29,685 reputation
1170146
bio website linkedin.com/in/avidouglen
location Israel
age 39
visits member for 3 years, 11 months
seen 10 hours ago

Security expert and experienced Windows programmer


Mar
9
comment Verifying server software integrity?
+1 great response, even though there really isnt an answer here... which is probably the real technical answer...
Mar
8
awarded  Good Answer
Mar
7
revised What are the implementation details and rationale of ASP.NET MVC3's AntiForgeryToken?
edited tags
Mar
7
comment Problems with avoiding JSON hijacking with MVC3's AntiForgeryToken, or similar token validation
Poked to try to get some answers...
Mar
7
revised Problems with avoiding JSON hijacking with MVC3's AntiForgeryToken, or similar token validation
edited tags
Mar
7
revised What is the equivalent European organization of NIST, especially in the Security Computer Division?
edited tags
Mar
7
revised Security Architecture - Settings to drive UI and Privileges (Rights) - Role-Based, per User-Account
edited tags
Mar
7
revised Storing users cookies in a database on a server
edited tags
Mar
7
comment License key / Serial number generator and checker
I'm not clear about this, if you're asking for a cryptographically secure random number generator - even with certain additional constraints - then that's easy, just tell us which platform/language you're on. If you're asking for something else - then it's not clear, and why would you ask on ITsec?
Mar
7
revised License key / Serial number generator and checker
edited tags
Mar
7
comment The valid role of obscurity
Well said, and well commented @Cameron. The well-known principle is misstated as "Avoid all security via obscurity", instead of "Don't rely only on security via obscurity". In fact I would encourage it, since it can limit your potential attackers. True, youre limited to the dangerous, knowledgeable ones, but you can focus on them instead of dealing with all the noise from script kiddies and the like. "First make it secure, then make it obscure."
Mar
7
revised How to define security requirements to ensure that developers… do not provide security by obscurity?
edited tags
Mar
7
revised The valid role of obscurity
edited tags
Mar
7
revised I'm leaving my job and want to erase as many personal details etc. as possible; any tips?
edited tags
Mar
7
reviewed Approve suggested edit on Comparing online security courses: eLearnSecurity vs. Offensive-Security
Mar
6
comment Why do we authenticate by prompting a user to enter both username and password? Does prompting the password only suffice?
omg, U-Prove?? what a horrible naming experiment... Hadn't heard about that before.
Mar
6
comment Replacing windows shell for everybody but the system administrator
Ah, if its non-enterprise then you're probably not domain-joined, and hence no GPO....
Mar
6
answered Replacing windows shell for everybody but the system administrator
Mar
6
comment Why do we authenticate by prompting a user to enter both username and password? Does prompting the password only suffice?
@nealmcb, I agree with that. However, authorization sans identification actually is performed more often than you might think - e.g. in all the pr0n sites "I am over 18", I wouldnt count that as identification... Also this is kinda what claims-based authorization (see MS Geneva) is about...
Mar
5
revised Why do some sites block pasting into username or password input fields?
edited tags