7,566 reputation
21250
bio website lucb1e.com
location The Netherlands
age
visits member for 2 years, 5 months
seen yesterday

Software Engineering student. Also interested in computer networking and security. For contact info, see lucb1e.com/!about


Dec
2
comment Is there any technical security reason not to buy the cheapest SSL certificate you can find?
I'm sure this is all technically true, but talking about your self-invented 5 tiers of security does not answer the question. And disclosure would be used when you are a certificate reseller, not when you (like most of the people here I think) got a website with a (hopefully signed) certificate.
Nov
23
comment How do major sites prevent DDoS?
@NewWorld Well google for it, it's not hard to find. One example is PayPal (Ebay-owned) being DDoSed by "Anonymous" not too long ago.
Nov
21
comment How do major sites prevent DDoS?
"Have you?" Yes.
Nov
5
comment Would it be possible to verify ownership of digital currency without a network connection to an authority server?
@AndrewHoffman user10008 is right, Bitcoin is exactly this. It's decentralized and prevents double spending. You should read up on it.
Oct
21
comment One liner to create passwords in linux?
Base64 has 64 possible characters while there are in fact 95 printable characters. Would not recommend.
Oct
21
comment One liner to create passwords in linux?
I would not use this answer because any hash-sum (md5sum, sha256sum, ...) outputs hexadecimals. They contain only 4 bits of randomness per byte while being just as hard to remember as any same-cased alphanumeric string. There are lots of packages and other ways to do this properly, even if you only use tools that are available on almost every Unix-like OS.
Oct
20
comment is there a risk in increasing esmtp header line length against rfc5822 - asa/pix question
Well, if I was sure about an answer I would post it :). But if you test with longer headers to make sure it doesn't crash anything, it is probably okay, at least until you find out more.
Oct
20
comment is there a risk in increasing esmtp header line length against rfc5822 - asa/pix question
How about increasing the limit instead of removing it? I could imagine that a multi-gigabyte header might crash things, so setting a reasonable limit (at least for the moment) might be a good idea.
Oct
15
comment Password recovery flow - Send Password recovery to any email?
So entering a non-registered email address would create an account for them automatically? It's sort of odd and you may want to consider whether users understand what is going on. Also, I could send lots of emails with useless links to people that never signed up for your website. Then again, you can do that with most register forms, but it's something to think about.
Oct
15
comment How does SSL/TLS work?
@MuhammadUmer Wish we'd get something interesting like this at school. We got one lecture with some encryption basics and even there I had to correct the teacher a few times... so that was useless... Keep on googling and never let school interfere with your education :) (Quote from Mark Twain.)
Oct
11
comment Is an 80 bit password good enough for all practical purposes?
@emory Responding to your first comment: good point. We shouldn't blindly trust a service to be perfectly secure. I still think it's okay to slack a little bit and use a weaker password on big services (as long as it's not crackable within 5 minutes with some serious power, probably nobody is going to bother when they got 90 million other passwords to try), but I think your main point is valid.
Oct
10
comment Is an 80 bit password good enough for all practical purposes?
@psusi The first point is probably valid, but I have yet to hear that Moore's law is completely dead. Citation needed, I suppose. About your second argument: when writing the post I doubted to include the phrase "for the same amount of money" but decided to leave it out because it seemed obvious to me. The point is that not everyone has the money to buy four times as much calculation power as they already have. Else why bother inventing faster CPUs when could buy more CPUs instead?
Oct
10
comment Is an 80 bit password good enough for all practical purposes?
@Peter Dice, good one! I knew about diceware, but you're the first person I hear who actually uses it :)
Oct
10
comment Is an 80 bit password good enough for all practical purposes?
@Lighty That's about passphrases vs. passwords and whether XKCD got it right. This question is about the practical strength of an 80-bit password.
Oct
1
comment How to tell if someone else's site is vulnerable to Shellshock without hacking them?
I suspect the downvote is because, though that site may stink of security vulns, this question (title at least) stinks of black hat ;). Reading the question more thoroughly it's probably not the case, but you might want to try to formulate it a bit less like "I see this really old website and want to exploit it" and more like "Someone claims their site to be certified secure, can I prove that it's not (e.g. shellshock?) without really hacking them?"
Sep
28
comment How can I keep Google from tracking me?
@user26832 Oops I meant Portugal. You said Portuguese and I misremembered it for Spanish when writing the comment. But I see that you edited in that you're using a French VPN server (I didn't know that at the time of writing), so the comment is obsolete now.
Sep
28
comment How can I keep Google from tracking me?
Find your IP address (at a site like whatismyip.com) and see if it's your own. If it isn't, then Google probably just redirected you to their Spanish site because the VPN's server is in Spain. If it is, then your VPN is not configured correctly.
Sep
21
comment A future heartbleed bug?
I've been noticing a bunch of certificate updates on Google, Twitter and other websites too. In all cases it changed, if I remember correctly, the MD5 fingerprint to undefined or something. Seems to be related to the recent discussion about accepted hashing methods for certificates in 2015.
Sep
13
comment Is my custom password hashing algorithm insecure?
It's better than nothing (kudos for at least thinking about the problem), but in general pbkdf2/bcrypt/scrypt with decent settings is always better than something you came up with yourself.
Sep
8
comment Is the HMAC weakened if a part of the message is part the key?
TL;DR: No but it's useless. Just leave the message out of the key.