meta user
network profile
| bio | website | linkedin.com/in/avidouglen |
|---|---|---|
| location | Israel | |
| age | 38 | |
| visits | member for | 2 years, 6 months |
| seen | 22 hours ago | |
| stats | profile views | 1,759 |
Security expert and experienced Windows programmer
|
Nov 18 |
answered | Is it ever appropriate to fight back? |
|
Nov 18 |
awarded | Beta |
|
Nov 18 |
comment |
How to keep a shared web hosting server secure? +1 for being realistic, +10 for being an optimist anyway :) |
|
Nov 18 |
comment |
What is a Web Application Firewall? Another feature you should consider when selecting a WAF, is self configuration / learning mode. Not all WAFs support this, and not all do it well - but for large applications, it can be quite a bother to configure all pages and parameters ( thats O(m * n)), and self learning can help here. However, caveat emptor - overzealous learning can be even worse. |
|
Nov 18 |
comment |
What is a Web Application Firewall? With WAFs you can also be a lot more granular, down to defining the size, format, range etc for a specific paramater on a specific page. |
|
Nov 18 |
revised |
Is the law the only thing stopping many sites from being hacked/cracked? edited tags |
|
Nov 18 |
revised |
How secure are my passwords in the hands of Firefox using a Master Password? edited tags |
|
Nov 18 |
answered | What are the pros and cons of site wide SSL (https)? |
|
Nov 18 |
revised |
What are the pros and cons of site wide SSL (https)? Focused question on the alternatives |
|
Nov 18 |
comment |
What are rainbow tables and how are they used? Hmm... Though the more I think about it, in real life systems Rainbow Tables are nowhere near as useful as hash tables. As you stated, for common passwords hash tables are much better (since they are order of magnitude faster, and the size requirements for a password dictionary are of course much smaller than the entire possible range of passwords). And who're we kidding? Most passwords fall into that category, it is very rare (and will be for some time) that you need to call in RT. |
|
Nov 18 |
comment |
What are rainbow tables and how are they used? Though to be specific (now that you opened my eyes I did some more research :) ), Rainbow Tables are differentiated from Hellman Hash Chains by using several different reduction functions. More complex indeed... but really quite a beautiful idea (Ah! is that why they're called "Rainbow" tables?) |
|
Nov 18 |
comment |
What are rainbow tables and how are they used? Oh my goodness, I admit to being shocked - I discuss and explain Rainbow tables all the time, and all this time it seems I have been one of the "commonly confused"! I would totally +1000 times, I really learned something new here (and I thought I knew the answer). Glad I asked the question after all... Thank you! |
|
Nov 18 |
comment |
RBAC model: user in two roles access dilemma @igor - Oh, I completely understand that, it wasn't criticism of course. I have had many situations where this is exactly what is required (short of a full blown EAM), but I think it's vital to be very clear on your model, and what part of it comes from which. |
|
Nov 18 |
comment |
RBAC model: user in two roles access dilemma @igor, I'm curious - was I correct about you using an ACL model together with the RBAC? |
|
Nov 18 |
revised |
RBAC model: user in two roles access dilemma edited tags |
|
Nov 18 |
revised |
What is the difference between RBAC and DAC/ACL? added 172 characters in body |
|
Nov 18 |
answered | RBAC model: user in two roles access dilemma |
|
Nov 17 |
answered | Is the law the only thing stopping many sites from being hacked/cracked? |
|
Nov 17 |
answered | If you could have only one book on web security, what would it be? |
|
Nov 17 |
revised |
If you could have only one book on web security, what would it be? edited tags |
