28,975 reputation
1168143
bio website linkedin.com/in/avidouglen
location Israel
age 39
visits member for 3 years, 9 months
seen yesterday

Security expert and experienced Windows programmer


Mar
9
answered Is AJAX fundamentally insecure?
Mar
9
comment Is AJAX fundamentally insecure?
@Rory not sure its an exact duplicate... this is kinda more a theoretical question...
Mar
9
revised Wireless keyboard sniffing risk
edited tags
Mar
9
comment How to make a report after a ddos attack? what information do I need to write on the report?
+1, I would also add root cause analysis, and also under impact - time personnel spent cleaning up the mess...
Mar
9
revised How to make a report after a ddos attack? what information do I need to write on the report?
edited tags
Mar
9
comment The valid role of obscurity
But as @Rory also stated, obscurity is not necessarily a bad thing, of itself - it's only bad when you rely on it for your security. If your system is secured properly, then there are situations (as was the original question) where it can help just a little bit more. Of course you shouldnt rely on it - and we'd have to be careful to avoid a false sense of security - but obscurity does have some value - consider it an element of minimizing attack surface (or a form thereof). "First make it secure - then make it obscure". (Gonna adopt that line...)
Mar
9
comment Why should one not use the same asymmetric key for encryption as they do for signing?
Also, why would the attacker have access to N and such?
Mar
9
comment Why should one not use the same asymmetric key for encryption as they do for signing?
Can you provide some details? What kind of attacks break this usage? (Though I agree regardless about the system not being designed for this usage...)
Mar
9
comment Verifying server software integrity?
+1 great response, even though there really isnt an answer here... which is probably the real technical answer...
Mar
8
awarded  Good Answer
Mar
7
revised What are the implementation details and rationale of ASP.NET MVC3's AntiForgeryToken?
edited tags
Mar
7
comment Problems with avoiding JSON hijacking with MVC3's AntiForgeryToken, or similar token validation
Poked to try to get some answers...
Mar
7
revised Problems with avoiding JSON hijacking with MVC3's AntiForgeryToken, or similar token validation
edited tags
Mar
7
revised What is the equivalent European organization of NIST, especially in the Security Computer Division?
edited tags
Mar
7
revised Security Architecture - Settings to drive UI and Privileges (Rights) - Role-Based, per User-Account
edited tags
Mar
7
revised Storing users cookies in a database on a server
edited tags
Mar
7
comment License key / Serial number generator and checker
I'm not clear about this, if you're asking for a cryptographically secure random number generator - even with certain additional constraints - then that's easy, just tell us which platform/language you're on. If you're asking for something else - then it's not clear, and why would you ask on ITsec?
Mar
7
revised License key / Serial number generator and checker
edited tags
Mar
7
comment The valid role of obscurity
Well said, and well commented @Cameron. The well-known principle is misstated as "Avoid all security via obscurity", instead of "Don't rely only on security via obscurity". In fact I would encourage it, since it can limit your potential attackers. True, youre limited to the dangerous, knowledgeable ones, but you can focus on them instead of dealing with all the noise from script kiddies and the like. "First make it secure, then make it obscure."
Mar
7
revised How to define security requirements to ensure that developers… do not provide security by obscurity?
edited tags