29,130 reputation
1168144
bio website linkedin.com/in/avidouglen
location Israel
age 39
visits member for 3 years, 10 months
seen 5 hours ago

Security expert and experienced Windows programmer


Mar
9
comment How to make a report after a ddos attack? what information do I need to write on the report?
@Autocracy karma comes around
Mar
9
comment Is AJAX fundamentally insecure?
"Input validation... cannot [be] securely done in AJAX" is probably the reason @C.Ross's coworkers think AJAX is insecure, and the inverse is probably the reason AJAX-heavy apps usually are insecure.
Mar
9
comment Is AJAX fundamentally insecure?
Wow, it happened: the first time I didnt love one of your answers :). You kinda lost me with the FPS analogy (though it did make me want to go fire up UT...). The main issue I take with your answer, is the assumption that "AJAX... is code on the client side". While not necessarily wrong, per se, it is also not accurate, and often the cause of real problems when programmers see it that way. AJAX really encompasses code on the client side, but also the serving "page", and the communication between them. ...
Mar
9
comment How to make a report after a ddos attack? what information do I need to write on the report?
well, then, I'd +1 you again, if I could... ;-)
Mar
9
answered Is AJAX fundamentally insecure?
Mar
9
comment Is AJAX fundamentally insecure?
@Rory not sure its an exact duplicate... this is kinda more a theoretical question...
Mar
9
revised Wireless keyboard sniffing risk
edited tags
Mar
9
comment How to make a report after a ddos attack? what information do I need to write on the report?
+1, I would also add root cause analysis, and also under impact - time personnel spent cleaning up the mess...
Mar
9
revised How to make a report after a ddos attack? what information do I need to write on the report?
edited tags
Mar
9
comment The valid role of obscurity
But as @Rory also stated, obscurity is not necessarily a bad thing, of itself - it's only bad when you rely on it for your security. If your system is secured properly, then there are situations (as was the original question) where it can help just a little bit more. Of course you shouldnt rely on it - and we'd have to be careful to avoid a false sense of security - but obscurity does have some value - consider it an element of minimizing attack surface (or a form thereof). "First make it secure - then make it obscure". (Gonna adopt that line...)
Mar
9
comment Why should one not use the same asymmetric key for encryption as they do for signing?
Also, why would the attacker have access to N and such?
Mar
9
comment Why should one not use the same asymmetric key for encryption as they do for signing?
Can you provide some details? What kind of attacks break this usage? (Though I agree regardless about the system not being designed for this usage...)
Mar
9
comment Verifying server software integrity?
+1 great response, even though there really isnt an answer here... which is probably the real technical answer...
Mar
8
awarded  Good Answer
Mar
7
revised What are the implementation details and rationale of ASP.NET MVC3's AntiForgeryToken?
edited tags
Mar
7
comment Problems with avoiding JSON hijacking with MVC3's AntiForgeryToken, or similar token validation
Poked to try to get some answers...
Mar
7
revised Problems with avoiding JSON hijacking with MVC3's AntiForgeryToken, or similar token validation
edited tags
Mar
7
revised What is the equivalent European organization of NIST, especially in the Security Computer Division?
edited tags
Mar
7
revised Security Architecture - Settings to drive UI and Privileges (Rights) - Role-Based, per User-Account
edited tags
Mar
7
revised Storing users cookies in a database on a server
edited tags