29,670 reputation
1169146
bio website linkedin.com/in/avidouglen
location Israel
age 39
visits member for 3 years, 11 months
seen 18 hours ago

Security expert and experienced Windows programmer


Mar
12
answered When should I not use CSRF protection for a form?
Mar
12
revised Generating OpenPGP key pair with restrictions
edited tags
Mar
11
comment Is AJAX fundamentally insecure?
@Casey, I meant that it is partially our fault, by saying it input validation can't be done in AJAX we are confusing the issue. Since AJAX encompasses both the clientside scripts, AND the server code - it's not true that it cant be done. Of course, if you're referring only to the client scripts, of course its true - but that's my point, "AJAX" means different things to different people.
Mar
11
comment Why should one not use the same asymmetric key for encryption as they do for signing?
I see. That makes sense, thanks! But I understand that currently, there are no known practical attacks? (Other than bad practice, and more importantly lack of assurance)
Mar
11
comment The valid role of obscurity
Well, no, not directly contradicts anything specific. I was assuming, as you were quoting Kerckhoff's principle to a question of "when is obscurity appropriate", that you were saying that you should not have obscurity as a security control at all. Maybe I was just reading between the line... sorry if I misread you :)
Mar
9
revised Monitoring a specific application for creation or modification of files
edited tags
Mar
9
answered Monitoring a specific application for creation or modification of files
Mar
9
comment How to make a report after a ddos attack? what information do I need to write on the report?
@Autocracy karma comes around
Mar
9
comment Is AJAX fundamentally insecure?
"Input validation... cannot [be] securely done in AJAX" is probably the reason @C.Ross's coworkers think AJAX is insecure, and the inverse is probably the reason AJAX-heavy apps usually are insecure.
Mar
9
comment Is AJAX fundamentally insecure?
Wow, it happened: the first time I didnt love one of your answers :). You kinda lost me with the FPS analogy (though it did make me want to go fire up UT...). The main issue I take with your answer, is the assumption that "AJAX... is code on the client side". While not necessarily wrong, per se, it is also not accurate, and often the cause of real problems when programmers see it that way. AJAX really encompasses code on the client side, but also the serving "page", and the communication between them. ...
Mar
9
comment How to make a report after a ddos attack? what information do I need to write on the report?
well, then, I'd +1 you again, if I could... ;-)
Mar
9
answered Is AJAX fundamentally insecure?
Mar
9
comment Is AJAX fundamentally insecure?
@Rory not sure its an exact duplicate... this is kinda more a theoretical question...
Mar
9
revised Wireless keyboard sniffing risk
edited tags
Mar
9
comment How to make a report after a ddos attack? what information do I need to write on the report?
+1, I would also add root cause analysis, and also under impact - time personnel spent cleaning up the mess...
Mar
9
revised How to make a report after a ddos attack? what information do I need to write on the report?
edited tags
Mar
9
comment The valid role of obscurity
But as @Rory also stated, obscurity is not necessarily a bad thing, of itself - it's only bad when you rely on it for your security. If your system is secured properly, then there are situations (as was the original question) where it can help just a little bit more. Of course you shouldnt rely on it - and we'd have to be careful to avoid a false sense of security - but obscurity does have some value - consider it an element of minimizing attack surface (or a form thereof). "First make it secure - then make it obscure". (Gonna adopt that line...)
Mar
9
comment Why should one not use the same asymmetric key for encryption as they do for signing?
Also, why would the attacker have access to N and such?
Mar
9
comment Why should one not use the same asymmetric key for encryption as they do for signing?
Can you provide some details? What kind of attacks break this usage? (Though I agree regardless about the system not being designed for this usage...)
Mar
9
comment Verifying server software integrity?
+1 great response, even though there really isnt an answer here... which is probably the real technical answer...