31,214 reputation
1275149
bio website linkedin.com/in/avidouglen
location Israel
age 39
visits member for 4 years, 1 month
seen 5 hours ago

Security expert and experienced Windows programmer


Apr
20
answered PCI Compliance - If am eligible to self certify - do I need to use a QSA company in this context?
Apr
20
revised PCI Compliance - If am eligible to self certify - do I need to use a QSA company in this context?
edited tags
Apr
20
comment Can we still provide confidentiality when cryptography is outlawed?
+1 for putting into context of risk and value, i.e. sometimes this might be the right solution. Though of course this shouldn't be relied on when you really need the confidentiality.
Apr
20
comment HMAC - Why not HMAC for password storage?
@Jesper and of course, this brings you back 'round to key management, which is a sticky subject all on it's own.
Apr
20
revised HMAC - Why not HMAC for password storage?
edited tags
Apr
20
revised Information gathering before deploying a Network IPS
edited tags
Apr
20
revised Securing clients side scripts
edited tags
Apr
20
comment Secure memcpy for pure C
@Thomas, re ISO/IEC - I remember reading somewhere (I can't find it now) that the gcc/linux implementors officially declared that they would not be implementing memcpy_s or similar... But, of course I am still looking for an equivalent or a workaround...
Apr
20
comment How can IA-5(1)(b) be enforced on Windows systems?
For the record, you can also have Windows enforce password history, i.e. that the new password does not match previous X passwords (as the OP mentioned).
Apr
20
revised Do you detect/react to DNS tunnelling?
edited tags
Apr
20
comment Comprehensive book to study about wireless technology
Are you asking specifically for a book on wireless security, or wireless in general? If the latter, I'd recommend asking on superuser.com. Regardless, lists of books are borderline ontopic - will probably be made CW...
Apr
20
revised Patching Mechanism and security holes
edited tags
Apr
20
revised Password History/Password policy
edited tags
Apr
20
revised Question about the SessionLock paper
edited tags
Apr
20
revised What indicators did OWASP use to end up with OWASP Top 10?
edited tags
Apr
20
comment Secure memcpy for pure C
@Marcin MS provides additional, "more secure" versions of these methods - e.g. strcpy_s, strncpy_s, amongst others - that do the same thing as memcpy_s, i.e. check the target buffer against an additional argument. Again, a programmer can provide wrong values here too, but good programmers would have to think about the size of the target buffer.
Apr
20
answered What indicators did OWASP use to end up with OWASP Top 10?
Apr
20
comment Secure memcpy for pure C
@Marcin strncpy only controls the size of the source buffer, not the target buffer. Same as with the original memcpy...
Apr
20
comment Secure memcpy for pure C
True - but I was asking the specific question, how to improve this specific bit. Thanks for the answer.
Apr
20
comment Secure memcpy for pure C
strncpy and such are still considered unsafe, though slightly better than strcpy. The problem is the same as with memcpy - you only define how many bytes to copy, but that has no relation to the target buffer... Good to know about the ISO bit, though... Thanks!