8,099 reputation
21253
bio website lucb1e.com
location The Netherlands
age
visits member for 2 years, 9 months
seen yesterday

Software Engineering student. Also interested in computer networking and security. For contact info, see lucb1e.com/!about


Mar
3
reviewed Approve What is the most hardened set of options for GCC compiling C/C++?
Mar
3
reviewed Approve Bypass va_randomize_space and stack-protector
Mar
1
reviewed Approve Data protection laws and regulation for storing IP addresses for registered users
Feb
28
reviewed Approve How can I Hide my Public IP Address
Feb
26
reviewed Approve Documentation on Meterpreter Shells
Feb
23
comment How to encrypt more than 16 bytes using AES?
Short answer: see this Wikipedia article: en.wikipedia.org/wiki/Block_cipher_mode_of_operation
Feb
22
comment Is using SHA-512 for storing passwords tolerable?
He didn't actually ask about upgrading from SHA-1 to SHA-2, so I'm not sure what point you're making here. He seems to understand pbkdf2/bcrypt/etc should be used, he just asks whether sha512+salt is okay enough to pass the audit.
Feb
22
reviewed Approve Generating an unguesable token for confirmation e-mails
Feb
20
reviewed Approve Is it appropriate to use haveged as a source of entropy on virtual machines?
Feb
19
reviewed Reject Emails are forwarded to wrong addresses and possible hacking?
Feb
15
comment Appropriate way to encrypt passwords/financial info?
@Samuel Okay I see, thanks for the reply :)
Feb
15
comment Can someone steal money from my bank account if they know my IBAN and personal details?
And signatures are of course copy-proof because they vanish when you try to photocopy them... So yeah, they practically allow anyone to withdraw money.
Feb
15
revised Should IBAN and bank details be considered private data and encrypted?
edited title
Feb
15
comment Should IBAN and bank details be considered private data and encrypted?
"private data"? Definitely. Encrypt it? Now there's a question.
Feb
15
comment Appropriate way to encrypt passwords/financial info?
@Samuel I'm only vaguely familiar with keepass. How is entering a master password into keepass any different from truecrypt and gpg?
Feb
13
revised How to calculate CVSS of an attack so that it matches those in CVEs?
Question is about cvss, not assigning a cve number or something. Edited title to reflect that and added tag.
Feb
8
comment Bad practice to have a “god” password?
@Polynomial Or better yet, not use an admin user but give the support people permissions to do this. That way logs can be kept that show who did what instead of "Administrator changed X's DNS records as per faxed request." Edit: Oh it seems this is mentioned in answers already.
Feb
8
comment What chars should I not allow in passwords?
I'm sorry for the downvote, but there is a reason for it: issues in the underlying programming language are never a reason to prohibit characters from being used. This is what mysql_real_escape_string, or better, parameterized queries are for. User data should never ever ever be interpreted as being executable code regardless, if this happens you'll have much bigger problems than just password storage. Asterisks, question marks, percentage signs and backslashes are perfectly fine characters that I use and want to continue using in my passwords. Besides, didn't we hash them before storage?
Feb
8
comment What chars should I not allow in passwords?
@this.josh Minimum length of 17? Alright here's an md5sum of an 8-character letters-only password: 124c6ffa6d57c5909e7a403293aed173. Generated using echo -n secret | md5sum. Since this is less than the square root of the strength you said is the "minimum" more than 2 years ago, I expect it must be no problem to crack on a commodity gpu (using hashcat or barswf or something). Good luck. (Honestly I think it's doable, but md5 shouldn't be used for password storage anyway. Still, I wonder if anyone can figure it out.)
Feb
8
comment What chars should I not allow in passwords?
Why avoid spaces? Perhaps str.replace them out if you think it may cause compatibility problems anywhere, but being unable to make decent passphrases really bothers me. Nobody has spaces in passwords, which is exactly why I use them very frequently.