Hendrik Brummermann

15,677 reputation

23483

bio	website	faiumoni.de/de/start.html
	location	Germany, Europe
	age	32
visits	member for	2 years, 5 months
	seen	5 hours ago
stats	profile views	1,611

My main focus is on security and privacy aspects in the areas of business web applications, databases and online games. I like to look further and see the whole picture.

	15,677 reputation	bio	website	faiumoni.de/de/start.html	visits	member for	2 years, 5 months
23483 badges		location	Germany, Europe		seen	5 hours ago

summary answers questions tags badges favorites bounties reputation activity

300 Comments

suggestions reviews revisions comments badges posts accepts all

1d	comment	Insecure versions of crypt hashes @Shackrock `$6` is Sha512Crypt. That is an algorithm that is similar to BCrypt, but different. Most notably, it is based on Sha512 instead of Blowfish.
May 1	comment	Decrypt my cookie Hello Barry and welcome to IT Security Stack Exchange. Unfortunately your question is not a good fit for this site because it is not helpful for anyone else.
Apr 8	comment	Is it possible to increase the cost of BCrypt or PBKDF2 when its already calculated and without the original password? Possible Duplicate: security.stackexchange.com/q/32361/665
Apr 6	comment	Server root attack? This looks like an attempt to exploit registerglobals
Apr 6	comment	Getting credentials using proxy server Possible duplicate of security.stackexchange.com/questions/2914
Mar 21	comment	Is it possible to execute a php script in an image file? Please note Apache's support for double extensions: something.php.gif will be handled by PHP in common installations despite the final extension being .gif.
Mar 18	comment	How would one crack a weak but unknown encryption protocol? Hello RamRachum, Challenge to decode something style-questions are considered off topic here.
Mar 9	comment	Admin area in my php website is vulnerable to sql injection without login You should fix the SQL injection vulnerability nonetheless by consequently using mysql_real_escape_string or preferable parameterized queries. Otherwise this is a mine, just waiting for some code reuse in a couple of years. It is important to note that the above code does not completely prevent exploiting the vulnerability: Cross site request forgery needs to be prevented, too.
Mar 5	comment	Tools helps: First time cracking passwords The first reason that came to my mind was: The attacker is hoping for password reuse, e. g. on a private email account.
Feb 20	comment	What is the point of hashing passwords? Another related reason is that is eases the work of your public relation department: "We have implemented state of the art security protocols. For example we use the bcrypt password hashing algorithm" is a good basis to start crisis communication from.
Feb 13	comment	Is there a difference between GET and POST for web application security? Cross site POST request are not much harder then cross site GET requests. Especially if JavaScript is enabled, the form can be submitted without any user interaction at all.
Feb 7	comment	Why are vulnerabilities and lack of security possible in computers? While the Harvard Architecture prevents the direct interpretation of data as program code, it does not help against logic bugs, ill interpretation of data or integer overflows.
Feb 4	comment	Received a Kindle from a stranger, what are the risks? @AJHenderson, Kindle does read you. Have a look at the ToS. Amazon does keep very detailed records of your reading habits.
Feb 2	comment	How does the Yahoo webmail exploit work? What browser and which version are you using?
Jan 22	comment	XSS risk for an application which can be accessed from localhost only This is wrong, even if you are the only person accessing it. Reflective XSS works by telling the browser to access an URL which contains the attack-code. An external website may tell a browser to access localhost.
Jan 21	comment	Can law enforcement track a criminal through dynamic IP address? Yes, they can. It is unlikely that the criminal tried to hide his source in this case. Unfortunately there may be a lot of red tape involved which takes time. So I am afraid, it is likely that your computer is deleted and sold before they act.
Jan 20	comment	Is it a good idea to have a “master” password? Hello Stephen, please include a summary of those links in your answer.
Dec 31	comment	Are services like Hide My Ass and UnoDNS reasonably safe to use? Please note, that instant proxy services (such as HMA) see all traffic in clear-text. If you have a look at the URLs of instant-proxies, you will see: `https://anon-service/https/real-server/real-url`. So your browser has an encrypted connection to the anon-service and the anon-service has an encrypted connection to the real server. Using a traditional proxy will ensure an encrypted connection from the browser to the real server, unless the browser accepted untrustworthy certificates.
Dec 30	comment	Can I develop SSH-based tools within United States? The lawyers at SourceForge use this sentence as checkbox for projects to toggle the USA censorship enforcement: "This project incorporates, accesses, calls upon or otherwise uses encryption software with a symmetric key length greater than 64 bits ("encryption"). This review does not include products that use encryption for authentication only."
Dec 20	comment	How secure is aSSL (javascript)? Does it effectively mimic SSL? Step 0: Enable the browser to download the html-code and the assl library without enabling an attacker to manipulate it in transit. I mean adding just a little piece of javascript-code which sends a copy of the data somewhere else.