37,123 reputation
1488159
bio website linkedin.com/in/avidouglen
location Israel
age 40
visits member for 4 years, 8 months
seen 3 mins ago

Security expert and experienced Windows programmer


May
16
revised Next steps after webmail account was compromised
edited tags
May
16
awarded  Nice Question
May
14
comment What's the difference between an access control method, security model, and security policy?
And on your other point, "access control model to preserve Integrity, I would simply tell you THIS IS NOT a best practice" - you would be very wrong. Access control is intended to, well, control access. Not necessarily access to confidential information, just access. That could be access to performing some fuctionality, or access to modifying some data (i.e. integrity). Access control is absolutely one of the key methods to protect that.
May
14
comment What's the difference between an access control method, security model, and security policy?
I fail to see the distinction you make re "Integrity preserving model that uses access control" vs "access control model". Biba is an Access Control Model, even though it is not focused on confidentiality. I really dont understand why you say it isnt...
May
14
revised Recent Facebook XSS exploit details
edited tags
May
14
revised What are the career paths in the computer security field?
edited tags
May
14
comment How do I learn Cryptographic/Mathematical notation
@makerofthings, Not misinformation, per se, but it is kinda out of date. There were mistakes and such, but it's an "oldish" book. The "Cryptography Engineering" book that @D.W. recomended is considered the 3rd edition of the book you mentioned, so the mistakes and and such were cleaned up, and overall it is supposed to be better (still on my reading list, though...)
May
14
revised Peer review of C# cryptography for Azure Table security
edited tags
May
14
revised Suggested reading list: OS exploits
edited tags; edited title
May
14
comment How is “something you have” typically defined for “two-factor” authentication?
+1, even though this answer no longer fits the edited question (it did before, though, so thats why the upclick...)
May
14
comment How is “something you have” typically defined for “two-factor” authentication?
@john, that's not saying much - there are some banks that claim to use "Secret Questions" as a 2nd factor...
May
14
reviewed Approve IPV6 Cryptographically Generated Address implementation
May
14
comment What applications are at risk from “Backwards Unicode Names” and what are the mitigations?
@SteveS, this sounds similar to the issues with IDN - they look like a different domain name, and so can be used to fool the ignorant. Does that make IDN support a vulnerability? Well, no, not really, even though it can create and exploitable issue. Basically the problem is that it doesnt prevent social hacks.
May
14
revised What applications are at risk from “Backwards Unicode Names” and what are the mitigations?
edited tags
May
14
comment Getting self-signed SSL certificates for all https connections made from some premises
for all you know, this page will be modified on the fly to remove your answer ;)
May
14
revised How can I export my private key from a Java Keytool keystore?
edited tags
May
14
comment Getting self-signed SSL certificates for all https connections made from some premises
+1, but small comment: re (2) the proxy operators not only can see everything, they can change anything they want....
May
14
comment How does Diaspora work?
Can you provide a link to this Diaspora stuff, since its not exactly well-known? Is it a security protocol, or else how is the rest of the question security-related (as per @Phoenician-Eagle's comment)?
May
14
revised How to find out the Chaff packets of WEP?
edited tags
May
14
comment What are the career paths in the computer security field?
@chx thanks, but eh. It basically just says there is such an initiative, but with no real explanation there...