5,692 reputation
21044
bio website lucb1e.com
location The Netherlands
age
visits member for 1 year, 9 months
seen 9 hours ago

Software Engineering student. Also interested in computer networking and security. For contact info, see lucb1e.com/!about


Sep
22
suggested suggested edit on How to create ssh tunnel using netcat?
Sep
22
comment How to create ssh tunnel using netcat?
@nothankyou Binding to a port <1024 I guess.
Sep
22
comment How have DNS recursion attacks happened?
Wait, do you mean DNS cache poisoning?
Sep
21
comment Why shouldn't we roll our own?
The biggest problem I notice among beginning coders, is that they don't take security risks seriously. If I mention what kind of weaknesses some system has, the common response is rolling their eyes... The attacks are real and do happen, and if you can't even apply proper security at school then how's your application supposed to fare when it's live for hundreds of customers? :/ The only way to convince them is usually providing examples, and best of all a live demo. So if you have examples... I think it'd be a nice addition!
Sep
17
comment Securing the hardware of my computer against remote exploits
So how we protect ourselves against this? That's the real question @linux1 asked.
Sep
17
comment Is there a term for a “Master + extension” style password scheme?
Yes, so to generate a password to login anywhere you need some PBDKF2 tool.
Sep
16
comment Securing the hardware of my computer against remote exploits
"lots of ways to exploit a computer besides at the OS level" Source? I heard of a few attacks, but they are very rare in comparison. Also I don't think you can really ask "how do we go about protecting this", it really depends on the case.
Sep
16
comment Is AES slower to encrypt than MD5?
@ktothez I think there should be a couple quick questions when signing up, one of them being whether MD5 is an encryption algorithm.
Sep
14
comment Is there a term for a “Master + extension” style password scheme?
Checking your mail somewhere on a system that is not yours will become very hard. You probably don't remember that hash of over 30 characters long... And having to use some site to obtain the other site's password doesn't sound recommendable either.
Sep
14
comment Is there a term for a “Master + extension” style password scheme?
I'm not sure how good it is to do this though. Once someone finds two passwords, he can be almost certain what the base password is, which makes further cracking that much easier. But yeah, what are the odds... Just don't do it when working for the CIA I guess :)
Sep
14
comment XSS : Blacklist characters vs. whitelist
@tdammers I see what you mean. What I meant was that you escape them for the database with functions like mysql_real_escape_string, so you do actually escape them. Then when outputting to a client you escape them again with htmlspecialchars or something. But yeah my wording might be misleading. The post got no upvotes though, I guess it's a bit offtopic, but feel free to edit if you think it should be changed anyway.
Sep
14
comment XSS : Blacklist characters vs. whitelist
@tdammers No, you're not storing it as escaped data. You're transferring it as such. This prevents SQL injections, XSS attacks, and probably more in other languages.
Sep
14
comment How can I tell if I've been hacked?
That's kind of a broad question. Do you mean your desktop, server, webapplication, ftp server, ...?
Sep
14
revised XSS : Blacklist characters vs. whitelist
edited tags
Sep
14
comment XSS : Blacklist characters vs. whitelist
@curiousguy Oh, I didn't know vrfy, neat.
Sep
13
comment Is this a good way to store passwords in a Web Application?
Looks pretty okay to me.
Sep
13
answered XSS : Blacklist characters vs. whitelist
Sep
13
comment Giving merchant account information to web programmer
Well it seems normal that you need some sort of priviliges to setup a system, but why the processor name... Looks like pretexting to me, but that's probably too far-fetched
Sep
10
comment How does a client authenticate the domain controller
"Kerberos" comes to mind, but not sure if that's it.
Sep
10
comment Why are CSRF tokens necessary?
@Gumbo I know CSRF is no replay attack, but using a nonce prevents both at once.