meta user
network profile
| bio | website | linkedin.com/in/avidouglen |
|---|---|---|
| location | Israel | |
| age | 38 | |
| visits | member for | 2 years, 6 months |
| seen | 1 hour ago | |
| stats | profile views | 1,755 |
Security expert and experienced Windows programmer
|
1h |
comment |
Extra/Special Security for Financial Web Apps? Hi Sulla, welcome to IT Security. As @DeerHunter commented, your question really isnt looking for something specific that we could answer with. Can you please review the FAQ, and read How to Ask, and then try to focus your question a bit more? |
|
1d |
comment |
What are some recommended certifications that do not require industry experience? It seems to me, that a certification with no experience behind it, and little formal education, would not be worth much. Why are you not interested in getting real world experience? |
|
2d |
comment |
CSRF protection with Session Id ah, I see - that was not clear from your answer. However, while this scheme could work fine (I dont see any issues with it offhand), it needlessly over-complicates things. Why try to build this (and you will probably get some parts wrong, like the cryptographic bits), when you have a perfectly fine mechanism built in to almost any framework or platform you're using? |
|
2d |
comment |
CSRF protection with Session Id And what would stop the 2nd cookie from being submitted by a CSRF attack, same as the session id cookie...? |
|
May 19 |
comment |
Please recommend scanner that allows to find XSS and SQL injections vulnerabilities for Web Application @Michael the question is still asking for a product recommendation. These types of questions are not a good fit for SE sites. You'd be better asking questions around how to know if a product is good, or what features or qualities are important, or how to compare two different products. Or take it a step further and ask about a methodology to find these flaws... |
|
May 19 |
awarded | Announcer |
|
May 19 |
reviewed | Reject suggested edit on identity-management tag wiki excerpt |
|
May 19 |
accepted | Backup schedule for Encryption Keys |
|
May 17 |
comment |
Backup schedule for Encryption Keys But even more so, as @Thomas put it so well: you do not want to make too many copies of your encryption keys because encryption keys are, by definition, extremely sensitive, and multiple copies are, also by definition, at odds with confidentiality. |
|
May 17 |
comment |
Backup schedule for Encryption Keys I meant more about the timing, i.e. every time a key is exported, that is a sign that the key was generated. I dont think that it is likely that this would directly expose the key, but I wasn't sure that it doesnt leak some info. |
|
May 17 |
reviewed | Approve suggested edit on Malicious Links that Respond to Browsers but not curl or wget |
|
May 16 |
comment |
Prevent Malware attack on my site And btw please do not cross-post the same question to more than one SE site - if it were appropriate, a moderator could have migrated it here. |
|
May 16 |
comment |
Prevent Malware attack on my site Hi Codeeater, welcome to IT Security. As the commenters on Stack Overflow and the answerers here mentioned, there is really no way anybody here can answer your question - there are too many things to consider. You really need to sit down and learn about secure coding, and how to protect wordpress sites, and these are more than can be delivered in a single answer here. After you do the research, come back with a specific question and we will be glad to help you with it. |
|
May 16 |
comment |
Touch Screen Password Guessing by Fingerprint Trace "Obviously, cleaning your screen after every use is a practical (and not to difficult) defense against this specific attack"... especially after garlic bread. |
|
May 16 |
comment |
Backup schedule for Encryption Keys Re the cryptography I actually have no idea either. But if keys are exported every X days, regularly, I don't know that there is NOT an issue. |
|
May 16 |
comment |
Backup schedule for Encryption Keys Thanks, Brandon. Missing details as per my comment up top, I'm not asking about a single specific situation, but rather general guidelines. "Restoring and testing" - this is obvious, or rather always true with backups. |
|
May 16 |
comment |
Backup schedule for Encryption Keys @ewanm89 I suppose that's also true, but would be a factor in an answer. Make any assumptions on this you like, but they should be explicit... |
|
May 16 |
asked | Backup schedule for Encryption Keys |
|
May 16 |
reviewed | Close w3af plugin development example |
|
May 16 |
reviewed | Reject suggested edit on |
