29,685 reputation
1170146
bio website linkedin.com/in/avidouglen
location Israel
age 39
visits member for 3 years, 11 months
seen 5 hours ago

Security expert and experienced Windows programmer


Mar
18
revised Anybody have additional information on the EMC RSA SecurID compromise?
edited tags
Mar
17
answered Are there any security measures that are resistant to a brute force attack?
Mar
17
comment Are there any security measures that are resistant to a brute force attack?
The original q on stackoverflow: stackoverflow.com/q/5336992/10080
Mar
17
revised How to apply FIPS to Microsoft Access database with custom VBA
edited tags
Mar
17
revised How can Network Disconnect be implemented for RDP on a Windows system (2003/XP or later)?
edited tags
Mar
17
comment In inSSIDer, what is the difference between WPA2-CCMP and RSNA-CCMP?
By that, I take it you're the original programmer for inssider? Feel free to point that out :)
Mar
16
revised Setting DHCP lease time to very small time increases security?
edited tags
Mar
16
answered Security Architecture - Settings to drive UI and Privileges (Rights) - Role-Based, per User-Account
Mar
16
revised Should the bit-strength selection of a child certificate be influenced by the CA or the chain?
edited tags
Mar
16
revised What SSL key should I make for IIS: RSA or DH? What bit length is appropriate?
edited tags
Mar
14
comment When should I not use CSRF protection for a form?
... curious what other people disagree with here...
Mar
14
comment When should I not use CSRF protection for a form?
Wrt development process, I'm not familiar with Twig or Liquid, but there are frameworks that let you seperate UI and code (i.e. "codebehind"). Also in many frameworks the CSRF protection is configuration-based, on shouldnt interfere with UI designers.
Mar
14
comment When should I not use CSRF protection for a form?
@keisimone as @nhnb said, if there is any "identity" that could be misused, and any "action" being performed, you should have CSRF protection. In your case you could solve this differently, be re-initializing and emptying the cart on login.
Mar
14
comment Is there a need for a simple SAAS security risk assessment application?
I disagree. I think market research is legitimately ontopic, and what better place for that than here? Just need to clean up a bit of the salespitch, and my vote would be to keep open
Mar
13
revised What are some good, free tools to run automated security audits for PHP code?
edited tags
Mar
13
comment The valid role of obscurity
Ah, now I can agree with that. Although I think that might be a bit too... "hard" for typical programmers, to have as a guiding principle. So while I agree in theory, and can be helpful for security pros, I think @Rory's explanation (which basically comes down to the same thing) is "easier" for non-security-pro consumption...
Mar
13
revised Is BASIC-Auth secure if done over HTTPS?
deleted 143 characters in body
Mar
12
comment When should I not use CSRF protection for a form?
@nhnb reauthentication is the correct solution, and the most direct. Until not so long ago, it was the only recommended solution, since rolling your own token management would always be gotten wrong, and very often create more damage than it solves. There are many examples of this used well, even outside of banks, e.g. LinkedIn. The key to that approach is being selective in where you apply it, though.
Mar
12
revised Known security vulnerabilities in JBoss 4.x.x?
edited tags
Mar
12
revised Key management in cloud datacenters
edited tags