6,392 reputation
21147
bio website lucb1e.com
location The Netherlands
age
visits member for 2 years, 2 months
seen 7 hours ago

Software Engineering student. Also interested in computer networking and security. For contact info, see lucb1e.com/!about


Oct
12
comment How can I be secure with a global salt?
@jpkrohling "unsalted passwords can be easily attacked with rainbow tables". Well would you want to generate a rainbow table where each hash takes 0.1s (after which you still need to run it against the user database), or crack the salted passwords (without rainbow table) which take only 0.001s per hash per user? So yeah, I meant storing it in the same table.
Oct
9
answered How can I be secure with a global salt?
Oct
9
comment How to get the output of a SQL injection?
"This is just for learning purpose." That's what they all say ;)
Oct
4
comment Torception: An onion within an onion
Ask on #tor at irc.oftc.net. You'll be told it's a bad idea and they're actually looking into disabling this in later versions.
Sep
29
awarded  Announcer
Sep
26
comment Where does StartSSL generate the cerificate, server or client-side?
Good answer, thanks! I've always wondered whether a CSR would be better than having them generate a private key, but I've always been too lazy to actually look it up (and then figure out how to). From now on I'll always use CSRs.
Sep
24
comment Hotspot with same SSID, how does authorization work?
"it also has a MAC address" This isn't always checked. I think Symbian did, Android 4.1 doesn't seem to. Wouldn't this cause problems with multiple APs from one network? I'm sure Android and Windows handle this right, so I'd guess the MAC is not checked for that reason. "I expect most WiFi/PEAP clients to record the certificate sent by the AP upon the first connection" I'd expect that too, but I'm not sure. I couldn't easily find an answer to this on google. Linux Mint asks whether to accept the self-signed certificate, Windows and Android don't.
Sep
24
revised Hotspot with same SSID, how does authorization work?
edited tags
Sep
12
accepted Is there any risk in allowing more more failed login attempts before autobanning for a longer time?
Sep
11
comment Verify a user's affiliation with an organization
I've seen plenty of actions that had a code that a user needed to enter on the website. Tell them it's an "invite code" to the event? Well the case is solved so I guess it doesn't matter anymore now, I just don't see why users wouldn't understand it.
Sep
10
comment Verify a user's affiliation with an organization
@derabbink Who said they need a username anyway ;). The codes are random and unique for everyone.
Sep
10
answered Verify a user's affiliation with an organization
Sep
10
comment Verify a user's affiliation with an organization
Use another TicketSellingCorp. They clearly have no clue about security and no interest in protecting your users.
Sep
9
accepted Why is RFC4255 (SSHFP) not used for https?
Sep
7
asked Is there any risk in allowing more more failed login attempts before autobanning for a longer time?
Sep
2
comment Does using Google DNS make extensions like AdBlock Plus useless?
Third point: Just get rid of annoying ads. I don't really care that much about speeding up browsing or avoiding user tracking. Well I do care, but I don't have AdBlock Plus for that purpose.
Sep
1
revised IMG tag vulnerability
Corrected a mistake
Aug
27
comment Why is RFC4255 (SSHFP) not used for https?
Thanks for the elaborate answer! "The current CA system works." I agree, but then why are we implementing totally useless (unauthenticated) encryption into http2.0? According to the IETF (and I agree with this part), because we need to make deployment easier. Admins don't feel like spending money on or even ordering a certificate when it's not really required. But since you named no real vulnerabilities in this scheme, I guess cert fingerprints in DNS could be part of http2.0 to make the encryption have any use beyond obscurity. Perhaps no padlock, but at least it'd be worth something.
Aug
27
asked Why is RFC4255 (SSHFP) not used for https?
Aug
26
comment How to attract hackers?
Just say "this is unhackable" and post it on hackernews. No more needs be done, you don't even need to offer prize money or anything ;)