6,497 reputation
21147
bio website lucb1e.com
location The Netherlands
age
visits member for 2 years, 3 months
seen 3 hours ago

Software Engineering student. Also interested in computer networking and security. For contact info, see lucb1e.com/!about


11h
comment A future heartbleed bug?
I've been noticing a bunch of certificate updates on Google, Twitter and other websites too. In all cases it changed, if I remember correctly, the MD5 fingerprint to undefined or something. Seems to be related to the recent discussion about accepted hashing methods for certificates in 2015.
11h
answered entropy of two factor authentication
14h
reviewed Approve suggested edit on Can anti-CSRF token prevent bruteforce attack?
1d
answered Search on hashed data
1d
reviewed Approve suggested edit on Why is it a security problem not to update one's browser?
Sep
13
comment Is my custom password hashing algorithm insecure?
It's better than nothing (kudos for at least thinking about the problem), but in general pbkdf2/bcrypt/scrypt with decent settings is always better than something you came up with yourself.
Sep
11
reviewed Approve suggested edit on Is there any good reason to choose IDS over IPS?
Sep
10
reviewed Approve suggested edit on How to keep someone from analyzing our site?
Sep
8
reviewed Approve suggested edit on How Does A Random Salt Work?
Sep
8
comment Is the HMAC weakened if a part of the message is part the key?
TL;DR: No but it's useless. Just leave the message out of the key.
Sep
7
reviewed Approve suggested edit on Not replacing SSL cert on a rebuilt, formerly rooted Unix Server
Sep
5
reviewed Approve suggested edit on hsm tag wiki excerpt
Sep
2
reviewed Approve suggested edit on Is there a security issue in using the same certificate for all a company's services?
Sep
1
comment Encrypting a huffman encoded file
Encrypt the whole file. The contents do not matter and you want to leak as little info to an attacker as possible. In fact I wouldn't be surprised if you could figure out the file's contents under the right circumstances when leaving the header exposed. I cannot think of a single advantage to leaving anything exposed. For encryption, use something like GCM (galois/counter mode), or if that's unavailable try for AES-256-CTR, or AES-256-CBC. Tip: use a library. (Yeah this comment might be good enough for an answer, but it's just jotting down thoughts.)
Aug
31
reviewed Approve suggested edit on Are there any artifacts for filesystem forensics in memory?
Aug
24
reviewed Approve suggested edit on How does this website prevent directing away from it
Aug
24
reviewed Approve suggested edit on Why is “www.” considered unsafe in this HTTPS URL?
Aug
22
reviewed Approve suggested edit on How should I store and secure self-signed certificates?
Aug
21
comment Hackers attack against wp-config.php
@JaneBrye in that case I think someone might be abusing your hosting account for spam or DDoS attacks or something. Without more details I can't really say anything, but one way to stop it is change hosting and do a fresh Wordpress install. Or have someone look at it.. perhaps the hosting company can look through logs? It's in their interest not to end up on blacklists.
Aug
21
comment What sensitive information can be leaked in a Vim's swap file?
Hmm, good point. I edit stuff on a live website with vim, but never thought about the swp files that might leak parts of the content... The odds are low that someone will try whether the swp file is present right at the moment when I'm editing, but it's a good point nevertheless.