34,397 reputation
1381151
bio website linkedin.com/in/avidouglen
location Israel
age 40
visits member for 4 years, 6 months
seen yesterday

Security expert and experienced Windows programmer


Feb
14
revised How can I secure a network share from the insider threat?
edited tags
Feb
13
comment What should I ask a prospective security consultant?
@packs, yes, but what about the excellent, small companies (and freelancers)? Usually, they do better work than "sufficiently large companies"...
Feb
13
comment What should I ask a prospective security consultant?
I agree that speaking at wellknown confs, and released papers, are good signs - but it's important to note that the absence of these should not at all be taken as a bad sign. Many consultants just get on with the work, and don't try to get lots of visibility. Admittedly, it's likely that he won't be brilliant (if he was, he'd probably get that visibility regardless...), but he might be able to do the regular 98% of the work just as well.
Feb
13
comment When the use of a AntiForgeryToken is not required /needed?
Not so contrived... See @D.W.'s answer.
Feb
13
comment When the use of a AntiForgeryToken is not required /needed?
+1, niice. CSRF-twist on the ol' session fixation... Nice paper, too, btw.
Feb
13
revised BlackBerry client authenticating to Java Web Service
copied question details + retagged
Feb
13
comment What can one do when encryption methods fail?
Can God create an encryption algorithm that even God cannot break?
Feb
13
comment What can one do when encryption methods fail?
Are you saying God can read my encrypted files?? Dang, looks like its time to move over to atheism.stackexchange.com ...
Feb
13
comment Is 2008 Server Core installation the most secure deployment?
yfuhs I don't think "is it more secure" should go over to SF, though the "is it more difficult" probably should. It's 2 different questions... Your "lower attack surface" bit would probably get missed at SF (+1 for that, btw)
Feb
13
revised When the use of a AntiForgeryToken is not required /needed?
edited tags
Feb
13
revised What can one do when encryption methods fail?
edited tags
Feb
13
comment How do I apply a security baseline to Windows 2008 R2?
@SteveSyfuhs, I'm on the fence... it is a sysadmin q, but it is about hardening the system...
Feb
13
revised How do I apply a security baseline to Windows 2008 R2?
edited tags
Feb
11
revised intel wireless 5100 AGN adapter to support injection
edited tags
Feb
10
comment intel wireless 5100 AGN adapter to support injection
Is this a security question? I don't see the connection...
Feb
10
reviewed Approve How to prevent CSRF if you want to include Flash plugins in your form like Uploadify in your form?
Feb
10
comment How useful is CISSP to a recent graduate?
I'm not so sure how much an entry-level position is expected to have the CISSP checkbox... Also, I find the CISSP exam to be much easier after a few years experience...
Feb
10
revised SQL injection for a username/password form?
edited tags
Feb
10
comment Altering a $_SESSION variable in PHP via XSS?
Why do you not consider XSS as "bad programming"? Of course it's bad programming, and of course the effects of the XSS very much depend on internal implementation. Bottom line, XSS can affect the session variables, in certain situations and depending on implementation.
Feb
10
revised Altering a $_SESSION variable in PHP via XSS?
edited tags