36,253 reputation
1485155
bio website linkedin.com/in/avidouglen
location Israel
age 40
visits member for 4 years, 7 months
seen 16 hours ago

Security expert and experienced Windows programmer


Mar
7
revised The valid role of obscurity
edited tags
Mar
7
revised I'm leaving my job and want to erase as many personal details etc. as possible; any tips?
edited tags
Mar
7
reviewed Approve Comparing online security courses: eLearnSecurity vs. Offensive-Security
Mar
6
comment Why do we authenticate by prompting a user to enter both username and password? Does prompting the password only suffice?
omg, U-Prove?? what a horrible naming experiment... Hadn't heard about that before.
Mar
6
comment Replacing windows shell for everybody but the system administrator
Ah, if its non-enterprise then you're probably not domain-joined, and hence no GPO....
Mar
6
answered Replacing windows shell for everybody but the system administrator
Mar
6
comment Why do we authenticate by prompting a user to enter both username and password? Does prompting the password only suffice?
@nealmcb, I agree with that. However, authorization sans identification actually is performed more often than you might think - e.g. in all the pr0n sites "I am over 18", I wouldnt count that as identification... Also this is kinda what claims-based authorization (see MS Geneva) is about...
Mar
5
revised Why do some sites block pasting into username or password input fields?
edited tags
Mar
5
revised TLS replay attack - requirements of the serverHello nonce
edited tags
Mar
5
answered I am still logged in using a browser X, can CSRF attack work when I use another (default) browser Y on the same machine?
Mar
5
revised I am still logged in using a browser X, can CSRF attack work when I use another (default) browser Y on the same machine?
edited tags
Mar
5
comment tripwire report - inode number
security related how? (other than you happen to notice this while using tripwire...)
Mar
5
revised Different strategies for online anonymity and their +/-s?
edited tags
Mar
5
revised Is a large number of RSA-encrypted files a vulnerability?
edited tags
Mar
5
answered Why do we authenticate by prompting a user to enter both username and password? Does prompting the password only suffice?
Mar
5
revised Why do we authenticate by prompting a user to enter both username and password? Does prompting the password only suffice?
edited tags
Mar
5
comment Is there a real risk of exploitation in java code where a null pointer is dereferenced
Wow, fantastic detailage. So, bottom line - are there non-standard combinations of systems where this is exploitable in some form? Or is it still theoretical (though important)?
Mar
5
comment Is there a real risk of exploitation in java code where a null pointer is dereferenced
I seem to remember reading some research a year or 2 ago, about some possible attack based on null dereference in Java, in certain scenarios. I cannot find it though....
Mar
5
revised Is there a real risk of exploitation in java code where a null pointer is dereferenced
edited tags
Mar
3
comment How do I secure my SaaS startup?
@keisimone I think you'd have good chances of finding one here - I'd be happy to put myself forward, but your needs are not my preferred specialty :) (and I'm pretty swamped now...). Typically offers of business are off-topic, but contacts can be - and have been - made, and taken offline. Alternatively, you can contact someone via the chatroom... Also take into account re budget, it still really depends on how many hours / how much details of work you expect him to go into.