6,272 reputation
21146
bio website lucb1e.com
location The Netherlands
age
visits member for 2 years, 1 month
seen 12 hours ago

Software Engineering student. Also interested in computer networking and security. For contact info, see lucb1e.com/!about


Mar
5
reviewed Approve suggested edit on What risks do Cookieless sessions have? What are the mitigations?
Mar
3
reviewed Approve suggested edit on What is the most hardened set of options for GCC compiling C/C++?
Mar
3
reviewed Approve suggested edit on Bypass va_randomize_space and stack-protector
Mar
1
reviewed Approve suggested edit on Data protection laws and regulation for storing IP addresses for registered users
Feb
28
reviewed Approve suggested edit on How can I Hide my Public IP Address
Feb
26
reviewed Approve suggested edit on Documentation on Meterpreter Shells
Feb
23
comment How to encrypt more than 16 bytes using AES?
Short answer: see this Wikipedia article: en.wikipedia.org/wiki/Block_cipher_mode_of_operation
Feb
22
comment Is using SHA-512 for storing passwords tolerable?
He didn't actually ask about upgrading from SHA-1 to SHA-2, so I'm not sure what point you're making here. He seems to understand pbkdf2/bcrypt/etc should be used, he just asks whether sha512+salt is okay enough to pass the audit.
Feb
22
reviewed Approve suggested edit on Generating an unguesable token for confirmation e-mails
Feb
20
reviewed Approve suggested edit on Is it appropriate to use haveged as a source of entropy on virtual machines?
Feb
19
reviewed Reject suggested edit on Emails are forwarded to wrong addresses and possible hacking?
Feb
15
comment Appropriate way to encrypt passwords/financial info?
@Samuel Okay I see, thanks for the reply :)
Feb
15
comment Can someone steal money from my bank account if they know my IBAN and personal details?
And signatures are of course copy-proof because they vanish when you try to photocopy them... So yeah, they practically allow anyone to withdraw money.
Feb
15
revised Should IBAN and bank details be considered private data and encrypted?
edited title
Feb
15
comment Should IBAN and bank details be considered private data and encrypted?
"private data"? Definitely. Encrypt it? Now there's a question.
Feb
15
comment Appropriate way to encrypt passwords/financial info?
@Samuel I'm only vaguely familiar with keepass. How is entering a master password into keepass any different from truecrypt and gpg?
Feb
13
revised How to calculate CVSS of an attack so that it matches those in CVEs?
Question is about cvss, not assigning a cve number or something. Edited title to reflect that and added tag.
Feb
8
comment Bad practice to have a “god” password?
@Polynomial Or better yet, not use an admin user but give the support people permissions to do this. That way logs can be kept that show who did what instead of "Administrator changed X's DNS records as per faxed request." Edit: Oh it seems this is mentioned in answers already.
Feb
8
comment What chars should I not allow in passwords?
I'm sorry for the downvote, but there is a reason for it: issues in the underlying programming language are never a reason to prohibit characters from being used. This is what mysql_real_escape_string, or better, parameterized queries are for. User data should never ever ever be interpreted as being executable code regardless, if this happens you'll have much bigger problems than just password storage. Asterisks, question marks, percentage signs and backslashes are perfectly fine characters that I use and want to continue using in my passwords. Besides, didn't we hash them before storage?
Feb
8
comment What chars should I not allow in passwords?
@this.josh Minimum length of 17? Alright here's an md5sum of an 8-character letters-only password: 124c6ffa6d57c5909e7a403293aed173. Generated using echo -n secret | md5sum. Since this is less than the square root of the strength you said is the "minimum" more than 2 years ago, I expect it must be no problem to crack on a commodity gpu (using hashcat or barswf or something). Good luck. (Honestly I think it's doable, but md5 shouldn't be used for password storage anyway. Still, I wonder if anyone can figure it out.)