lynks

4,352 reputation

3735

bio	website	adranos.com
	location
	age
visits	member for	1 year
	seen	4 hours ago
stats	profile views	181

	4,352 reputation	bio	website	adranos.com	visits	member for	1 year
3735 badges		location			seen	4 hours ago

summary answers questions tags badges favorites bounties reputation activity

172 Comments

suggestions reviews revisions comments badges posts accepts all

May 16	comment	Truly deniable encryption Yep that would probably do it. You have to make sure your access patterns are realistic (set all disks to `noatime` so file access time is not written to disk to make this easier, you can just say you are worried about disk lifetime).
May 15	comment	Is it posible to make shellcode with C++? This answer makes me want to go home and rethink my life.
May 15	comment	Tools to extract code comments from sites? +1 this is what I would do. `curl` piped to `sed`.
May 15	comment	Securing my firewall (both dedicated and iptables-based) With iptables, the `policy` is the default action that a chain takes when no rules have been matched, so yeah it has the same effect as your final two rules. If port 22 is not forwarded to the outside world, then that is fine too. Given that iptables is behind the hardware firewall, I would say your logs will remain mostly empty.
May 14	comment	Bruteforce Passphrase of Dictionary Words @DanKanze come join us in the DMZ
May 14	comment	Bruteforce Passphrase of Dictionary Words @DanKanze your use of the word 'throttling' is incorrect here. The point is that in order to test a candidate password, the attacker has to compute the hash for that candidate and compare it to the hash he is trying to crack. A good defender makes this computation process slow.
May 14	comment	Bruteforce Passphrase of Dictionary Words @DanKanze the fact that I list both 1000/second and 100 BILLION/second as possible attack rates should indicate to you that it really does depend on the situation. Trying to attack someone's Facebook account online is very slow, while trying to crack a poorly protected password hash is very fast.
May 14	comment	Looking for a software that will help me set security policy on my network This question is very broad as it stands, I suggest you look into some solutions yourself and come back with more specific issues as they arise. If it was me, I would run all connections via a Linux box running iptables. That would give you all the control you would ever need.
May 14	comment	Bruteforce Passphrase of Dictionary Words This is attempting all possible combinations of 4 words. And 1000 guesses per second is realistic for an online attack, such as a web-service. In an offline attack, it varies, but can be as much as 100 billion attempts per second in the worst cases (such as single iteration md5).
May 14	comment	Salting in encryption (rather than hashing) Is this not what an Initialisation Vector is for?
May 14	comment	Why isn't open WiFi encrypted? Bear in mind that Wifi is a layer 1 protocol. This means it is transparent to layer 2 (Ethernet). So 'having the wifi password' is equivalent to 'plugged into the switch'.
May 9	comment	Is OpenGL a security problem? Good question, it extends to all DMA hardware - pretty much anything that plugs into a PCI slot or Firewire port, which then runs software (or even just firmware) that could be subverted.
May 6	comment	What is the collision chance of a 128-bit hashing function if it is always fed with 256-bits of data? It is also worth noting that 2^64 is a teeny tiny fraction of the 2^128 hash space.
May 3	comment	Is IP Forwarding a risk by itself? +1 as I understand it, ip_forward is transparent, masquerading is what people should be worried about.
May 3	comment	How to camouflage at the best on internet? It depends who you are trying to hide from. The remote hosts you connect to? Your ISP? Other users of your machine? Other users of your local network? The government? Law enforcement?
May 3	comment	Confidentiality without Encryption - A way to circumvent Internet censorship Yep you're about right, some mixmasters did fragment the emails into a storm of fragments (the whole point is to get a lot of users), but it is not quite the same which is why I only commented, rather than answered :P
May 3	comment	Confidentiality without Encryption - A way to circumvent Internet censorship I am reminded of Mix-Master email relays.
May 3	comment	How to effectively save database password inside desktop application? 1. public key crypto still requires decrypting... 2. I can edit your program just as easily. The point of my answer was to illustrate that wherever you turn, it is quite easy for a user to head you off. You cannot have more control over a user's machine than the user.
Apr 30	comment	Can anyone determine what kind of encryption this is? This might be marked as too localized, but do you have any other information? They just look like random uids matching the format `w0dA0dwwwMP1`
Apr 29	comment	.JPEG File upload shell via EXIF comments In combination with a local file include vulnerability this would be quite powerful - ie not having to rely on poor extension filtering. I assume `include(evil_image.jpg);` would execute the embedded scripts..