Luc

3,371 reputation

2832

bio	website	lucb1e.com
	location	The Netherlands
	age
visits	member for	10 months
	seen	21 hours ago
stats	profile views	208

Application development student. Also interested in computer networking and security. See also: lucb1e.com/!about

	3,371 reputation	bio	website	lucb1e.com	visits	member for	10 months
2832 badges		location	The Netherlands		seen	21 hours ago

summary answers questions tags badges favorites bounties reputation activity

210 Comments

suggestions reviews revisions comments badges posts accepts all

1d	comment	Touch Screen Password Guessing by Fingerprint Trace I have seen this as well, it's rather common!
1d	comment	Touch Screen Password Guessing by Fingerprint Trace @RoryAlsop Same here. I can't recite many passwords, or even recognize them from sight. Muscle memory all the way. Seeing them for the first time is like "Oh so that's what kept my account safe over the past months... wait quickly get it off the screen before I remember it!"
2d	comment	Touch Screen Password Guessing by Fingerprint Trace "90 percent", that's worrying. And interesting: it also means that most people's patterns are probably not very complex and thus bruteforceable.
2d	comment	Tools to extract code comments from sites? @D3C4FF English is part of the Burp Suite. Edit: ok not the smartest response. What I really mean is that something being part of a security suite doesn't make any random subject related to security when it should, in my opinion, be a SO or SU question.
May 15	comment	Tools to extract code comments from sites? I think it's not very security related. Your intended purpose maybe, but extracting comments in itself would be a stackoverflow question (or perhaps a superuser one, but I don't think it takes an entire tool as Adnan showed with his regex).
May 12	comment	Pronounceable Password Generator @SimonLehmann Very true, hadn't thought of that. Indeed the meaning of a word can make one remember synonyms instead... I personally use random passwords, but a password's strength is really in their length so I should switch.
May 8	comment	Should I enforce a password policy on a web site? Especially have a reasonable policy. Anything over 5 characters would be enough in my opinion. If you use the password abcde, that's your own stupid problem when my database gets hacked. I'll implement ratelimiting for login attempts so that you can't hack my service by trying for weak passwords. But I should be able to choose `^[ -~]$` as password which contains neither digits nor lowercase nor uppercase. I think it's stronger than the average "`s3cur3pa$$word`".
May 7	comment	Filtering In Iran @Adnan But proxies wouldn't get them arrested?
May 7	comment	VCS to manipulate returned trees to prevent leaks? @John "Nobody wants to lose their house in a lawsuit ;)" And then how exactly do you track down who leaked the code and needs to loose their house? That's what this question is about.
May 4	comment	Is publishing your public IP address a security threat? The thirty links in this post make it annoying to read. I think if you link a single instance of CDIR and ASN(s) people would know where to look...
May 2	comment	How proxy servers sniff data Could you elaborate on what happens when a rogue CA is installed by the sysadmins? For example do EV certificates still show as EV, and is it always possible to see the rogue CA on top of the certification path? There is a rogue CA here, but they don't seem to be using it right now (I make sure the EV cert shows whenever I log in).
May 1	comment	How proxy servers sniff data I knew I should look out for "mai1.google.com", but that Cryllic "a" just looks entirely the same. This is scary. How about stаckexchange.com (note the cryllic "а" in there), can you register a domain like that too? Or does it work on subdomains only? I wonder because the top- and second-level domains are not under your control, but the subdomain(s) can be used without registration and managed by your own nameservers.
Apr 29	comment	How to securely hash passwords? @DeerHunter If you think the implementation is bad, perhaps the author will still change things in later versions of PHP if you reply here: security.stackexchange.com/q/16506/10863
Apr 24	comment	Detailed tutorial for Virtual Steganographic Laboratory for Digital Images (VSL)? To downvoters: Please comment why you downvote so that the poster can make a better post next time. I assume it's because the poster doesn't seem to have tried Google, but I don't really know.
Apr 23	comment	How can browser select suggestions for my private searches? @ewanm89 Yeah that's what I meant by "and the fact that you have JS disabled"; that also is a parameter that could be tracked.
Apr 23	comment	How can browser select suggestions for my private searches? @AJHenderson Usually disabling Javascript makes you pretty much indistinguishable besides your IP and user agent string. And the fact that you have JS disabled. My linux computer is pretty distinct on our family connection for 4 people.
Apr 23	comment	How can browser select suggestions for my private searches? "If you are truly clearing all the local records when you close the browser, are not logged in to any accounts and are connecting through a VPN, then there should be no way for a web server to recognize you between visits." Basically you are right, but practically it's a different story: panopticlick.eff.org
Apr 21	comment	Can robots.txt for your face be made effective? There is a difference between recognizing people that you saw earlier on the street and storing everyone's whereabouts in one big database, accessible to people that you cannot approve and you don't even know when anyone accesses the data.
Apr 18	comment	Can Skype chat be protected from snooping? Are there safe alternatives? From a person that I know who works with security a lot I've also heard this. He says that because Microsoft is much bigger, authorities already have contact with them, and it's much easier to submit such snooping requests for governments. Don't get me wrong, small companies are just as easy to threaten and get data from, but authorities don't give it much of a priority. It seems Skype is relatively hard to snoop though, changing encryption key every day... I don't know the details.
Apr 18	comment	Automatic router admin password change Actually @whitespy9's problem was mistyping the IP address. His DNS servers had nothing to do with it. It is interesting what happens with your router... Actually I'd think the ISP changes it or something.