28,525 reputation
1067143
bio website linkedin.com/in/avidouglen
location Israel
age 39
visits member for 3 years, 8 months
seen 2 days ago

Security expert and experienced Windows programmer


Mar
9
revised How to make a report after a ddos attack? what information do I need to write on the report?
edited tags
Mar
9
comment The valid role of obscurity
But as @Rory also stated, obscurity is not necessarily a bad thing, of itself - it's only bad when you rely on it for your security. If your system is secured properly, then there are situations (as was the original question) where it can help just a little bit more. Of course you shouldnt rely on it - and we'd have to be careful to avoid a false sense of security - but obscurity does have some value - consider it an element of minimizing attack surface (or a form thereof). "First make it secure - then make it obscure". (Gonna adopt that line...)
Mar
9
comment Why should one not use the same asymmetric key for encryption as they do for signing?
Also, why would the attacker have access to N and such?
Mar
9
comment Why should one not use the same asymmetric key for encryption as they do for signing?
Can you provide some details? What kind of attacks break this usage? (Though I agree regardless about the system not being designed for this usage...)
Mar
9
comment Verifying server software integrity?
+1 great response, even though there really isnt an answer here... which is probably the real technical answer...
Mar
8
awarded  Good Answer
Mar
7
revised What are the implementation details and rationale of ASP.NET MVC3's AntiForgeryToken?
edited tags
Mar
7
comment Problems with avoiding JSON hijacking with MVC3's AntiForgeryToken, or similar token validation
Poked to try to get some answers...
Mar
7
revised Problems with avoiding JSON hijacking with MVC3's AntiForgeryToken, or similar token validation
edited tags
Mar
7
revised What is the equivalent European organization of NIST, especially in the Security Computer Division?
edited tags
Mar
7
revised Security Architecture - Settings to drive UI and Privileges (Rights) - Role-Based, per User-Account
edited tags
Mar
7
revised Storing users cookies in a database on a server
edited tags
Mar
7
comment License key / Serial number generator and checker
I'm not clear about this, if you're asking for a cryptographically secure random number generator - even with certain additional constraints - then that's easy, just tell us which platform/language you're on. If you're asking for something else - then it's not clear, and why would you ask on ITsec?
Mar
7
revised License key / Serial number generator and checker
edited tags
Mar
7
comment The valid role of obscurity
Well said, and well commented @Cameron. The well-known principle is misstated as "Avoid all security via obscurity", instead of "Don't rely only on security via obscurity". In fact I would encourage it, since it can limit your potential attackers. True, youre limited to the dangerous, knowledgeable ones, but you can focus on them instead of dealing with all the noise from script kiddies and the like. "First make it secure, then make it obscure."
Mar
7
revised How to define security requirements to ensure that developers… do not provide security by obscurity?
edited tags
Mar
7
revised The valid role of obscurity
edited tags
Mar
7
revised I'm leaving my job and want to erase as many personal details etc. as possible; any tips?
edited tags
Mar
7
reviewed Approve suggested edit on Comparing online security courses: eLearnSecurity vs. Offensive-Security
Mar
6
comment Why do we authenticate by prompting a user to enter both username and password? Does prompting the password only suffice?
omg, U-Prove?? what a horrible naming experiment... Hadn't heard about that before.