6,527 reputation
21147
bio website lucb1e.com
location The Netherlands
age
visits member for 2 years, 3 months
seen 44 mins ago

Software Engineering student. Also interested in computer networking and security. For contact info, see lucb1e.com/!about


1d
comment A future heartbleed bug?
I've been noticing a bunch of certificate updates on Google, Twitter and other websites too. In all cases it changed, if I remember correctly, the MD5 fingerprint to undefined or something. Seems to be related to the recent discussion about accepted hashing methods for certificates in 2015.
Sep
13
comment Is my custom password hashing algorithm insecure?
It's better than nothing (kudos for at least thinking about the problem), but in general pbkdf2/bcrypt/scrypt with decent settings is always better than something you came up with yourself.
Sep
8
comment Is the HMAC weakened if a part of the message is part the key?
TL;DR: No but it's useless. Just leave the message out of the key.
Sep
1
comment Encrypting a huffman encoded file
Encrypt the whole file. The contents do not matter and you want to leak as little info to an attacker as possible. In fact I wouldn't be surprised if you could figure out the file's contents under the right circumstances when leaving the header exposed. I cannot think of a single advantage to leaving anything exposed. For encryption, use something like GCM (galois/counter mode), or if that's unavailable try for AES-256-CTR, or AES-256-CBC. Tip: use a library. (Yeah this comment might be good enough for an answer, but it's just jotting down thoughts.)
Aug
21
comment Hackers attack against wp-config.php
@JaneBrye in that case I think someone might be abusing your hosting account for spam or DDoS attacks or something. Without more details I can't really say anything, but one way to stop it is change hosting and do a fresh Wordpress install. Or have someone look at it.. perhaps the hosting company can look through logs? It's in their interest not to end up on blacklists.
Aug
21
comment What sensitive information can be leaked in a Vim's swap file?
Hmm, good point. I edit stuff on a live website with vim, but never thought about the swp files that might leak parts of the content... The odds are low that someone will try whether the swp file is present right at the moment when I'm editing, but it's a good point nevertheless.
Aug
21
comment how to wipe RAM in Windows 7
"(hardcore overclocker, perhaps?)" Or the FBI ;)
Aug
21
comment Should expired compromised certificates be taken care of if the time is always correct?
"It's your server that should check the validity of the certificate not the web client." I think this is the most important remark here. The server is something you control and which usually has a somewhat-correct time (not off by weeks at least).
Aug
13
comment Can my workplace view my Tor traffic?
"just connecting to the network" won't allow them to run code on your computer. That's what we call an RCE and is considered a security vulnerability if software allows it. Sysadmins can only run scripts on Windows remotely because the system was connected to the active directory by an administrator earlier; you can't just run code on anyone connected to your WiFi network. That would be, well, either lots of fun or hell, depending on which end you're on.
Aug
13
comment Can my workplace view my Tor traffic?
@Taemyr "If only suspicious activity is private, privacy becomes suspicious."
Aug
12
comment What Twitter #hashtags apply to IT Security
I would personally go with #infosec instead, much shorter (stupid twitter character limit) and everyone in the industry knows it.
Aug
9
comment How to prevent BadUSB attacks on linux desktop
@user53541 tried to comment but can't due to reputation limit so he had to resort to editing to talk to us. Rejected edit, but adding comment for him: "It can't work to authorize device using interface class number, the interface device will not be created if the device is not authorized."
Jul
20
comment Is “the oft-cited XKCD scheme […] no longer good advice”?
TL;DR use a password manager?
Jul
19
comment What defines a programming language as useful for hacking?
Bash is a scripting language, but what you are describing here is more stringing tools together than actual scripting.
Jul
19
comment How can my employer be a man-in-the-middle when I connect to Gmail?
"certificate 028CA85E6765" Yeah I thought the same. Trouble is, Google uses dozens of certificates. Why they go through the trouble of having many certificates at the same time even if most of them are nowhere near expiring is a mystery to me, but they do. I think the best thing to do is compare fingerprints from the CA.
Jul
19
comment How can my employer be a man-in-the-middle when I connect to Gmail?
Exactly. So eventually the question is: who sold you your private laptop and why are you running a preinstalled Windows containing who knows what? Somewhere you have a root of trust :) (And talking about trust roots, did anyone mention CAs? :D)
Jul
17
comment Better techniques than url parameter encryption
Something sounds very wrong when you say RBAC is not an option.
Jun
13
comment Is there any reason someone wouldn't use a longer key?
That text sounds pretty good to include in your answer ;) Afraid I can't give you a second upvote though :(
Jun
13
comment Expiring AES Key
Well if you can modify the file, you can also delete it or change the key it's encrypted with. That would work of course. Other than that... well I guess I'll let others answer, but I'm not aware of any such technique.
Jun
13
comment Is there any reason someone wouldn't use a longer key?
+1 for being the only one to mention elliptic curves. What I've always wondered though: is ECC also faster than RSA when using a key with roughly the same strength (e.g. 2048-bits RSA and 224-bits ECC)?