31,987 reputation
346116
bio website bishopfox.com
location
age
visits member for 4 years, 3 months
seen yesterday

Test everything, trust no one.

Do not trust any security related answers you see on StackOverflow.com (SO) / Security.StackExchange.com (SE). Not from me, not from anyone. There are very smart people on SO/SE and there are excellent answers given, although the right answer is not always chosen.

I have been writing exploit code for a while. There is no perfect system, vulnerable code will always exist.


Dec
19
comment Reversible, recoverable user data encryption scheme
@KeithS Just about everyone on security.se will go ape shit if you suggest replacing SSL with a home-brew system. I am one of these people. From experience I think that reinventing the wheel is one of the worst evils in the security industry. This discussion is not building a secure system, it is a learning experience for you and a waste of everyone Else's time.
Dec
19
answered At what point is password complexity “safe enough”
Dec
19
revised Reversible, recoverable user data encryption scheme
added 80 characters in body
Dec
19
comment Reversible, recoverable user data encryption scheme
@KeithS None of these problems are new, proven solutions already exist in the open source world. I like SSL a lot, their cipher suite system incorporates variants of all the proven primates such that when a vulnerability is found you can easily fall back on a secure set of primitives. NO SSL cipher suite is redundant, such as using bcrypt and sha256 at the same time. This is the opposite of your system, in that you are increasing the attack surface by increasing the complexity. If a flaw is found in bcrypt you have a problem, when a flaw is found in sha2 you also have a problem.
Dec
19
comment Changing user account passwords from PHP script - vulnerabilities?
@Ryan Griggs I expect some level of security in an application. Just about everything in your code is vulnerable as if you do not know the basics. strcpy() really? Do you know what a buff overflow is? Calling the commandline with attack supplied input? You should start from the beginning with a simple question instead of piling it on.
Dec
19
revised Reversible, recoverable user data encryption scheme
added 14 characters in body
Dec
19
revised Reversible, recoverable user data encryption scheme
added 523 characters in body
Dec
19
revised Reversible, recoverable user data encryption scheme
added 523 characters in body
Dec
19
revised Reversible, recoverable user data encryption scheme
added 523 characters in body
Dec
19
answered Reversible, recoverable user data encryption scheme
Dec
18
comment Changing user account passwords from PHP script - vulnerabilities?
Yes this is very obviously remote code execution. Worse idea ever. Voting to close.
Dec
18
comment Resource consumption attacks against algorithms
@bonsaiviking This is a great answer. I am looking for other vulnerable algorithms, and he found a whole set!
Dec
15
revised Resource consumption attacks against algorithms
edited title
Dec
15
reviewed Approve Resource consumption attacks against algorithms
Dec
15
revised Resource consumption attacks against algorithms
added 247 characters in body; edited title
Dec
15
accepted How can a web application protect IE users when this browser doesn't support HSTS?
Dec
14
asked Resource consumption attacks against algorithms
Dec
11
comment How do I prevent this type of SQL injection attack?
parametrized quires, like every other sql injection ever.
Dec
10
comment Same-origin policy for file: URLs in Android browser?
@D.W. So what did you find out? Did you try it?
Dec
8
comment My website keeps getting infected
You should hire a professional.