6,467 reputation
21147
bio website lucb1e.com
location The Netherlands
age
visits member for 2 years, 2 months
seen 18 hours ago

Software Engineering student. Also interested in computer networking and security. For contact info, see lucb1e.com/!about


Feb
3
comment Does including the username in a password make it less secure?
One bit of entropy still doubles the number of possibilities. Upon a database hack, it will take (on average and all else equal) 1.5 times longer to crack your password than it would without appending/prepending your username. It also works as a sort of salt, which would have been useful in Adobe's recent case (encrypted password database hack). But I don't downvote because in principle you're right: it's not that useful, and not everyone would know if there is some sort of vulnerability in it (not everyone knows how hashing works), so better don't do it if you don't know the result.
Jan
25
reviewed Approve suggested edit on Escaping rich text editor output
Jan
21
comment Basic Security Knowledge
First of all, I upvoted because you clearly put some thought into this post and the questions are indeed good starting points for beginners. However I'm not sure this is a good place to ask them: the answers would vary a lot and would mostly be rather long because it are broad subjects. I think an ideal answer might be a short book actually. If you still want to go ahead with making this beginner's FAQ, you could google around for answers and ask more specific questions on this site. I think those would generate some great answers, the amount of thought you put into questions seems good ;)
Jan
21
comment In Tor, what stops the end server from following the breadcrumbs back to their origin?
The answer to your question is yes, they can. But the data is there only as long as the connection is open. You'd have to knock on two people's doors and hope they both respond within a matter of hours, ifnot minutes. You can consider yourself lucky if they're even on the same continent. The Tor project exists for a while now and though there have been some high profile people using it, I never heard of this happening.
Jan
18
comment Is it possible to increase the cost of BCrypt or PBKDF2 when its already calculated and without the original password?
Let's say we have a function bcrypt(pwd, rounds). We store passwords as bcrypt(pwd, 1000). You are saying that an attacker can calculate bcrypt(pwd, 1) for any bcrypt(pwd, 1000), and then crack them with an iteration count of 1. Do you realize that once the attacker did the conversion for bcrypt(*, 1000) to bcrypt(*, 1), he already has the plaintext? The point of adding iterations is that they take time, and the point of a PRF in password hashing functions is that it is not reversible.
Jan
18
comment Could once infected machine be ever trusted again?
Upvote for the principle idea of labeling it as "cleaned up" instead of "trusted" after infection, but I wouldn't just run a virus scanner. A complete wipe of the harddrive is required, and depending on the circumstances you may want to flash the harddrive's, motherboard's and other firmware (or replace certain parts with new parts). This is not required after your little brother got a virus from illegal software, but it might be when the CIA discovers an infection in their systems.
Jan
18
awarded  Good Answer
Jan
17
answered Tails like OS for Smartphones
Jan
16
comment Are passwords stored in memory safe?
@Kaii If I had some sort of important job, it might be an option.
Jan
16
reviewed Approve suggested edit on Does critical SubjectAltName IP:x.x.x.x on an SSL client certificate limit where the certificate can be used from?
Jan
15
reviewed Approve suggested edit on Nested encryption for multiple users
Jan
13
comment Can ISPs log IP connections?
@TeunVink Okay, thanks for the follow up. Weird that I heard a different story, or perhaps the ISP is not as benign as they seem (or they have a misconception of what's required, though it seems odd). Well I'm just speculating now. Thanks for the additional info anyway!
Jan
12
comment Can ISPs log IP connections?
@TeunVink For the CIOT database (linking IP to a name and address), sure, and e-mail too, but beyond that I thought they also had to log more. At least the example from this ISP shows that they were required to; they didn't want to log anything because it simply costs money to maintain. That is, if the story I heard is true, and I think so (but I can't elaborate on why I believe the person because that might give too much info about them).
Jan
10
comment Credit card information being sent over HTTP?
Although the risk of the data being caught is relatively low, this is a credit card account we're talking about. If someone happens to be using this website on an unprotected or shared wifi, their credit card information could easily be abused. So yes, I'd say it's a very legitimate concern and you should notify them about this. Depending on the country, I can imagine a victim could sue them for neglect or something along those lines.
Jan
10
revised Can ISPs log IP connections?
added 184 characters in body
Jan
10
answered Can ISPs log IP connections?
Jan
9
comment Can ISPs log IP connections?
Replaced "Let's say I want to go to google.com, can my ISP see it in logs?" with "Let's say I went to google.com, can my ISP see it in logs?". This is not thoughtcrime we're talking about ;)
Jan
9
revised Can ISPs log IP connections?
Fixed typos, added dns tag
Jan
7
comment Email instead of username
@MartinBrown Good morning mister edge-case ;). I'm pretty sure noone elses uses my handle 'lucb1e'. If it's not available somewhere, it's more likely someone is trying to impersonate me than anything else. (Or I simply had an account already.) So far at least I've never had collisions, and it's been quite a few years of registering anywhere from Twitter to Gmail to, well, anywhere.
Jan
5
reviewed Close Is my information secure when using Private Tunnel?