36,258 reputation
1485155
bio website linkedin.com/in/avidouglen
location Israel
age 40
visits member for 4 years, 7 months
seen 2 hours ago

Security expert and experienced Windows programmer


4h
comment Is there any way to make WEP secured AP uncrackable?
@Shivam sorry to tell you, but it is the correct answer... It is not possible to make WEP secure. I recommend you upgrade to a device that can support a secure protocol.
10h
comment Pentest : is this site secure
Now, to the point - this is a community moderated site - if a question is removed, it is for good reason. Please do not try to game the system by simply repeating the same question over again. Please go read help center to give you an idea what type of questions are acceptable here.
10h
comment Pentest : is this site secure
Philippe, welcome to Information Security. As has been noted to you before, this type of question is not acceptable here, for several reasons: that is a huge amount of work to do (several weeks) for a single answer; there is no way we can tell if this site is really yours; even if it is, no responsible consultant would touch that without a contract in place to protect themselves. Moreover, this is not a job board, and "secure enough" is absent any context of "secure enough for what?"
16h
reviewed Close Reformatting drive from a GUID partition to an MBR partition
16h
reviewed Leave Open What are the security benefits to block all http referer header requests for web browser?
2d
revised Why no self-hosted email? (Snowden, Lavabit, Hushmail, NSA)
edited tags
Jun
30
comment What are the drawbacks of login request throttling?
Personally, I am very anti-CAPTCHA in almost all scenarios it is commonly used (and in general, for that matter). That said - if this is a threat that you need to mitigate, I would suggest implementing a conditional CAPTCHA - e.g. after the 2nd time it gets locked. That said, at some point other mitigations are called for, e.g. blocking (or graylisting) the IP, etc.
Jun
30
comment What are the drawbacks of login request throttling?
@paj28 "short" is very context-dependent. While there is a valid threat of repeated locking, such that even 5 minute timeout would cause an account DoS - I at least have not seen that. It would likely be either very targeted (eg a personal attack, which is easier to handle), or a hit-and-run style to blanket all the thousands of users, once. Persistent account lockout for many users (i.e. repeatedly locking each account every 5 minutes) seems that would require quite a bit of resources.
Jun
29
comment What are the drawbacks of login request throttling?
@paj28 it varies. Basic technical solution is short lockouts, as the OP mentioned. Others have put in CAPTCHAs (which, while I am not a fan, can help raise the bar a bit). Oh yeah, and then there is always that one that decides to abolish lockouts altogether :-S
Jun
28
comment What are the drawbacks of login request throttling?
@paj28 that is not correct, I have seen this at non-megascale sites also - banking apps, auction and sale sites, even corporate systems...
Jun
27
reviewed Approve How to use Kalibrate and rtl-sdr to detect my GSM modem?
Jun
27
revised Can anyone give me sample php code that is vulnerable to SQL injection
edited tags
Jun
23
comment How critical is it to keep your password length secret?
The total amount of entropy provided the by password length is not too difficult to calculate, or rather the MAXIMUM entropy... let's assume passwords can be any length between 1 character and 32, then it is 5 bits of entropy at most, with of course a heavy bunching down near the bottom by the minimum required length. Of course, some banks will restrict you to 12 characters (minimum 6), so that's only 2.5 bits AT MOST. All that is of course assuming that the length is secret, which its not...
Jun
23
comment Why do so many banks have relatively weak e-banking security?
@NateKerkhofs Shame on you! SwiftOnSecurity definitely IS the real Taylor Swift, she said so herself! ;-)
Jun
22
awarded  Good Answer
Jun
22
revised Why is it insecure to store the session ID in a cookie directly?
Removed harsh Dave-ness
Jun
22
comment Dom based Xss Query - location.hash
@m1ke or even a simple "document.write()", or any element.append, or or or...
Jun
21
awarded  Nice Answer
Jun
21
comment Why is it insecure to store the session ID in a cookie directly?
@gabeio 1) While I appreciate the offer, its big task to cover all relevant dependencies and such. So thanks, but I'm not going to review all the relevant code. 2) Usually it is not the crypto library that is broken, but how it is used. 3) HMAC is not what is typically known as "signing", so if the devs are confusing between known terminology it just enforces what I suggested, the chance of getting something wrong in the implementation. 4) all that aside, it doesn't matter, since what I said still stands: crypto is delicate, don't throw it around contextless, if you do you may break something.
Jun
21
comment Why is it insecure to store the session ID in a cookie directly?
On the other hand, the downside of just throwing on some cryptodust all willy nilly without considering the context and threats, is that these things are delicate. If you throw on broken crypto, on top of an already strong sessionid, you might weaken it needlessly. (I'm not saying that library's crypto IS broken - but I am saying it is a non-negligible probability that it might be).