7,186 reputation
21250
bio website lucb1e.com
location The Netherlands
age
visits member for 2 years, 4 months
seen 6 hours ago

Software Engineering student. Also interested in computer networking and security. For contact info, see lucb1e.com/!about


1d
comment One liner to create passwords in linux?
Base64 has 64 possible characters while there are in fact 95 printable characters. Would not recommend.
1d
comment One liner to create passwords in linux?
I would not use this answer because any hash-sum (md5sum, sha256sum, ...) outputs hexadecimals. They contain only 4 bits of randomness per byte while being just as hard to remember as any same-cased alphanumeric string. There are lots of packages and other ways to do this properly, even if you only use tools that are available on almost every Unix-like OS.
2d
comment is there a risk in increasing esmtp header line length against rfc5822 - asa/pix question
Well, if I was sure about an answer I would post it :). But if you test with longer headers to make sure it doesn't crash anything, it is probably okay, at least until you find out more.
2d
comment is there a risk in increasing esmtp header line length against rfc5822 - asa/pix question
How about increasing the limit instead of removing it? I could imagine that a multi-gigabyte header might crash things, so setting a reasonable limit (at least for the moment) might be a good idea.
Oct
19
comment How to use Intel Ivy Bridge's RNG?
"My [CPU] does not provide a RNG flag" there is an RdRand flag, though.
Oct
15
comment Password recovery flow - Send Password recovery to any email?
So entering a non-registered email address would create an account for them automatically? It's sort of odd and you may want to consider whether users understand what is going on. Also, I could send lots of emails with useless links to people that never signed up for your website. Then again, you can do that with most register forms, but it's something to think about.
Oct
15
comment How does SSL/TLS work?
@MuhammadUmer Wish we'd get something interesting like this at school. We got one lecture with some encryption basics and even there I had to correct the teacher a few times... so that was useless... Keep on googling and never let school interfere with your education :) (Quote from Mark Twain.)
Oct
11
comment Is an 80 bit password good enough for all practical purposes?
@emory Responding to your first comment: good point. We shouldn't blindly trust a service to be perfectly secure. I still think it's okay to slack a little bit and use a weaker password on big services (as long as it's not crackable within 5 minutes with some serious power, probably nobody is going to bother when they got 90 million other passwords to try), but I think your main point is valid.
Oct
10
comment Is an 80 bit password good enough for all practical purposes?
@psusi The first point is probably valid, but I have yet to hear that Moore's law is completely dead. Citation needed, I suppose. About your second argument: when writing the post I doubted to include the phrase "for the same amount of money" but decided to leave it out because it seemed obvious to me. The point is that not everyone has the money to buy four times as much calculation power as they already have. Else why bother inventing faster CPUs when could buy more CPUs instead?
Oct
10
comment Is an 80 bit password good enough for all practical purposes?
@Peter Dice, good one! I knew about diceware, but you're the first person I hear who actually uses it :)
Oct
10
comment Is an 80 bit password good enough for all practical purposes?
@Lighty That's about passphrases vs. passwords and whether XKCD got it right. This question is about the practical strength of an 80-bit password.
Oct
1
comment How to tell if someone else's site is vulnerable to Shellshock without hacking them?
I suspect the downvote is because, though that site may stink of security vulns, this question (title at least) stinks of black hat ;). Reading the question more thoroughly it's probably not the case, but you might want to try to formulate it a bit less like "I see this really old website and want to exploit it" and more like "Someone claims their site to be certified secure, can I prove that it's not (e.g. shellshock?) without really hacking them?"
Sep
28
comment How can I keep Google from tracking me?
@user26832 Oops I meant Portugal. You said Portuguese and I misremembered it for Spanish when writing the comment. But I see that you edited in that you're using a French VPN server (I didn't know that at the time of writing), so the comment is obsolete now.
Sep
28
comment How can I keep Google from tracking me?
Find your IP address (at a site like whatismyip.com) and see if it's your own. If it isn't, then Google probably just redirected you to their Spanish site because the VPN's server is in Spain. If it is, then your VPN is not configured correctly.
Sep
21
comment A future heartbleed bug?
I've been noticing a bunch of certificate updates on Google, Twitter and other websites too. In all cases it changed, if I remember correctly, the MD5 fingerprint to undefined or something. Seems to be related to the recent discussion about accepted hashing methods for certificates in 2015.
Sep
13
comment Is my custom password hashing algorithm insecure?
It's better than nothing (kudos for at least thinking about the problem), but in general pbkdf2/bcrypt/scrypt with decent settings is always better than something you came up with yourself.
Sep
8
comment Is the HMAC weakened if a part of the message is part the key?
TL;DR: No but it's useless. Just leave the message out of the key.
Sep
1
comment Encrypting a huffman encoded file
Encrypt the whole file. The contents do not matter and you want to leak as little info to an attacker as possible. In fact I wouldn't be surprised if you could figure out the file's contents under the right circumstances when leaving the header exposed. I cannot think of a single advantage to leaving anything exposed. For encryption, use something like GCM (galois/counter mode), or if that's unavailable try for AES-256-CTR, or AES-256-CBC. Tip: use a library. (Yeah this comment might be good enough for an answer, but it's just jotting down thoughts.)
Aug
21
comment Hackers attack against wp-config.php
@JaneBrye in that case I think someone might be abusing your hosting account for spam or DDoS attacks or something. Without more details I can't really say anything, but one way to stop it is change hosting and do a fresh Wordpress install. Or have someone look at it.. perhaps the hosting company can look through logs? It's in their interest not to end up on blacklists.
Aug
21
comment What sensitive information can be leaked in a Vim's swap file?
Hmm, good point. I edit stuff on a live website with vim, but never thought about the swp files that might leak parts of the content... The odds are low that someone will try whether the swp file is present right at the moment when I'm editing, but it's a good point nevertheless.