26,954 reputation
1061140
bio website linkedin.com/in/avidouglen
location Israel
age 39
visits member for 3 years, 5 months
seen 56 mins ago

Security expert and experienced Windows programmer


Mar
5
revised Why do we authenticate by prompting a user to enter both username and password? Does prompting the password only suffice?
edited tags
Mar
5
comment Is there a real risk of exploitation in java code where a null pointer is dereferenced
Wow, fantastic detailage. So, bottom line - are there non-standard combinations of systems where this is exploitable in some form? Or is it still theoretical (though important)?
Mar
5
comment Is there a real risk of exploitation in java code where a null pointer is dereferenced
I seem to remember reading some research a year or 2 ago, about some possible attack based on null dereference in Java, in certain scenarios. I cannot find it though....
Mar
5
revised Is there a real risk of exploitation in java code where a null pointer is dereferenced
edited tags
Mar
5
comment Is there a real risk of exploitation in java code where a null pointer is dereferenced
OHH EMM GEEE. Was just busting my head over this on Thursday, was gonna ask it here, but never got around to it... You rock!
Mar
3
comment How do I secure my SaaS startup?
@keisimone I think you'd have good chances of finding one here - I'd be happy to put myself forward, but your needs are not my preferred specialty :) (and I'm pretty swamped now...). Typically offers of business are off-topic, but contacts can be - and have been - made, and taken offline. Alternatively, you can contact someone via the chatroom... Also take into account re budget, it still really depends on how many hours / how much details of work you expect him to go into.
Mar
3
revised Is WPA2 WiFi protected against ARP poisoning and sniffing?
edited tags
Mar
3
revised Best Security Conferences?
edited tags; edited title
Mar
2
revised Should I go for Master of Science by GIAC SANS and what to do with my expiring GSEC cert?
edited tags
Mar
2
revised Code Analysis: Binary vs Source
emphasis
Mar
2
revised Code Analysis: Binary vs Source
accept -> except
Mar
1
answered Code Analysis: Binary vs Source
Mar
1
revised Demonstrating SQL injection on the following
edited tags
Mar
1
answered Should I bother teaching buffer overflows any more?
Mar
1
revised Should I bother teaching buffer overflows any more?
edited tags
Feb
28
comment Pen test cell-phones
I'm not so clear on what you're trying to acheive here. Can you elaborate? In fact, I would suggest you back up, and as a first step figure out your threat model. What do you expect to be protected? What attack scenarios are you expecting, and want to prevent? Etc... Then, you can work from there and figure out how to verify these things. E.g. are you looking at sensitive company info in SMS? Pics of stolen docs? Cached data from corp apps on smartphones? Worried about stolen phones? Spoofed phone #? And so forth....
Feb
28
comment 2 factor authentication - cost effective solution for a web startup
@growse, oh absolutely. Definitely don't "solve all security problems", not even authentication - I see it as a sort of compromise, because the credentials are "easy". Credential management, on the other hand, becomes a very sticky business. But more than that, biometrics are always based on a sliding scale, i.e. "we think this is really you, more than we think that it's not". It really comes back to a tradeoff, and with software biometrics being more available - and now even cheaper than hw tokens (used to be the opposite) - I see it being a much more suitable solution in most cases.
Feb
28
comment 2 factor authentication - cost effective solution for a web startup
@growse, I don't think you're wrong about that, biometrics are inherently a "close enough" solution (as opposed to "something you have" or even a password, where an exact match is possible, and required). I am of the mind that biometrics are usually closer to "identification" rather than "authentication"... That said, as a second factor, they can add a lot of value - though they're often not secret, its not always easy to replicate (and that depends on the implementation, there should be protection against "reuse"). Point is, it's a lot cheaper than a hardware token....
Feb
27
comment How feasible is it for a CA to be hacked? Which default trusted root certificates should I remove?
@nealmcb, I agree - but as you like to say, "what's your threat model?" I wanted to point out that he was asking the wrong question, to solve his stated "problem".
Feb
27
answered 2 factor authentication - cost effective solution for a web startup