5,692 reputation
21044
bio website lucb1e.com
location The Netherlands
age
visits member for 1 year, 9 months
seen 1 hour ago

Software Engineering student. Also interested in computer networking and security. For contact info, see lucb1e.com/!about


May
21
reviewed Leave Open Considerations for information exchange agreement between governmental agencies
May
19
comment Known plaintext; What cipher is being used here?
For all we know, it could be a one-time pad. A good cipher should produce output indistinguishable from random data, so if it's something good, we don't have any way of telling what this is. The only real clue you gave is the default output format that it uses (or I guess that's what it's formatted in) and that input and output are the same length (which still can be almost anything).
May
17
reviewed Leave Open Does escaping quotes protect me from SQL injection?
May
17
awarded  Announcer
May
17
comment Touch Screen Password Guessing by Fingerprint Trace
I have seen this as well, it's rather common!
May
17
comment Touch Screen Password Guessing by Fingerprint Trace
@RoryAlsop Same here. I can't recite many passwords, or even recognize them from sight. Muscle memory all the way. Seeing them for the first time is like "Oh so that's what kept my account safe over the past months... wait quickly get it off the screen before I remember it!"
May
16
comment Touch Screen Password Guessing by Fingerprint Trace
"90 percent", that's worrying. And interesting: it also means that most people's patterns are probably not very complex and thus bruteforceable.
May
15
comment Tools to extract code comments from sites?
@D3C4FF English is part of the Burp Suite. Edit: ok not the smartest response. What I really mean is that something being part of a security suite doesn't make any random subject related to security when it should, in my opinion, be a SO or SU question.
May
15
comment Tools to extract code comments from sites?
I think it's not very security related. Your intended purpose maybe, but extracting comments in itself would be a stackoverflow question (or perhaps a superuser one, but I don't think it takes an entire tool as Adnan showed with his regex).
May
12
comment Pronounceable Password Generator
@SimonLehmann Very true, hadn't thought of that. Indeed the meaning of a word can make one remember synonyms instead... I personally use random passwords, but a password's strength is really in their length so I should switch.
May
8
comment Should I enforce a password policy on a web site?
Especially have a reasonable policy. Anything over 5 characters would be enough in my opinion. If you use the password abcde, that's your own stupid problem when my database gets hacked. I'll implement ratelimiting for login attempts so that you can't hack my service by trying for weak passwords. But I should be able to choose ^[ -~]$ as password which contains neither digits nor lowercase nor uppercase. I think it's stronger than the average "s3cur3pa$$word".
May
8
reviewed Leave Open Android soft keyboard architecture
May
8
revised Does escaping quotes protect me from SQL injection?
Please use example.com as the example domain
May
8
reviewed Leave Open Does escaping quotes protect me from SQL injection?
May
8
awarded  Announcer
May
7
comment Filtering In Iran
@Adnan But proxies wouldn't get them arrested?
May
7
revised How to encrypt data on the server?
Fixed formatting and some sentences; added linux tag
May
7
comment VCS to manipulate returned trees to prevent leaks?
@John "Nobody wants to lose their house in a lawsuit ;)" And then how exactly do you track down who leaked the code and needs to loose their house? That's what this question is about.
May
7
reviewed Leave Open VCS to manipulate returned trees to prevent leaks?
May
2
comment How proxy servers sniff data
Could you elaborate on what happens when a rogue CA is installed by the sysadmins? For example do EV certificates still show as EV, and is it always possible to see the rogue CA on top of the certification path? There is a rogue CA here, but they don't seem to be using it right now (I make sure the EV cert shows whenever I log in).