7,147 reputation
21250
bio website lucb1e.com
location The Netherlands
age
visits member for 2 years, 3 months
seen 9 hours ago

Software Engineering student. Also interested in computer networking and security. For contact info, see lucb1e.com/!about


Jan
21
comment In Tor, what stops the end server from following the breadcrumbs back to their origin?
The answer to your question is yes, they can. But the data is there only as long as the connection is open. You'd have to knock on two people's doors and hope they both respond within a matter of hours, ifnot minutes. You can consider yourself lucky if they're even on the same continent. The Tor project exists for a while now and though there have been some high profile people using it, I never heard of this happening.
Jan
18
comment Is it possible to increase the cost of BCrypt or PBKDF2 when its already calculated and without the original password?
Let's say we have a function bcrypt(pwd, rounds). We store passwords as bcrypt(pwd, 1000). You are saying that an attacker can calculate bcrypt(pwd, 1) for any bcrypt(pwd, 1000), and then crack them with an iteration count of 1. Do you realize that once the attacker did the conversion for bcrypt(*, 1000) to bcrypt(*, 1), he already has the plaintext? The point of adding iterations is that they take time, and the point of a PRF in password hashing functions is that it is not reversible.
Jan
18
comment Could once infected machine be ever trusted again?
Upvote for the principle idea of labeling it as "cleaned up" instead of "trusted" after infection, but I wouldn't just run a virus scanner. A complete wipe of the harddrive is required, and depending on the circumstances you may want to flash the harddrive's, motherboard's and other firmware (or replace certain parts with new parts). This is not required after your little brother got a virus from illegal software, but it might be when the CIA discovers an infection in their systems.
Jan
18
awarded  Good Answer
Jan
17
answered Tails like OS for Smartphones
Jan
16
comment Are passwords stored in memory safe?
@Kaii If I had some sort of important job, it might be an option.
Jan
16
reviewed Approve suggested edit on Does critical SubjectAltName IP:x.x.x.x on an SSL client certificate limit where the certificate can be used from?
Jan
15
reviewed Approve suggested edit on Nested encryption for multiple users
Jan
13
comment Can ISPs log IP connections?
@TeunVink Okay, thanks for the follow up. Weird that I heard a different story, or perhaps the ISP is not as benign as they seem (or they have a misconception of what's required, though it seems odd). Well I'm just speculating now. Thanks for the additional info anyway!
Jan
12
comment Can ISPs log IP connections?
@TeunVink For the CIOT database (linking IP to a name and address), sure, and e-mail too, but beyond that I thought they also had to log more. At least the example from this ISP shows that they were required to; they didn't want to log anything because it simply costs money to maintain. That is, if the story I heard is true, and I think so (but I can't elaborate on why I believe the person because that might give too much info about them).
Jan
10
comment Credit card information being sent over HTTP?
Although the risk of the data being caught is relatively low, this is a credit card account we're talking about. If someone happens to be using this website on an unprotected or shared wifi, their credit card information could easily be abused. So yes, I'd say it's a very legitimate concern and you should notify them about this. Depending on the country, I can imagine a victim could sue them for neglect or something along those lines.
Jan
10
revised Can ISPs log IP connections?
added 184 characters in body
Jan
10
answered Can ISPs log IP connections?
Jan
9
comment Can ISPs log IP connections?
Replaced "Let's say I want to go to google.com, can my ISP see it in logs?" with "Let's say I went to google.com, can my ISP see it in logs?". This is not thoughtcrime we're talking about ;)
Jan
9
revised Can ISPs log IP connections?
Fixed typos, added dns tag
Jan
7
comment Email instead of username
@MartinBrown Good morning mister edge-case ;). I'm pretty sure noone elses uses my handle 'lucb1e'. If it's not available somewhere, it's more likely someone is trying to impersonate me than anything else. (Or I simply had an account already.) So far at least I've never had collisions, and it's been quite a few years of registering anywhere from Twitter to Gmail to, well, anywhere.
Jan
5
reviewed Close Is my information secure when using Private Tunnel?
Jan
5
comment Can I trust the details given in Resource Monitor?
Quick additional note: malicious software can always change things like these. It could send false data to any process requesting the process list (such as sysinternals' process explorer, task manager, or the resource manager). There is no way to be 100% sure that what you are looking at is right, if you suspect to have been compromised and the malware may have had admin or system permissions.
Jan
5
reviewed Approve suggested edit on Is exploit researching different from penetration testing
Jan
4
comment Using multiple hash-functions along the line
Use PBKDF2 or something similar. See security.stackexchange.com/q/211/10863. That's all.