meta user
network profile
| bio | website | lucb1e.com |
|---|---|---|
| location | The Netherlands | |
| age | ||
| visits | member for | 10 months |
| seen | 16 hours ago | |
| stats | profile views | 208 |
Application development student. Also interested in computer networking and security. See also: lucb1e.com/!about
|
Oct 25 |
answered | Good Practices to secure FTP access |
|
Oct 25 |
comment |
Why is this certificate valid for so many domains? @jdoe Because that requires SNI, and is a rather long story. This answer on Serverfault explained it for me. If that's still not clear, let me know! Edit: And also, from a security perspective, the server would still need to know all those certificates (or at least a number of them). If you can grab one, you can probably grab all private keys stored there. |
|
Oct 24 |
awarded | Civic Duty |
|
Oct 24 |
comment |
What is the problem with chain hashing? @acidzombie24 Because a salt is complementary to iterating hashing (or chaining). You shouldn't do either one or the other, you should do both. Or best of all, you don't mess around with security but use something proven like bcrypt or PBKDF2. |
|
Oct 24 |
comment |
Are there really functioning quantum computers? +1 Very short, but nailed exactly what I wanted to know when reading the question title ^^ |
|
Oct 23 |
comment |
Why is this certificate valid for so many domains? They aren't sharing their own key, we hope anyway, but if you can inject scripts you own the page. |
|
Oct 23 |
answered | Why is this certificate valid for so many domains? |
|
Oct 23 |
comment |
Why is this certificate valid for so many domains? To save others some time, a screenshot: g2f.nl/0fsu03z.png (45kb) |
|
Oct 23 |
comment |
What's the impact of disclosing the front-face of a credit or debit card? At least good for some social engineering |
|
Oct 22 |
comment |
172.16.33.197, 127.0.0.1 IP addresses in visitor logs Try sending this packet to your server: GET / HTTP/1.1\r\nHost: example.com\r\nX-FORWARDED-FOR: cookies!\r\n\r\n Congrats, you just forged your own IP to 'cookies'! |
|
Oct 20 |
answered | Is truecrypt a good choice to work with file that are generated and manipulated via browser |
|
Oct 19 |
comment |
Is truecrypt a good choice to work with file that are generated and manipulated via browser A bit vague first question. Truecrypt encrypts data with an algorithm you can choose and a password or keyfile you can set. What does a browser have to do with this? Anything transmitted over HTTP can be read and tampered with, I guess you know that. And what do server-side languages have to do with the generation of files in a browser.. and then have something to do with security? |
|
Oct 16 |
awarded | Announcer |
|
Oct 15 |
comment |
Roundcube login only looks at first 8 characters of password entered? I'm quite sure WebFaction is to blame, not RoundCube. |
|
Oct 12 |
comment |
attack/abuse notification email template For a template, I think it's hard to autogenerate the damage that was done. |
|
Oct 12 |
comment |
Manually adding 's' to 'http' It'll show grey https with a yellow warning icon on mixed content. But yeah I guess non-tech people wouldn't know and ask the same question as is asked now. |
|
Oct 12 |
comment |
Manually adding 's' to 'http' Note that you can also get free certificates, purchasing one from a company like Verisign isn't needed to make the certificate trusted. The sysadmin either doesn't know this or doesn't care. |
|
Oct 12 |
revised |
Manually adding 's' to 'http' Partially misunderstood question |
|
Oct 12 |
answered | Manually adding 's' to 'http' |
|
Oct 12 |
awarded | Enlightened |
