32,908 reputation
1379150
bio website linkedin.com/in/avidouglen
location Israel
age 40
visits member for 4 years, 4 months
seen yesterday

Security expert and experienced Windows programmer


1d
comment What does “random” mean in the context of password creation?
@SantiBailors the probability that a truly random generation process would generate "password" are infinitesimally small, in other words: extremely unlikely, such that you really really don't need to take it into consideration.
Mar
24
revised How to solve this flag?
rolled back to a previous revision
Mar
24
revised How should I manage people/technicians during an incident/outbreak?
edited tags
Mar
23
comment Security Tool To Control File Transfers on a Virtual Machine
Also, if you do not trust your developers, you are headed to a world of pointless pain. Perhaps just work better on the interview process, and make your expectations clear up front.
Mar
15
awarded  Good Answer
Mar
10
comment Why is the entropy of a session key approximately half the number of bits in the key?
Since that article was written almost 10 years ago, I am guessing it was a misunderstanding of entropy by the author? Unless he meant that the session id is Base64 of the random data, so the actual bits in the final sessionid is not the entropy bits... Still, that's not half, though much closer.
Mar
8
awarded  Good Question
Mar
8
reviewed Approve Mobile App Security vs. Traditional PC Desktop Security In The New Era
Mar
8
comment Php's password_hash encoding for HTTP basic authentication
Hi Dario, you seem to have conflicting requirements: So I don't warry If communication is not crypted. I just want to prevent some user can sniff and use the password. Also any crypto you do in JS is worthless, if the JS itself is not at a minimum served over HTTPS. Finally, "can't afford HTTPS" seems incredibly weird, since there are plenty of very cheap cert providers, maybe even free... This sounds like an invented problem to solve the solution.
Mar
3
revised Is using an free and anonymous VPN service safe?
removed spammy links.
Mar
1
reviewed Leave Open reusing old bank issued security device
Feb
27
awarded  Notable Question
Feb
25
comment Is it dangerous to allow users to edit the CSS styles?
Hi Tom, welcome to Information Security! I think you're missing @AndréDaniel's point - the custom CSS isn't just served to the blogger herself, but to any user that visits that blog page. Oh and btw, if you're allowing any user to store the CSS as files on disk (as opposed to dynamically in e.g. a database), then you do open up a whole bunch of other forms of server-side attacks.
Feb
24
comment Is it a good idea to use two salts?
and yes, technically speaking it does not serve the same purpose as an actual salt, so while my explanation may be a misnomer, it is what the OP was asking.
Feb
24
comment Is it a good idea to use two salts?
@RichieFrame a "pepper" is essentially a "server-wide salt". So in this case, it is exactly what he meant.
Feb
23
comment Kaspersky Antivirus “secure connection scan” as broken as Superfish?
mrclschstr, welcome to Information Security, and thanks for bringing this here! I don't think it is substantially different, though as @CodesInChaos says hopefully it is not as broken as the others. Still doesn't change the negligent attitude to TLS, PKI, and CA security though .
Feb
23
reviewed Approve Kaspersky Antivirus “secure connection scan” as broken as Superfish?
Feb
22
comment Password hashing and blowfish
oh and btw @php_nub_qq welcome to Information Security! Sorry for the harsh welcome... :-)
Feb
22
comment Password hashing and blowfish
+1 to @Gilles. Also, nothing that you asked about is specific to PHP, except for the broken code ;-)
Feb
22
revised What is the security/copy protection model for streaming media services?
edited tags; edited tags; edited tags