31,214 reputation
1275149
bio website linkedin.com/in/avidouglen
location Israel
age 39
visits member for 4 years, 1 month
seen 8 hours ago

Security expert and experienced Windows programmer


Jan
20
comment How do I use C# to encrypt/decrypt data where the private key is on a smartcard, hardware security module, TPM chip etc
+1. In other words - you need the "driver" for the specific hardware. One tip - make sure to look at the CSPParameters class, too...
Jan
20
revised How do I use C# to encrypt/decrypt data where the private key is on a smartcard, hardware security module, TPM chip etc
edited tags
Jan
20
comment What particular concerns should one bear in mind when wardriving?
@Iszi - its not just a question of someone hosting multiple networks, there are those kind souls who on principle have their network open, as a "community hotspot". I personally dont (though if you know me you can easily use my network, by design), but my neighbour has his open - and it is configured securely (for his purposes, of course).
Jan
20
comment Possible to use CAPICOM to extract current SSL certificate?
You might also find this question helpful ;-). Actually, both questions really have the same purpose, dont they? Just trying a different technology to find the solution...
Jan
20
comment Possible to use CAPICOM to extract current SSL certificate?
To the best of my knowledge, CAPICOM has been discontinued, and is not very much supported. At least, thats what I remember from a few years ago - I'm looking for a link, but best I've found so far just points to "recommendations" to use .NET instead.
Jan
20
comment Possible to use CAPICOM to extract current SSL certificate?
@D.W. typically openSSL is not available to javascript on random clients...
Jan
20
comment Safe implementation of sharing encryption secrets (username, password) in the cloud
Is it just me, or does this whole architecture seem a bit, well, off? "Assuming ... can be identified securely to the cloud" - why would you assume that? How can you ensure it? And, assuming you can (e.g. via private/public keys) - why do you then need to (potentially) expose passwords in client-side config files? You can can already authenticate them "somehow" - so why bother with an additional datum that needs to be kept secret? Of course, that's assuming the password is intended to identify individual agents - otherwise, why ever bother? ... Then again, maybe I'm missing something...
Jan
19
revised Safe implementation of sharing encryption secrets (username, password) in the cloud
edited tags
Jan
19
comment What tools are available to identify which country a specific IP address is located in?
@Rory nice edit :). I tried to find some way to make it specifically pertinent - regulation, that's the key (as usual...)
Jan
19
comment Protecting an IIS web site hosted at home
As to scalability - I would say this is also no longer the case, at least not substantially so. Even with Apache you'd eventually have the need to scale out, and per server there is not a substantial difference in the webservers - your content and code would have a much larger impact than the choice of webserver. Again, it depends how you configure it, and IIS makes it easier to do it right.
Jan
19
comment Protecting an IIS web site hosted at home
Missed these comment responses before (you should tag the user's name so it pops in his inbox @mr_eclair), but your comments sound like fanboy rhetoric. As @rory stated, the security advantage that Apache might have had, is no longer the case, and hasn't been for years. Yes, they can both be implemented insecurely, and yes IIS makes it easier to shoot yourself in the face - but it also makes it easier to configure it securely - well, everything is easier, isnt it?
Jan
19
comment Biometric versus other Two Factor Authentication Mechanisms
I think the problem isnt that biometrics can be forged, so much as the fact that you leave this "credential" (i.e. your fingerprint) all over the place. It's similar to if you used the same password for all sites - including advertising it on billboards. Or, even crazier - if some form of public national id (say, SSN) were to be considered a secret identifier - even though you have to give it to everyone who asks for it.
Jan
19
comment Is posting from HTTP to HTTPS a bad practice?
@Troy - "secure" isn't just protecting the confidentiality of the transport, its also authentication, etc.
Jan
19
comment Non-OEM Biometric Software?
Note to the uninformed, MS' GINA is only applicable to pre-Vista, i.e. Windows XP and Server 2003.
Jan
19
comment User “home directory” on iPhone, Android, Windows mobiles and Blackberry
@Paul, tags should be used as categories, and sometimes as SEO. They are not keywords... As per the FAQ, please try to reuse existing tags before creating new ones - [mobile] already exists, no reason to create [mobile-security]... and, "security" is already implied by being on IT Security, doesnt make sense to repeat that in the tag...
Jan
19
revised User “home directory” on iPhone, Android, Windows mobiles and Blackberry
edited tags
Jan
19
revised How to prevent CSRF if you want to include Flash plugins in your form like Uploadify in your form?
edited tags
Jan
19
revised Storing private asymmetric key in application binary?
edited tags
Jan
19
revised What is the vulnerability in my PHP code?
edited tags
Jan
18
comment Is posting from HTTP to HTTPS a bad practice?
your answer contradicts your first sentence: that "Technically its still secure". Problem is, "secure" can mean several different things here.