33,823 reputation
1381151
bio website linkedin.com/in/avidouglen
location Israel
age 40
visits member for 4 years, 5 months
seen 20 hours ago

Security expert and experienced Windows programmer


Apr
26
comment How to securely store my passwords?
Not an answer, but I recommend PassSafe...
Apr
26
comment How to securely store my passwords?
Btw, I realized that it is not clear from your question that you're asking about your own passwords, for other services, stored on your desktop (or laptop, or whatever) - as opposed to an application / service storing passwords for all registered users. Can you put that clarification in the question (assuming I understood correctly)?
Apr
26
revised How to securely store my passwords?
edited tags
Apr
26
revised Are passwords in memory?
edited tags
Apr
26
comment REST specific security weaknesses
Wow, very nice answer. I would have +1'd you even just for the link to WS-Attacker, I hadn't heard of this tool before - it looks great! Thanks!
Apr
26
revised REST specific security weaknesses
edited tags
Apr
26
revised Feistel Block Cipher
edited tags
Apr
26
comment Feistel Block Cipher
I agree with @Ams and @D.W. Though you got an excellent answer from @Thomas, it really would be much better (and please note for future questions) had you focused on a particular issue, or ask a specific question, instead of expecting a full-on tutorial.
Apr
26
comment PCI Compliance - If am eligible to self certify - do I need to use a QSA company in this context?
@BombDefused, ASV usually is seperate from QSA, though they don't have to be. (Usually ASVs have a cheaper per-hour rate than QSAs too, so consider shopping around.) Another point you should pay attention to: network ASV and application ASV are not always the same. These are two seperate requirements in the PCI, and some ASVs do one, but not the other.
Apr
26
awarded  web-application
Apr
24
revised Generating one-time tokens from API-key?
edited tags
Apr
24
comment Are all security requirements expected to be testable?
but isnt the randomness algorithm reviewed? Even if the output isnt actually tested, that doesnt mean the randomness isnt tested, just not via an enduser testcase...
Apr
24
comment Are all security requirements expected to be testable?
@Paul, that's a good way of putting it... And yet, there will always be some types that cant have any simplistic test case attached to it, and will simply need a "must be reviewed".
Apr
24
comment What do you do to protect data on a Macbook in the event of theft/loss of the device?
@atdre, the iPhone tracking has been debunked (this data is only used locally, and for GPS-enabled apps, like maps). Besides, thats not the point of the question, please keep your rants on-topic.
Apr
24
revised What do you do to protect data on a Macbook in the event of theft/loss of the device?
Removed rant
Apr
23
revised Reasons behind MAC Spoofing on a corporate network?
edited tags
Apr
23
revised Secure memcpy for pure C
removed crosspost
Apr
23
accepted Secure memcpy for pure C
Apr
23
comment Secure memcpy for pure C
Two practical points: cross-compilation is not an issue here, I don't need a common denominator (if I did, I'd probably consider Java... ;) ). Second, as you mention at the end of your last comment, most programmers are not great programmers, and that's exactly why I'm looking for this. I would also point out, this wouldnt help for BAD programmers, they can flub anything up... it's for the basically GOOD (but not supergreat) programmers, who will do the right thing when it's pointed out to them - it's for them that memcpy_s (or similar) would help immensely.
Apr
23
comment Secure memcpy for pure C
@Ninefingers, I understand from your comments that there are some anti-MS sentiment. However, I really don't care a whit about that, one way or another. It has no bearing on the question, which was "any more secure replacements for memcpy" (which has been proven time and again as probabilistically dangerous, that is, likely to be used in an unsafe manner). As an example, I mentioned the well-known bandaid that MS implemented (which btw, was not their "invention").