6,432 reputation
21147
bio website lucb1e.com
location The Netherlands
age
visits member for 2 years, 2 months
seen 12 hours ago

Software Engineering student. Also interested in computer networking and security. For contact info, see lucb1e.com/!about


Mar
18
comment How safe is SSL?
TL;DR: yes it is all encrypted and secure. Even if it wasn't, there is nothing you can do about it. Adding hashing via javascript adds no security to https.
Mar
18
revised How safe is SSL?
Removed unnecessary markup, fixed typos
Mar
17
comment Why warning sign when visiting https-website?
It's a lengthy piece, but the answer is in here: security.stackexchange.com/a/20833/10863. Under the section "How to crack SSL," subsection "in detail," paragraph 2, it is explained what causes this warning sign.
Mar
13
reviewed Approve suggested edit on Would using Google reCAPTCHA allow Google to cheat?
Mar
12
comment Why am I allowed to access protected Windows files when I boot Ubuntu from USB?
@Emmet Yeah, very clever.
Mar
11
comment Is this where a nonce comes into play?
@user3379785 Note that comments aren't really meant for chatty back-and-forth stuff. The chat is usually recommended instead, but for some reason you need 20 reputation point to participate in the chat... If you have more questions on this topic you could email me or something. See https://lucb1e.com/!about for contact details. If you have a more general question (something that would be of use to others), you can always start a new question on this site.
Mar
11
comment Is this where a nonce comes into play?
@user3379785 The crux of the problem is that the GUID is both the unique way of referring to an account and it provides full access. So as long as the GUID can be used instead of username+password, I think the design could be improved (even if it's not directly broken, like I said in the post). You say the GUID is checked before API calls, but how is it checked? You mean the server checks whether the GUID matches the session's owner? So the GUID is not enough, you now also need to send the session id with API requests to control an account? In that case I think it's much more solid now :)
Mar
11
awarded  Nice Answer
Mar
10
comment Is this where a nonce comes into play?
@user3379785 It could be, but it's probably much more practical to generate it only once and put it in a database column. Or generate it upon logging in and put it in a session file (or session table). Depends on the implementation.
Mar
10
revised Is this where a nonce comes into play?
added 83 characters in body
Mar
10
answered Is this where a nonce comes into play?
Mar
10
revised Why am I allowed to access protected Windows files when I boot Ubuntu from USB?
Fixed a broken sentence and added a little bit of info
Mar
9
answered Why am I allowed to access protected Windows files when I boot Ubuntu from USB?
Mar
9
reviewed Reject suggested edit on Is Adblock (Plus) a security risk?
Mar
7
reviewed Approve suggested edit on Does it make any sense to alter a hashed password?
Mar
5
reviewed Approve suggested edit on Is it worth it to get paid anti-virus software?
Mar
5
reviewed Approve suggested edit on What risks do Cookieless sessions have? What are the mitigations?
Mar
3
reviewed Approve suggested edit on What is the most hardened set of options for GCC compiling C/C++?
Mar
3
reviewed Approve suggested edit on Bypass va_randomize_space and stack-protector
Mar
1
reviewed Approve suggested edit on Data protection laws and regulation for storing IP addresses for registered users