34,417 reputation
1381151
bio website linkedin.com/in/avidouglen
location Israel
age 40
visits member for 4 years, 6 months
seen 1 hour ago

Security expert and experienced Windows programmer


1h
comment How to secure MySQL database usernames and passwords within a php file?
Quoting from the help center, **Provide context for links**: Links to external resources are encouraged, but please add context around the link so your fellow users will have some idea what it is and why it’s there. Always quote the most relevant part of an important link, in case the target site is unreachable or goes permanently offline. There are reasons for this "rule" - it is for the benefit of all users.
1h
comment How to secure MySQL database usernames and passwords within a php file?
@John No answer is better. Simply because a link-only answer creates noise that obscures the "good" answers, and does not contribute to the body of knowledge that is Stack Exchange. What happens 12 months from now, if that link is no longer active, and someone else is looking for the answer? Then you get this situation. Also, absent any context to the link, why would someone follow the link blindly?
1h
comment How to secure MySQL database usernames and passwords within a php file?
@John, we are all getting sick with this behaviour - that is why several of our users have jumped in to help you avoid that behavior. There is a reason for our rules, and social conventions - they are not arbitrary or random. It is to improve the quality of the answers provided, and not just to drive traffic to your site. We would happily welcome any information you can provide here, but as Rhino said, simply linking to other sites does not improve the quality of information here. I for one have not clicked the link, and would not, unless you gave me reason to in your answer.
3h
comment Man in the middle attack theory
@moebius_eye the problem is verification: If Alice does not already have Bob's certificate ahead of time, via a secure and trusted channel, there would be no way of verifying that it IS Bob's certificate. That's where 3rd party signing comes in: I might not have Bob's certificate ahead of time, but I do have Chad's certificate, and he is the one that signed Bob's cert. This allows me to verify any certificate, for any user, as long as it was signed by a trusted 3rd party.
4h
reviewed Leave Closed Anonymous web purchases
9h
comment Is visiting HTTPS websites on a public hotspot secure?
@Pacerier yeah, now, didn't used to be :-) Also their certs are mostly pinned (re my 2nd point), so... yeah. Thanks!
9h
revised Is visiting HTTPS websites on a public hotspot secure?
Replaced google with example.org
May
18
comment How to get started in Cybersecurity with a business management background?
Hi, and welcome to Information Security - as Polynomial commented, this kind of question doesn't really work here. That said, do take a look around the careers tag, and security.stackexchange.com/q/3772/33 in particular (it's kind of a generic form of your question, -ish). Good luck!
May
18
revised How to get started in Cybersecurity with a business management background?
edited tags
May
14
comment Ensure that a file can only be decrypted after a specific date
@DavidRicherby even with a powerful time machine, certain points in the time-space continuum can still be time-locked. No timetravel in, no timetravel out. It's a wibbly wobbly timey wimey thing....
May
13
comment Two-Step vs. Two-Factor Authentication - Is there a difference?
I agree about the relevance to the question, but that is the core of the answer.
May
13
comment Two-Step vs. Two-Factor Authentication - Is there a difference?
There are numerous examples of true 2 factor authentication that is NOT 2 steps. E.g. biometrics of how you type in your password (aka behavioral biometrics). The rest of the answer is similarly wrong.
May
8
answered How to prevent user from removing disabled attribute and manually editing role?
May
8
comment How to prevent user from removing disabled attribute and manually editing role?
@TimWilliams why are you so focused on PHP? There are plenty of other, much better options - and not to mention that this is a security site...
May
5
comment How many combinations does a specific password policy allow?
Very true. However I would take your point further, and note that absent any restriction, guidance, or mitigating circumstance, all else being equal a majority of users would still choose trivially simple passwords, even if these do not show up in existing research. E.g. "1234567890", or "1qaz2wsx3edc". The important point of equiprobability is often forgotten, but that is the base assumption that gives "how much information can be encoded" any value.
May
4
comment Why is a public key called a key - isn't it a lock?
If y'all want to discuss the validity of this type of conversational question, or non-practical terminology questions, why dontcha take it over to Information Security Meta...
May
1
comment Becoming HIPAA Compliant
Hi Kevin, welcome to Information Security! Can you include specific details in your answer? Link only answers are not productive here (linkrot, searchability, etc).
Apr
30
comment Threat Modelling Application Decomposition
Just a general comment, you should separate the authentication process from the other processes (you have the other 2 flowing through the "Check Password" process), whereas the authentication itself is really a single process. If you need to, you can model it a layer deeper (but I don't think you do) - at each layer you want to be keeping it as simple and direct as possible. Also remember you need to be focusing on flows - "wifi data" doesn't flow through the password check...
Apr
30
comment Threat Modelling Application Decomposition
Hi @h1h1, welcome to Information Security! I'm not sure how well this question fits our site as it is, but I'll leave it for now...
Apr
30
comment How can I set my server to only accept requests from my own client app? (similar to SSL Client Certificates)
again, that merely moves the client secret around - a malicious user would still be able to find it and use it for his own bogus app.