31,224 reputation
1275149
bio website linkedin.com/in/avidouglen
location Israel
age 39
visits member for 4 years, 1 month
seen 54 mins ago

Security expert and experienced Windows programmer


Apr
11
revised Does default ModSecurity protect enough against XSS?
emphasized better to use encoding
Apr
11
comment Does default ModSecurity protect enough against XSS?
I'm going to +1 you, even though its not really an answer to my question - but it is the CORRECT answer, unfortunately I'm dealing here with my client's constraints... Of course the long term solution is to fix the code, but I was looking for a temporary quick fix.
Apr
11
comment How should passwords be stored if they must be recoverable?
+1, although I really dont think we should be looking at crypto to solve access control...
Apr
11
comment How should passwords be stored if they must be recoverable?
@nealmcb, and dont forget, this is a technical law with security implications, so the lawyers should have been welcoming us over there, too...
Apr
11
comment How should passwords be stored if they must be recoverable?
@PulpSpy - CPA-secure? That's encryption that your accountant can't hack?
Apr
11
comment How should passwords be stored if they must be recoverable?
Heh, but in this case I was arguing against the veracity of any exploit based test, instead a conceptual risk analysis was called for. Also, if I'm not mistaken, you were in agreement with the accepted answer there ;)
Apr
10
asked Does default ModSecurity protect enough against XSS?
Apr
10
revised What is the use of a client nonce?
edited tags
Apr
10
comment Generating one-time tokens from API-key?
@atdre, yes, but you can select who gets the bounty, based on the same bounty rules. This is independant of the accepted answer, and of any other bounties... (For more info see the FAW, pretty low down on the page...)
Apr
10
comment Generating one-time tokens from API-key?
@atdre you CAN put a bounty on someone else's question, see that li'l pink buttonlink right underneath the comments?
Apr
10
comment How should passwords be stored if they must be recoverable?
@Rook, no he's not - in his solution, there are no passwords, to store or not store. The French law (I assume) does not require every website to have passwords, only to store existing passwords in a recoverable format.
Apr
10
comment How should passwords be stored if they must be recoverable?
See also this discussion over on SO, from a year ago... quite heated, in fact, and I'm glad to see none of the same rhetoric (yet) that there was over there. It's funny, some of the highest voted answers are just plain wrong, and all those that spoke to common sense and reasonable risk analysis were strongly downvoted (e.g. mine, near the bottom :) )
Apr
10
comment Should I bother teaching buffer overflows any more?
@mrnap, whether the clear answer is a resounding "YES" or not, it is always a legitimate question to ask. In fact, someone that doesn't constantly question the current conventional wisdom is the one that shouldnt be teaching a class on security. As we all know, questioning assumptions is one of the best tools in our toolbox, and most often leads to finding vulnerabilities.
Apr
9
revised what to do after suspected intrusion on hobby webserver
edited tags
Apr
9
revised Looking for example of well-known app using unsalted hashes
edited tags
Apr
9
comment Web Security Cheatsheet / ToDo list
+1, OWASP Top 10 is definitely the place to start.
Apr
9
revised Can RSA (or any public/private key algorithm) be repeated for large amounts of data?
edited tags
Apr
9
comment What should I look at in the event of a major vendor suffering compromise with unspecified impact?
+1, even though you mentioned "six sigma" in a non-derogatory fashion... :)
Apr
9
comment Is clipboard secure?
@Ormis, thanks - apparently it's called a Freehand Circle :)
Apr
8
revised What should I look at in the event of a major vendor suffering compromise with unspecified impact?
spelling