200 reputation
9
bio website linkedin.com/in/eranmedan
location United States
age 36
visits member for 1 year, 11 months
seen Apr 11 at 15:32

Tech Lead at NICE Actimize

  • Java, Scala, JavaScript, and all that is web
  • Data mining and fraud detection
  • Secretly wants to be a Ruby on Rails guy

Jun
6
awarded  Popular Question
Jul
2
accepted Throttling failed login attempts: exponential timeout? by IP? using a session cookie? captcha?
Apr
18
accepted How was this token decoded?
Apr
18
comment How was this token decoded?
p.s. should this question move to crypto.stackexchange.com? in any case if it can be improved by any way, please leave a comment / edit
Apr
18
asked How was this token decoded?
Jan
4
comment What is the severity of a fake certificate?
Thank you! you helped a lot to clear my blurry grasp on this :)
Jan
4
comment What is the severity of a fake certificate?
Thanks, so if I understand correctly, a legit certificate can actually protect me somehow from man in the middle attacks / DNS hijacking? (e.g. as long as the certificate is not hacked, then it will show as invalid if someone impersonates the target site?)
Jan
4
accepted What is the severity of a fake certificate?
Jan
3
comment What is the severity of a fake certificate?
Thanks, In other words, this can be used to redirect Google search results for example if some government wishes to censor something if I understand correctly? So I assume your comment about DNSSEC is related to having the DNS server be also "certified" so it's a real one and not one I created on a coffee shop open WiFi or something, did I get it right?
Jan
3
asked What is the severity of a fake certificate?
Dec
19
awarded  Citizen Patrol
Dec
4
comment How do certification authorities store their private root keys?
Sorry, I used my time machine and checked, your Quantum computer has a flaw, it turned into a dead cat
Nov
30
awarded  Teacher
Nov
30
comment VP of IT claims he unhashed 100% of all 16k employees' PWs. Is he lying to us?
You can hash all you want, but if you use MD5/SHA-1 (fast algorithms) and don't enforce password policy, any newbie hacker with a dictionary can crack most passwords using brute force on a strong EC2 instance in a few minutes / hours / days (depends on average password length and number of users) all under 100$. Or if you don't salt them then it's even easier using rainbow tables. Linked-in used one way hashes without salt, and got most password cracked when the database leaked. But the real issue is not passwords, all you need is the CEO's assistant to click on a malware link and your are in.
Nov
30
awarded  Critic
Nov
30
answered VP of IT claims he unhashed 100% of all 16k employees' PWs. Is he lying to us?
Nov
22
comment Throttling failed login attempts: exponential timeout? by IP? using a session cookie? captcha?
Thanks, Used to be a sworn .NET guy, but I have long ago converted to Java, (then to Scala) but thanks to things like TypeScript, F# etc, I'm starting to think checking back the other side...
Nov
22
awarded  Commentator
Nov
22
comment Throttling failed login attempts: exponential timeout? by IP? using a session cookie? captcha?
Hm... interesting, I wonder why not do a sleep() timer than, is it simply because it will kill my threadpool on a DDOS?
Nov
22
accepted Reset password - should I prevent abusing it?