30,355 reputation
1173148
bio website linkedin.com/in/avidouglen
location Israel
age 39
visits member for 4 years
seen 23 mins ago

Security expert and experienced Windows programmer


Apr
11
revised Giskismet query, how to select specific data?
edited tags
Apr
11
comment How should passwords be stored if they must be recoverable?
re Mastery - the "act of doing" can only get you past the apprenticeship stage. Yes, it is absolutely necessarily required, but it's not the end of the path, it's the beginning. Yes, any theory (of non-breakability) should be verified by the "doing", however in some cases analysis will tell you that the results of your "doing" just don't matter. And that level of mastership cannot be obtained by just doing, without looking at the bigger picture.
Apr
11
comment How should passwords be stored if they must be recoverable?
@Rook you're right - I didnt notice that the currently accepted answer was changed since I read it, it used to be what is now the second answer.
Apr
11
comment Does default ModSecurity protect enough against XSS?
oo, I got the big man himself! :) Now that Ofer and Or are not involved, I didn't know who to turn to... So, bottom line, ModSecurity+CRS does the job, in generic cases?
Apr
11
revised Does default ModSecurity protect enough against XSS?
emphasized better to use encoding
Apr
11
comment Does default ModSecurity protect enough against XSS?
I'm going to +1 you, even though its not really an answer to my question - but it is the CORRECT answer, unfortunately I'm dealing here with my client's constraints... Of course the long term solution is to fix the code, but I was looking for a temporary quick fix.
Apr
11
comment How should passwords be stored if they must be recoverable?
+1, although I really dont think we should be looking at crypto to solve access control...
Apr
11
comment How should passwords be stored if they must be recoverable?
@nealmcb, and dont forget, this is a technical law with security implications, so the lawyers should have been welcoming us over there, too...
Apr
11
comment How should passwords be stored if they must be recoverable?
@PulpSpy - CPA-secure? That's encryption that your accountant can't hack?
Apr
11
comment How should passwords be stored if they must be recoverable?
Heh, but in this case I was arguing against the veracity of any exploit based test, instead a conceptual risk analysis was called for. Also, if I'm not mistaken, you were in agreement with the accepted answer there ;)
Apr
10
asked Does default ModSecurity protect enough against XSS?
Apr
10
revised What is the use of a client nonce?
edited tags
Apr
10
comment Generating one-time tokens from API-key?
@atdre, yes, but you can select who gets the bounty, based on the same bounty rules. This is independant of the accepted answer, and of any other bounties... (For more info see the FAW, pretty low down on the page...)
Apr
10
comment Generating one-time tokens from API-key?
@atdre you CAN put a bounty on someone else's question, see that li'l pink buttonlink right underneath the comments?
Apr
10
comment How should passwords be stored if they must be recoverable?
@Rook, no he's not - in his solution, there are no passwords, to store or not store. The French law (I assume) does not require every website to have passwords, only to store existing passwords in a recoverable format.
Apr
10
comment How should passwords be stored if they must be recoverable?
See also this discussion over on SO, from a year ago... quite heated, in fact, and I'm glad to see none of the same rhetoric (yet) that there was over there. It's funny, some of the highest voted answers are just plain wrong, and all those that spoke to common sense and reasonable risk analysis were strongly downvoted (e.g. mine, near the bottom :) )
Apr
10
comment Should I bother teaching buffer overflows any more?
@mrnap, whether the clear answer is a resounding "YES" or not, it is always a legitimate question to ask. In fact, someone that doesn't constantly question the current conventional wisdom is the one that shouldnt be teaching a class on security. As we all know, questioning assumptions is one of the best tools in our toolbox, and most often leads to finding vulnerabilities.
Apr
9
revised what to do after suspected intrusion on hobby webserver
edited tags
Apr
9
revised Looking for example of well-known app using unsalted hashes
edited tags
Apr
9
comment Web Security Cheatsheet / ToDo list
+1, OWASP Top 10 is definitely the place to start.