feature meaning that in the event of extortion one can provide access to seemingly sensitive but relatively worthless information. |
|
Aug 28 |
answered | Avast says I don't need to use encrypted connections for my e-mail accounts |
|
Mar 12 |
comment |
Wireless security attack techniques At the age of about 13 I was able to crack WEP in about 8 minutes using an Asus EEEPC 900. I wrote a blog post on the exact steps using BT2, which has been mirrored (my blog since went down, can't remember why). Er, the guy who mirrored it actually used it as a source for a translation. Whack this through Google translate. hdlsec.com/foro/seguridad/hack-wifi-desde-asus-eee |
|
Mar 12 |
answered | Can a hacker sniff others' network data over a wireless connection? |
