2,182 reputation
713
bio website
location United Kingdom
age 22
visits member for 2 years, 7 months
seen Sep 8 at 20:25

I am currently employed as an apprentice mechanical engineer. I frequently code in my spare time and have been deeply involved in computing for as long as I can remember (my earliest memories are navigating my full 4 GB hard drive on Windows 95 and thinking, what is all this junk occupying C:\windows\ and taking up room for all my games? Delete!).

I'd like to share my tips and tricks and anything else I've picked up over the years with the StackExchange community, so I look forward to helping!


Jul
17
comment How can I prevent my kids from bypassing my computer restrictions?
This is definitely a parenting question. Find a creative way of encouraging this and you could be raising the next Bill Gates :-) (or at least a talented IT professional)
Jul
1
comment Where do you store your personal private GPG key?
@johannestaas It's straightforward to encrypt the keys before backing them up although I'd prefer not to rely on remembering the pass-phrase. A backup in a physically secure location trumps encryption, IMO. You could use an open-source QR reader on an off-line device and then destroy all the data on it before putting it on-line again.
May
15
comment SSL/TLS version switch over reason
Can you log the negotiation in (one of or both of) your respective libraries? You should be able to retrieve details more easily that way. You can only speculate when you have just network data.
May
15
comment Encrypting files on Google Drive
@Celeritas You are wanting something illogical. You are saying you don't want to trust a computer that you want to use sensitive files on. Yes it's annoying when you can't have both convenience and confidentiality, but that is the way security works - it's a constant trade-off of these two elements. To be blunt, you simply have to get over it.
May
14
comment Is my ISP doing a port scan on my computer?
Thanks for your contribution. I advise this is investigated before sending abuse notices.
May
14
comment Is my ISP doing a port scan on my computer?
It is not impossible for a single person to control more than one IP address. You need to collect a list of the addresses and report them.
May
14
answered Is my ISP doing a port scan on my computer?
May
14
comment Strange logs in apache from bing/facebook
Or the IP address was previously used.
May
14
comment Is my ISP doing a port scan on my computer?
It is not usual for data to be incoming from port 443. Please show more of the source IP (first three segments).
May
8
comment Is it a bad idea to share the ssh host key in a diskless environment?
Well what that means is that if you think you're connecting to a specific one of those student workstations, you could actually be connecting to any other one of them, if they're redirecting traffic, since it's the same keypair. But not sure what benefit that would give them, unless they want you to get a headache. I cannot see much of an issue with this to be honest. There are probably more serious security issues in such an environment, if disk data is being transmitted in plain-text.
May
7
comment How to validate the confirmation link received when publishing a new PGP key?
You need to import both public and private keys. So: gpg --import public.asc and gpg --allow-secret-key-import --import private.key. You can use those keys once imported, as if you'd generated them locally.
May
7
reviewed Approve suggested edit on What's the meaning of the term “ad-hoc MAC” (Message Authentication Code)?
May
7
comment How to validate the confirmation link received when publishing a new PGP key?
@blacksensei That's absolutely correct! Key servers just attempt to make things more convenient. They're like an address book. There can still be houses, even if there is no entry in the address book.
May
7
comment Is it a bad idea to share the ssh host key in a diskless environment?
I'm not too sure this really is a security question, without you providing more detail. The fact you put it on SU first makes me think you are asking from the POV, can there be issues such as conflicts when multiple hosts use the same key? (Not AFAIK, but I'm not confident enough to answer in place of a SU expert.) The security situation is difficult to answer without you telling us the purpose of the keys and the access controls on them.
May
7
answered How to validate the confirmation link received when publishing a new PGP key?
May
7
comment How to do Rijndael MixColumns step
"They are supposed to XOR 1010 1000 by 02" Where did you get this impression?
May
6
comment How to deobfuscate this PHP malware?
I will add, however, that due to the fact the evaluated code is generated from direct XORing, the attackers could rewrite large portions of the code (up to however large the GET or COOKIE data can be or the current payload length, whichever is smallest) that is executed by knowing the payload data and determining the key that makes it XOR to new code.
May
6
comment How to deobfuscate this PHP malware?
Not quite, omitted due to the sheer size of it, $encrypted_string is generated by the mess of punctuation marks etc at the beginning of the code. Here's the binary contents that gets XOR'd by the decrypt() function: mega.co.nz/… We would want to get a copy of the key hopefully from the originating server log. Failing that we could brute force XOR the payload looking for a key that generates evaluable PHP.
May
6
comment How to validate the confirmation link received when publishing a new PGP key?
It's the second paragraph of your question that confuses me. The way you do it is identical, just you need to generate the key pair on your server. Perhaps this is an AskUbuntu question.
May
6
answered How to deobfuscate this PHP malware?