7,656 reputation
21250
bio website lucb1e.com
location The Netherlands
age
visits member for 2 years, 6 months
seen Dec 25 at 22:20

Software Engineering student. Also interested in computer networking and security. For contact info, see lucb1e.com/!about


Feb
15
comment Can someone steal money from my bank account if they know my IBAN and personal details?
And signatures are of course copy-proof because they vanish when you try to photocopy them... So yeah, they practically allow anyone to withdraw money.
Feb
15
revised Should IBAN and bank details be considered private data and encrypted?
edited title
Feb
15
comment Should IBAN and bank details be considered private data and encrypted?
"private data"? Definitely. Encrypt it? Now there's a question.
Feb
15
comment Appropriate way to encrypt passwords/financial info?
@Samuel I'm only vaguely familiar with keepass. How is entering a master password into keepass any different from truecrypt and gpg?
Feb
13
revised How to calculate CVSS of an attack so that it matches those in CVEs?
Question is about cvss, not assigning a cve number or something. Edited title to reflect that and added tag.
Feb
8
comment Bad practice to have a “god” password?
@Polynomial Or better yet, not use an admin user but give the support people permissions to do this. That way logs can be kept that show who did what instead of "Administrator changed X's DNS records as per faxed request." Edit: Oh it seems this is mentioned in answers already.
Feb
8
comment What chars should I not allow in passwords?
I'm sorry for the downvote, but there is a reason for it: issues in the underlying programming language are never a reason to prohibit characters from being used. This is what mysql_real_escape_string, or better, parameterized queries are for. User data should never ever ever be interpreted as being executable code regardless, if this happens you'll have much bigger problems than just password storage. Asterisks, question marks, percentage signs and backslashes are perfectly fine characters that I use and want to continue using in my passwords. Besides, didn't we hash them before storage?
Feb
8
comment What chars should I not allow in passwords?
@this.josh Minimum length of 17? Alright here's an md5sum of an 8-character letters-only password: 124c6ffa6d57c5909e7a403293aed173. Generated using echo -n secret | md5sum. Since this is less than the square root of the strength you said is the "minimum" more than 2 years ago, I expect it must be no problem to crack on a commodity gpu (using hashcat or barswf or something). Good luck. (Honestly I think it's doable, but md5 shouldn't be used for password storage anyway. Still, I wonder if anyone can figure it out.)
Feb
8
comment What chars should I not allow in passwords?
Why avoid spaces? Perhaps str.replace them out if you think it may cause compatibility problems anywhere, but being unable to make decent passphrases really bothers me. Nobody has spaces in passwords, which is exactly why I use them very frequently.
Feb
6
comment If I use a good Master Password in Firefox, is security improved when I Remember Passwords instead of re-type?
Short answer: I'd say it's mostly for ease of use, and it enables you to use much more unique passwords since you don't need to remember all passwords (be sure to backup Firefox' password database though!). I'd recommend using the master password and storing most passwords (not your bank login perhaps, but most sites should be no problem).
Feb
5
reviewed Approve How can I detect backdoors?
Feb
3
comment Downloading through Tor or not Tor?
@gowenfawr I disagree. If I merely said it's illegal, then then logical response is "but so is downloading child porn for research". I elaborated on my reasoning on purpose: illegal things are not always bad in the sense that they may still serve the common good. And misuse of Tor for filesharing really does use a load of cpu and bandwidth. I tried to host a Tor node myself, but my server can only handle a trickle of data because of CPU limitations (Intel Atom platform). If lots of people use Tor for such non-essentials, it clogs up that much more capacity.
Feb
3
answered Downloading through Tor or not Tor?
Feb
3
comment Does including the username in a password make it less secure?
One bit of entropy still doubles the number of possibilities. Upon a database hack, it will take (on average and all else equal) 1.5 times longer to crack your password than it would without appending/prepending your username. It also works as a sort of salt, which would have been useful in Adobe's recent case (encrypted password database hack). But I don't downvote because in principle you're right: it's not that useful, and not everyone would know if there is some sort of vulnerability in it (not everyone knows how hashing works), so better don't do it if you don't know the result.
Jan
25
reviewed Approve Escaping rich text editor output
Jan
21
comment Basic Security Knowledge
First of all, I upvoted because you clearly put some thought into this post and the questions are indeed good starting points for beginners. However I'm not sure this is a good place to ask them: the answers would vary a lot and would mostly be rather long because it are broad subjects. I think an ideal answer might be a short book actually. If you still want to go ahead with making this beginner's FAQ, you could google around for answers and ask more specific questions on this site. I think those would generate some great answers, the amount of thought you put into questions seems good ;)
Jan
21
comment In Tor, what stops the end server from following the breadcrumbs back to their origin?
The answer to your question is yes, they can. But the data is there only as long as the connection is open. You'd have to knock on two people's doors and hope they both respond within a matter of hours, ifnot minutes. You can consider yourself lucky if they're even on the same continent. The Tor project exists for a while now and though there have been some high profile people using it, I never heard of this happening.
Jan
18
comment Is it possible to increase the cost of BCrypt or PBKDF2 when its already calculated and without the original password?
Let's say we have a function bcrypt(pwd, rounds). We store passwords as bcrypt(pwd, 1000). You are saying that an attacker can calculate bcrypt(pwd, 1) for any bcrypt(pwd, 1000), and then crack them with an iteration count of 1. Do you realize that once the attacker did the conversion for bcrypt(*, 1000) to bcrypt(*, 1), he already has the plaintext? The point of adding iterations is that they take time, and the point of a PRF in password hashing functions is that it is not reversible.
Jan
18
comment Could once infected machine be ever trusted again?
Upvote for the principle idea of labeling it as "cleaned up" instead of "trusted" after infection, but I wouldn't just run a virus scanner. A complete wipe of the harddrive is required, and depending on the circumstances you may want to flash the harddrive's, motherboard's and other firmware (or replace certain parts with new parts). This is not required after your little brother got a virus from illegal software, but it might be when the CIA discovers an infection in their systems.
Jan
18
awarded  Good Answer