6,392 reputation
21147
bio website lucb1e.com
location The Netherlands
age
visits member for 2 years, 1 month
seen 20 hours ago

Software Engineering student. Also interested in computer networking and security. For contact info, see lucb1e.com/!about


Jan
10
comment Credit card information being sent over HTTP?
Although the risk of the data being caught is relatively low, this is a credit card account we're talking about. If someone happens to be using this website on an unprotected or shared wifi, their credit card information could easily be abused. So yes, I'd say it's a very legitimate concern and you should notify them about this. Depending on the country, I can imagine a victim could sue them for neglect or something along those lines.
Jan
10
revised Can ISPs log IP connections?
added 184 characters in body
Jan
10
answered Can ISPs log IP connections?
Jan
9
comment Can ISPs log IP connections?
Replaced "Let's say I want to go to google.com, can my ISP see it in logs?" with "Let's say I went to google.com, can my ISP see it in logs?". This is not thoughtcrime we're talking about ;)
Jan
9
revised Can ISPs log IP connections?
Fixed typos, added dns tag
Jan
7
comment Email instead of username
@MartinBrown Good morning mister edge-case ;). I'm pretty sure noone elses uses my handle 'lucb1e'. If it's not available somewhere, it's more likely someone is trying to impersonate me than anything else. (Or I simply had an account already.) So far at least I've never had collisions, and it's been quite a few years of registering anywhere from Twitter to Gmail to, well, anywhere.
Jan
5
reviewed Close Is my information secure when using Private Tunnel?
Jan
5
comment Can I trust the details given in Resource Monitor?
Quick additional note: malicious software can always change things like these. It could send false data to any process requesting the process list (such as sysinternals' process explorer, task manager, or the resource manager). There is no way to be 100% sure that what you are looking at is right, if you suspect to have been compromised and the malware may have had admin or system permissions.
Jan
5
reviewed Approve suggested edit on Is exploit researching different from penetration testing
Jan
4
comment Using multiple hash-functions along the line
Use PBKDF2 or something similar. See security.stackexchange.com/q/211/10863. That's all.
Dec
16
revised NTKRNLPA.EXE connected to strange IP
Clarified nslookup command with formatting, and provided a link to look subnets up.
Dec
16
comment NTKRNLPA.EXE connected to strange IP
@RoryMcCune Besides that you can simply spoof executable names, I wouldn't trust a potentially compromised machine to produce any reliable information about what's running.
Dec
9
comment Cross site scripting prevention removing &lt and &gt
Not sure I understand the problem correctly, but what if $UserInput = <script>alert(1);</script&gt?
Dec
2
awarded  Announcer
Nov
26
comment Irreversible hashing without collision
@Stephane Yes he just needs to look it up I guess, but why hash it at all? If you're going to hash "irreversibly", at least make sure it's really non-trivial to reverse. You can just use a static salt; it's the work factor that it's about. Also, any good hashing algorithm produces good pseudorandom output regardless of whether the numbers are sequential or not.
Nov
26
comment Irreversible hashing without collision
How many possible IDs are there? Because I'd think it's probably just a number from, say, 0 to uint_max (~4 billion). This is trivially searchable with any hashing system, and is thus pretty useless. Even if this hashing satisfies requirements from higher up, you should think about what you really want to achieve. If you really think this increases security, you should use something that increases the cost to search, like pbkdf2 or bcrypt with decent parameters.
Oct
30
comment How can I share files with other individuals using the cloud in a secure way?
So basically just run your own service. This answer doesn't really help since the OP is looking for something similar to Dropbox. Having to develop a Dropbox clone first is not really what he was looking for I think.
Oct
22
comment How does changing your password every 90 days increase security?
Upvoted because unfair. Another answer with +6 pretty much says the same thing. Don't downvote just because everyone else does.
Oct
12
comment How could malware like Stuxnet be detected?
It's funny that you say "like stuxnet". A part of the Stuxnet program was to have spies plug in prepared USB sticks. It's not only a technical problem that needs to be solved in order to prevent Stuxnet 2.0.
Oct
12
comment How can I be secure with a global salt?
@jpkrohling "unsalted passwords can be easily attacked with rainbow tables". Well would you want to generate a rainbow table where each hash takes 0.1s (after which you still need to run it against the user database), or crack the salted passwords (without rainbow table) which take only 0.001s per hash per user? So yeah, I meant storing it in the same table.