32,908 reputation
1379150
bio website linkedin.com/in/avidouglen
location Israel
age 40
visits member for 4 years, 4 months
seen yesterday

Security expert and experienced Windows programmer


Jan
29
revised DHCP vs. Static IP Addressing
edited tags
Jan
29
revised What firewall settings on a Macintosh are the most restrictive, while still permitting casual internet use?
edited tags
Jan
28
comment Security attacks on PHP web applications
Please note that these are a good place to start, and it is far from complete. After you're up to speed on the basics, you should look for more advanced topics...
Jan
28
comment Security attacks on PHP web applications
Please note that these are a good place to start, and it is far from complete. After you're up to speed on the basics, you should look for more advanced topics...
Jan
28
comment Security attacks on PHP web applications
@Christian there actually attacks that are specific to PHP, e.g. Remote File Inclusion, while not nonexistant in other platforms, is mostly a PHP issue. Though this is true in most cases.
Jan
28
comment Good Security tool for PHP- Suhosin vs Spike vs PHPIDS
I removed the second question about apache, in order to keep the question focused on one question at a time... Also, the apache part is a duplicate.
Jan
28
revised Good Security tool for PHP- Suhosin vs Spike vs PHPIDS
Removed apache q to keep the q on focus
Jan
28
comment Can anyone provide references for implementing web application self password reset mechanisms properly?
See also a similar question on SO.
Jan
28
revised Can anyone provide references for implementing web application self password reset mechanisms properly?
edited tags
Jan
27
revised Good Security tool for PHP- Suhosin vs Spike vs PHPIDS
edited tags
Jan
27
revised Security attacks on PHP web applications
edited tags
Jan
27
revised Classical Cryptography Tools
edited tags
Jan
27
comment PKI solution vendor selection
Umm... First suggestion would be on your first point - Available technical know how is limited. If you're intending on supporting "a couple of tenthousand identities", and the other non-trivial requirements, you might want to get some expertise on board to do it right, not just select the right product.
Jan
27
comment Why triple DES used in EDE mode?
This doesnt really make much sense....
Jan
27
comment Why triple DES used in EDE mode?
@D.W. right, thats what I said in my comment (sorry, was that not clear...?) Using the same identical K for all keyparts will allow you to "recreate" DES, thus providing for backwards compatibility... But that doesn't explain either why to use EDE with 2 or 3 different keys. Especially since K1=K2=K3 is not recommended, supported, or secure.
Jan
26
comment where can find sample coding for use of Bouncy Castle(java)?
@Rory, I'm not so sure - code for performing encryption is ontopic, I think... That said, for something this niche, he's likely to get answers quicker. However, I've noticed programmers often use cryptographic functions wrong (like, using the wrong cipher mode, getting the padding wrong, etc.)
Jan
26
comment Why triple DES used in EDE mode?
Backwards compatibility only applies where the same keypart (56 bits) is used for all 3 operations (which anyway has long been unrecommended).
Jan
25
answered Initialization vector with cipher block
Jan
25
revised Initialization vector with cipher block
edited tags
Jan
25
comment Good (preferably free) resource for CISSP practice questions
+1, I went to check my old bookmarks, and it turns out the best ones were also cccure...