33,788 reputation
1381151
bio website linkedin.com/in/avidouglen
location Israel
age 40
visits member for 4 years, 5 months
seen 5 hours ago

Security expert and experienced Windows programmer


2d
comment How to find more details on Invalid Certificates
Hi Damon, after you figure out how to examine the certs, if it turns out that it's not about root certificate as @M'vy mentions, those very last 2 bits of your q WOULD be on topic here....
Apr
16
comment Information Security on a network
Hi Liz, welcome to Information Security. Your question is pretty wide open, and there are numerous options with numerous aspects each with numerous tradeoffs to consider. Perhaps if you could elaborate a bit on the actual network architecture, requirements, and the real causes for this, instead of just copypasting a homework assignment.
Apr
16
comment What happens to a site that is NOT in trusted sites?
Please do not create ridiculously extraneous and irrelevant tags.
Apr
16
comment How do I restrict priveleges for an SQL Server Stored Procedure?
What is the situation here, that someone else can define arbitrary SPs?
Apr
16
comment How do I restrict priveleges for an SQL Server Stored Procedure?
Veda uh, yeah, its called writing the SQL code you want it to perform.
Apr
16
comment How do I restrict priveleges for an SQL Server Stored Procedure?
Or are you actually talking about an SP with dynamic SQL in it... that would substantially change the question.
Apr
16
comment How do I restrict priveleges for an SQL Server Stored Procedure?
I don't understand - you want to disallow the SP from doing anything but select? Why don't you just write it that way?
Apr
16
comment Securely storing passwords using PHP5
Thanks ConsiderMe. But most of that, especially the process etc, is not PHP specific, and already well answered elsewhere. So are you asking specifically about this particular set of functions, or which method to use? Or something else?
Apr
16
comment Why does the user pick the password?
@StanRogers that's actually a good point there - generic wordlists are generic, and do not take into account things like culture differences, language barriers, and globalization issues in general. Not to mention personal idiosyncrasies... That's why I recommended to offer generated passphrases, and never to enforce them. So it would be better in the general case, and revert to the status quo in the exceptions.
Apr
15
comment How to keep track of registry changes in a Windows based system
Though to be honest, its not really so ontopic as it stands now, with the exception of the last part of the last sentence... Specifically "what API to use" would be an SO question, and "what parts of the registry to monitor" would be an SU question. Would you like to modify your q to focus on the security parts ("how to detect malicious activity"), or should I migrate it?
Apr
15
comment How to keep track of registry changes in a Windows based system
Well, sure, now that you edited it and removed that part.
Apr
15
comment Your connection is not private - delete certificate/security exception?
Uhh... that's not how this works. The owner of the website needs to request and install the certificate on the webserver. You shouldn't be doing any of that in your webbrowser, and you also shouldn't be defining exceptions if you don't understand what it is doing.
Apr
15
comment Securely storing passwords using PHP5
Right, but I'm trying to figure out what part of your question is actually PHP-specific. Could you perhaps focus your question accordingly?
Apr
15
comment Securely storing passwords using PHP5
Welcome to Information Security. Is there anything in your question that is not answered by How to securely hash passwords??
Apr
15
comment Information on the Elderwood Project/Platform
I'm voting to close this question as off-topic because this is a question for Symantec. Symantec identified them - the details need to come from them.
Apr
15
comment Why does the user pick the password?
I think you missed the point of the question, if you even read all the way through it. The OP specifically refers to xkcd-style passphrases (even linked to it), and explicitly mentions how your "Memorize 'F82$fVq9'" is broken, and typically what users do anyway - which is what the OP is trying to fix. This whole password requirement thing is something that IT came up with and enforces, its definitely not something for serving the customer.
Apr
14
comment Why does the user pick the password?
@CodesInChaos absolutely agree, this is what I was alluding to (probably too subtle) with: "How much risk can the user decide to take upon himself/herself, and how much of that is system risk that should be taken out of the user's hands."
Apr
14
comment How to find passwords in memory (password managers)
Btw hash values can't ever be decrypted, that's the point - you mean "encrypted values"
Apr
14
comment How to find passwords in memory (password managers)
Best bet would be to simply review the code of one of the popular opensource managers... But that's not really a security question though, is it. So what exactly are you asking?
Apr
14
comment Why does the user pick the password?
@SteveDL if the password is reused as is (with no formulaic transformations), and reused on any and every site - then entropy is irrelevant and pointless to calculate. Since you've already gone and exposed your password to anyone who asks for it, bruteforce has become pointless (generally speaking). If there IS some "formula", it is usually pretty trivial and transparent, and the additional entropy would be a similar calculation to the xkcd's first box - maybe the name of the site, maybe the initials, etc - 3 bits at most for that, then another couple for location - before/after/middle...