34,397 reputation
1381151
bio website linkedin.com/in/avidouglen
location Israel
age 40
visits member for 4 years, 6 months
seen 15 hours ago

Security expert and experienced Windows programmer


Apr
26
answered How do you manage security-related OCD (i.e. paranoia)?
Apr
26
comment How do you manage security-related OCD (i.e. paranoia)?
+1, good answer. @nealmcb, note that @beth was talking about a warzone - the clear and present danger is men with guns. Better off, to have "easier" security (where the higher priority is jumping to the C&C / rocket control / intelligence systems faster) at the password level, and have compensating controls for the event the position is overrun (as it will be, eventually) and passwords retrieved, possibly by torture. Remember, this is WAR! ;)
Apr
26
comment How do you manage security-related OCD (i.e. paranoia)?
You DO realize that article was a joke, right? :)
Apr
26
revised How do you manage security-related OCD (i.e. paranoia)?
edited tags
Apr
26
comment How to securely store my passwords?
Not an answer, but I recommend PassSafe...
Apr
26
comment How to securely store my passwords?
Btw, I realized that it is not clear from your question that you're asking about your own passwords, for other services, stored on your desktop (or laptop, or whatever) - as opposed to an application / service storing passwords for all registered users. Can you put that clarification in the question (assuming I understood correctly)?
Apr
26
revised How to securely store my passwords?
edited tags
Apr
26
revised Are passwords in memory?
edited tags
Apr
26
comment REST specific security weaknesses
Wow, very nice answer. I would have +1'd you even just for the link to WS-Attacker, I hadn't heard of this tool before - it looks great! Thanks!
Apr
26
revised REST specific security weaknesses
edited tags
Apr
26
revised Feistel Block Cipher
edited tags
Apr
26
comment Feistel Block Cipher
I agree with @Ams and @D.W. Though you got an excellent answer from @Thomas, it really would be much better (and please note for future questions) had you focused on a particular issue, or ask a specific question, instead of expecting a full-on tutorial.
Apr
26
comment PCI Compliance - If am eligible to self certify - do I need to use a QSA company in this context?
@BombDefused, ASV usually is seperate from QSA, though they don't have to be. (Usually ASVs have a cheaper per-hour rate than QSAs too, so consider shopping around.) Another point you should pay attention to: network ASV and application ASV are not always the same. These are two seperate requirements in the PCI, and some ASVs do one, but not the other.
Apr
26
awarded  web-application
Apr
24
revised Generating one-time tokens from API-key?
edited tags
Apr
24
comment Are all security requirements expected to be testable?
but isnt the randomness algorithm reviewed? Even if the output isnt actually tested, that doesnt mean the randomness isnt tested, just not via an enduser testcase...
Apr
24
comment Are all security requirements expected to be testable?
@Paul, that's a good way of putting it... And yet, there will always be some types that cant have any simplistic test case attached to it, and will simply need a "must be reviewed".
Apr
24
comment What do you do to protect data on a Macbook in the event of theft/loss of the device?
@atdre, the iPhone tracking has been debunked (this data is only used locally, and for GPS-enabled apps, like maps). Besides, thats not the point of the question, please keep your rants on-topic.
Apr
24
revised What do you do to protect data on a Macbook in the event of theft/loss of the device?
Removed rant
Apr
23
revised Reasons behind MAC Spoofing on a corporate network?
edited tags