29,685 reputation
1170146
bio website linkedin.com/in/avidouglen
location Israel
age 39
visits member for 3 years, 11 months
seen 10 hours ago

Security expert and experienced Windows programmer


15h
awarded  Notable Question
Oct
12
revised Closely spaced failed logins in auth.log
edited tags
Sep
30
awarded  Explainer
Sep
28
revised how can i get job after completing grad in 2010
edited tags
Sep
27
comment Four-factor authentication
@Blackhawk yes and no - Google is authenticating the user (e.g. via password, or whatever). You are not authenticating the user at all - you are only relying on Google's assertion. This is a perfect example of why I said that "chain of trust" is a method of sharing the assertion, and not an authentication factor.
Sep
23
comment Four-factor authentication
You seem to be confusing "authentication" with "authorization", and a few others. chain of trust is not a form of authentication, it is the mechanism to propagate identity by vouching for each other. The first two, as @trysis said, are part of the other factors.
Sep
22
awarded  Announcer
Sep
18
comment Identifying Memorable Composition Rules
This may help, just about exactly the survey you are wondering about: ted.com/talks/…
Sep
18
comment What is the algorithm of bcrypt?
I'm not sure what you are asking that is not clearly answered on Wikipedia page for Bcrypt? If you have a specific question please clarify.
Sep
16
comment How session cookies work?
en.wikipedia.org/wiki/HTTP_cookie
Sep
15
awarded  Notable Question
Sep
14
comment Is null-byte injection possible in Java filenames?
Sure, if you want to expand this in to a proper answer... :-)
Sep
11
awarded  Announcer
Sep
11
comment Is null-byte injection possible in Java filenames?
Wow, thanks for the update Dave. Can you provide a link, and some more technical details?
Aug
31
comment For an HTTPS web application, is it worthwhile to encrypt the password before POSTing it, to keep a MITM attacker from harversting it?
This is a rare case in which I would hazard a guess as to the identity of the pentesters, and obvious incompetence aside, I would point out (if it is indeed the company I believe it to be) that they have a vested interest in this misguided thinking, having just spun off a startup company to build and sell such counter-productive products. As @aviv mentioned, their recommendations are worse than the "problem" they purport to solve - in fact I'd run across their product that does just that, at a client engagement... I didn't know it was a commercial product, I called it out as a vulnerability.
Aug
21
comment If you have option to choose between static code analysis vs dynamic code analysis which one would you pick and why?
Which would you rather, a dentist or a heart specialist? I can't afford to send you to both.
Aug
21
revised White-box vs. Black-box
Area51 proposal not really relevant anymore...
Aug
20
awarded  Notable Question
Aug
5
comment How to deal with misbehaving clients on an authoritative server?
This is squarely a security question, definitely not at all SF, not even programmers.se - its not about "how to do it", the question is basically "what do we do with misbehaving users / requests". If this was on programmers.se, it should be migrated here.
Aug
4
awarded  Famous Question