34,397 reputation
1381151
bio website linkedin.com/in/avidouglen
location Israel
age 40
visits member for 4 years, 6 months
seen 2 hours ago

Security expert and experienced Windows programmer


May
18
comment How to get started in Cybersecurity with a business management background?
Hi, and welcome to Information Security - as Polynomial commented, this kind of question doesn't really work here. That said, do take a look around the careers tag, and security.stackexchange.com/q/3772/33 in particular (it's kind of a generic form of your question, -ish). Good luck!
May
18
revised How to get started in Cybersecurity with a business management background?
edited tags
May
14
comment Ensure that a file can only be decrypted after a specific date
@DavidRicherby even with a powerful time machine, certain points in the time-space continuum can still be time-locked. No timetravel in, no timetravel out. It's a wibbly wobbly timey wimey thing....
May
14
comment Separate authentication factors from the rest of the web application?
Hi ReadWriteCode, welcome to Information Security. As others have noted, you haven't really asked a question yet... Also, salt would be a user identifier this is problematic, since "salt" is a well known term with a very specific meaning, which has nothing to do with user identification.
May
13
comment Two-Step vs. Two-Factor Authentication - Is there a difference?
I agree about the relevance to the question, but that is the core of the answer.
May
13
comment Two-Step vs. Two-Factor Authentication - Is there a difference?
There are numerous examples of true 2 factor authentication that is NOT 2 steps. E.g. biometrics of how you type in your password (aka behavioral biometrics). The rest of the answer is similarly wrong.
May
8
answered How to prevent user from removing disabled attribute and manually editing role?
May
8
comment How to prevent user from removing disabled attribute and manually editing role?
@TimWilliams why are you so focused on PHP? There are plenty of other, much better options - and not to mention that this is a security site...
May
5
comment How many combinations does a specific password policy allow?
Very true. However I would take your point further, and note that absent any restriction, guidance, or mitigating circumstance, all else being equal a majority of users would still choose trivially simple passwords, even if these do not show up in existing research. E.g. "1234567890", or "1qaz2wsx3edc". The important point of equiprobability is often forgotten, but that is the base assumption that gives "how much information can be encoded" any value.
May
4
comment Why is a public key called a key - isn't it a lock?
If y'all want to discuss the validity of this type of conversational question, or non-practical terminology questions, why dontcha take it over to Information Security Meta...
May
1
comment Becoming HIPAA Compliant
Hi Kevin, welcome to Information Security! Can you include specific details in your answer? Link only answers are not productive here (linkrot, searchability, etc).
Apr
30
comment Threat Modelling Application Decomposition
Just a general comment, you should separate the authentication process from the other processes (you have the other 2 flowing through the "Check Password" process), whereas the authentication itself is really a single process. If you need to, you can model it a layer deeper (but I don't think you do) - at each layer you want to be keeping it as simple and direct as possible. Also remember you need to be focusing on flows - "wifi data" doesn't flow through the password check...
Apr
30
comment Threat Modelling Application Decomposition
Hi @h1h1, welcome to Information Security! I'm not sure how well this question fits our site as it is, but I'll leave it for now...
Apr
30
comment How can I set my server to only accept requests from my own client app? (similar to SSL Client Certificates)
again, that merely moves the client secret around - a malicious user would still be able to find it and use it for his own bogus app.
Apr
30
revised Minimize risk with Windows 2003 end of life
Removed the name of the specific product since it was leading to spammy non-answers.
Apr
29
comment putting my password in a php file (phpmailer)
note that the value should be encrypted in the configuration file...
Apr
29
comment Does it increase the security if we split data to n pieces and encrypt each one with different key and different algorithm?
@Ali so as I understand Rabin's IDA (and I don't really...), this would effectively be similar to the 3rd scenario? I.e. attacker needs to break most of the chunks - how many depends on how the threshold is configured, but still would be most of them. So it seems to me that it is unlikely to be effectively better, as I explained, in which case you are worse off for the added cryptocomplexity with no benefit.
Apr
29
answered Does it increase the security if we split data to n pieces and encrypt each one with different key and different algorithm?
Apr
29
comment Is there a layer 1, 2, 5 and 6 DDoS attack?
As an aside, you should know that the OSI model is irrelevant, since it is not in use and the TCP/IP model does not fit well with the OSI model. Despite that, the terminology - such as "layer 7" meaning the application layer - still has stuck, which is why you wont often see layers 5/6 mentioned, since these dont strictly exist as such in TCP/IP...
Apr
24
reviewed Leave Closed “Transferring” SSL certificate to another person