6,292 reputation
21146
bio website lucb1e.com
location The Netherlands
age
visits member for 2 years, 1 month
seen 7 hours ago

Software Engineering student. Also interested in computer networking and security. For contact info, see lucb1e.com/!about


Nov
1
comment Who is responsible for the strength of user's passwords?
Interesting suggestion about the forced-password-change policy, but I wonder if it would really work to make things more secure or if it just creates more problems. People might choose especially weak passwords such as the week's number, or use a secure one and write it down, to name two things off the top of my head.
Nov
1
comment Who is responsible for the strength of user's passwords?
With that kind of logic I could blame the state for driving against a tree. Who put that tree there! Who put that road so close to the tree! Also your answer is rather short and subjective.
Oct
31
awarded  Nice Answer
Oct
30
revised Parabolic Denial Of Service — Would it work?
0.0.0.0 is a network and not an unicast address, thought this would be clearer
Oct
30
revised Limited JavaScript app scenario: Attack vectors and mitigation
added 298 characters in body
Oct
30
answered Limited JavaScript app scenario: Attack vectors and mitigation
Oct
30
comment How does syskey in Windows increase the security in a domain?
@GrahamHill Encrypting it with a decent password in winrar, whynot?
Oct
29
revised CSRF Protection on static pages
added 46 characters in body
Oct
29
answered CSRF Protection on static pages
Oct
25
comment Good Practices to secure FTP access
@MahbuburRAaman As you've pointed out yourself, FTP can be secured.
Oct
25
revised Good Practices to secure FTP access
Expanded with "the problem with standard ftp" and "about the measures you've taken so far".
Oct
25
answered Good Practices to secure FTP access
Oct
25
comment Why is this certificate valid for so many domains?
@jdoe Because that requires SNI, and is a rather long story. This answer on Serverfault explained it for me. If that's still not clear, let me know! Edit: And also, from a security perspective, the server would still need to know all those certificates (or at least a number of them). If you can grab one, you can probably grab all private keys stored there.
Oct
24
awarded  Civic Duty
Oct
24
comment What is the problem with chain hashing?
@acidzombie24 Because a salt is complementary to iterating hashing (or chaining). You shouldn't do either one or the other, you should do both. Or best of all, you don't mess around with security but use something proven like bcrypt or PBKDF2.
Oct
24
comment Are there really functioning quantum computers?
+1 Very short, but nailed exactly what I wanted to know when reading the question title ^^
Oct
23
comment Why is this certificate valid for so many domains?
They aren't sharing their own key, we hope anyway, but if you can inject scripts you own the page.
Oct
23
answered Why is this certificate valid for so many domains?
Oct
23
comment Why is this certificate valid for so many domains?
To save others some time, a screenshot: g2f.nl/0fsu03z.png (45kb)
Oct
23
comment What's the impact of disclosing the front-face of a credit or debit card?
At least good for some social engineering