29,415 reputation
1169146
bio website linkedin.com/in/avidouglen
location Israel
age 39
visits member for 3 years, 10 months
seen 2 hours ago

Security expert and experienced Windows programmer


1d
awarded  Explainer
Sep
28
revised how can i get job after completing grad in 2010
edited tags
Sep
27
comment Four-factor authentication
@Blackhawk yes and no - Google is authenticating the user (e.g. via password, or whatever). You are not authenticating the user at all - you are only relying on Google's assertion. This is a perfect example of why I said that "chain of trust" is a method of sharing the assertion, and not an authentication factor.
Sep
27
revised Not Certified but How can i start up Ethical hacker career?
edited tags
Sep
23
comment Four-factor authentication
You seem to be confusing "authentication" with "authorization", and a few others. chain of trust is not a form of authentication, it is the mechanism to propagate identity by vouching for each other. The first two, as @trysis said, are part of the other factors.
Sep
22
awarded  Announcer
Sep
18
comment Identifying Memorable Composition Rules
This may help, just about exactly the survey you are wondering about: ted.com/talks/…
Sep
18
comment What is the algorithm of bcrypt?
I'm not sure what you are asking that is not clearly answered on Wikipedia page for Bcrypt? If you have a specific question please clarify.
Sep
17
comment Where are my passwords stored in browser?
Actually, if you click "remember me" in a web form, odds are it is being stored by the app in a cookie, though it is possible that it is in client storage. If you let the browser itself save it, via the popup/toolbar/whatever, then it depends on the browser mechanism. Either way, this is not a security question...
Sep
16
comment How session cookies work?
en.wikipedia.org/wiki/HTTP_cookie
Sep
15
awarded  Notable Question
Sep
14
comment Is null-byte injection possible in Java filenames?
Sure, if you want to expand this in to a proper answer... :-)
Sep
11
awarded  Announcer
Sep
11
comment Is null-byte injection possible in Java filenames?
Wow, thanks for the update Dave. Can you provide a link, and some more technical details?
Aug
31
comment For an HTTPS web application, is it worthwhile to encrypt the password before POSTing it, to keep a MITM attacker from harversting it?
This is a rare case in which I would hazard a guess as to the identity of the pentesters, and obvious incompetence aside, I would point out (if it is indeed the company I believe it to be) that they have a vested interest in this misguided thinking, having just spun off a startup company to build and sell such counter-productive products. As @aviv mentioned, their recommendations are worse than the "problem" they purport to solve - in fact I'd run across their product that does just that, at a client engagement... I didn't know it was a commercial product, I called it out as a vulnerability.
Aug
21
comment If you have option to choose between static code analysis vs dynamic code analysis which one would you pick and why?
Which would you rather, a dentist or a heart specialist? I can't afford to send you to both.
Aug
21
revised White-box vs. Black-box
Area51 proposal not really relevant anymore...
Aug
20
awarded  Notable Question
Aug
5
comment How to deal with misbehaving clients on an authoritative server?
This is squarely a security question, definitely not at all SF, not even programmers.se - its not about "how to do it", the question is basically "what do we do with misbehaving users / requests". If this was on programmers.se, it should be migrated here.
Aug
4
awarded  Famous Question