31,139 reputation
1275149
bio website linkedin.com/in/avidouglen
location Israel
age 39
visits member for 4 years, 1 month
seen 8 hours ago

Security expert and experienced Windows programmer


Apr
12
answered Data Encryption and Key Management in C#
Apr
11
comment DNS access limitations
@WZeberaFFS MS DNS definitely does support access control, but I really don't remember the details...
Apr
11
comment Encrypting with Mongo
@Rook Azure is actually used quite a bunch, and is really starting to gain in popularity. Not #1 yet by any means, but steadily gaining percentages.
Apr
11
revised Encrypting with Mongo
edited tags
Apr
11
comment How should passwords be stored if they must be recoverable?
And I believe people who only write exploit code and exclude all else - especially risk analysis - are even bigger danger, because they misdirect limited security resources which might be better spent elsewhere, and cause the (non-security) business to perceive the security industry as hacks focused only on exploits not relevant to the business... So yes, we'll agree to disagree :). Much like compliance experts think that's the most important, and network pros see that as all important, etc, anyone with a narrow expertise tends to see that as the core, and everything else as unimportant.
Apr
11
comment How should passwords be stored if they must be recoverable?
@Rook do you think a car can be made safe simply by repetitive crash testing, without some thought and design? Again, I'm not testing is not necessary, I'm saying it's not all there is. What if the car is not safe when dropped from 50 feet in the air? Or the bulletproof vest wont stop a tank shell (or a rottweiller)? My point is that not everything that can be tested, should be tested (or needs to be) - some things just don't matter. But, I really think we're off context here...
Apr
11
revised How do Azure ACS 2.0 security features compare to ADFS 2.0?
edited tags
Apr
11
revised DNS access limitations
retagged
Apr
11
revised Complexity of web certificate attacks
edited tags
Apr
11
revised Giskismet query, how to select specific data?
edited tags
Apr
11
comment How should passwords be stored if they must be recoverable?
re Mastery - the "act of doing" can only get you past the apprenticeship stage. Yes, it is absolutely necessarily required, but it's not the end of the path, it's the beginning. Yes, any theory (of non-breakability) should be verified by the "doing", however in some cases analysis will tell you that the results of your "doing" just don't matter. And that level of mastership cannot be obtained by just doing, without looking at the bigger picture.
Apr
11
comment How should passwords be stored if they must be recoverable?
@Rook you're right - I didnt notice that the currently accepted answer was changed since I read it, it used to be what is now the second answer.
Apr
11
comment Does default ModSecurity protect enough against XSS?
oo, I got the big man himself! :) Now that Ofer and Or are not involved, I didn't know who to turn to... So, bottom line, ModSecurity+CRS does the job, in generic cases?
Apr
11
revised Does default ModSecurity protect enough against XSS?
emphasized better to use encoding
Apr
11
comment Does default ModSecurity protect enough against XSS?
I'm going to +1 you, even though its not really an answer to my question - but it is the CORRECT answer, unfortunately I'm dealing here with my client's constraints... Of course the long term solution is to fix the code, but I was looking for a temporary quick fix.
Apr
11
comment How should passwords be stored if they must be recoverable?
+1, although I really dont think we should be looking at crypto to solve access control...
Apr
11
comment How should passwords be stored if they must be recoverable?
@nealmcb, and dont forget, this is a technical law with security implications, so the lawyers should have been welcoming us over there, too...
Apr
11
comment How should passwords be stored if they must be recoverable?
@PulpSpy - CPA-secure? That's encryption that your accountant can't hack?
Apr
11
comment How should passwords be stored if they must be recoverable?
Heh, but in this case I was arguing against the veracity of any exploit based test, instead a conceptual risk analysis was called for. Also, if I'm not mistaken, you were in agreement with the accepted answer there ;)
Apr
10
asked Does default ModSecurity protect enough against XSS?