34,417 reputation
1381151
bio website linkedin.com/in/avidouglen
location Israel
age 40
visits member for 4 years, 6 months
seen 14 mins ago

Security expert and experienced Windows programmer


55m
comment Man in the middle attack theory
@moebius_eye the problem is verification: If Alice does not already have Bob's certificate ahead of time, via a secure and trusted channel, there would be no way of verifying that it IS Bob's certificate. That's where 3rd party signing comes in: I might not have Bob's certificate ahead of time, but I do have Chad's certificate, and he is the one that signed Bob's cert. This allows me to verify any certificate, for any user, as long as it was signed by a trusted 3rd party.
7h
comment Is visiting HTTPS websites on a public hotspot secure?
@Pacerier yeah, now, didn't used to be :-) Also their certs are mostly pinned (re my 2nd point), so... yeah. Thanks!
May
18
comment How to get started in Cybersecurity with a business management background?
Hi, and welcome to Information Security - as Polynomial commented, this kind of question doesn't really work here. That said, do take a look around the careers tag, and security.stackexchange.com/q/3772/33 in particular (it's kind of a generic form of your question, -ish). Good luck!
May
14
comment Ensure that a file can only be decrypted after a specific date
@DavidRicherby even with a powerful time machine, certain points in the time-space continuum can still be time-locked. No timetravel in, no timetravel out. It's a wibbly wobbly timey wimey thing....
May
13
comment Two-Step vs. Two-Factor Authentication - Is there a difference?
I agree about the relevance to the question, but that is the core of the answer.
May
13
comment Two-Step vs. Two-Factor Authentication - Is there a difference?
There are numerous examples of true 2 factor authentication that is NOT 2 steps. E.g. biometrics of how you type in your password (aka behavioral biometrics). The rest of the answer is similarly wrong.
May
8
comment How to prevent user from removing disabled attribute and manually editing role?
@TimWilliams why are you so focused on PHP? There are plenty of other, much better options - and not to mention that this is a security site...
May
5
comment How many combinations does a specific password policy allow?
Very true. However I would take your point further, and note that absent any restriction, guidance, or mitigating circumstance, all else being equal a majority of users would still choose trivially simple passwords, even if these do not show up in existing research. E.g. "1234567890", or "1qaz2wsx3edc". The important point of equiprobability is often forgotten, but that is the base assumption that gives "how much information can be encoded" any value.
May
4
comment Why is a public key called a key - isn't it a lock?
If y'all want to discuss the validity of this type of conversational question, or non-practical terminology questions, why dontcha take it over to Information Security Meta...
May
1
comment Becoming HIPAA Compliant
Hi Kevin, welcome to Information Security! Can you include specific details in your answer? Link only answers are not productive here (linkrot, searchability, etc).
Apr
30
comment Threat Modelling Application Decomposition
Just a general comment, you should separate the authentication process from the other processes (you have the other 2 flowing through the "Check Password" process), whereas the authentication itself is really a single process. If you need to, you can model it a layer deeper (but I don't think you do) - at each layer you want to be keeping it as simple and direct as possible. Also remember you need to be focusing on flows - "wifi data" doesn't flow through the password check...
Apr
30
comment Threat Modelling Application Decomposition
Hi @h1h1, welcome to Information Security! I'm not sure how well this question fits our site as it is, but I'll leave it for now...
Apr
30
comment How can I set my server to only accept requests from my own client app? (similar to SSL Client Certificates)
again, that merely moves the client secret around - a malicious user would still be able to find it and use it for his own bogus app.
Apr
29
comment putting my password in a php file (phpmailer)
note that the value should be encrypted in the configuration file...
Apr
29
comment Does it increase the security if we split data to n pieces and encrypt each one with different key and different algorithm?
@Ali so as I understand Rabin's IDA (and I don't really...), this would effectively be similar to the 3rd scenario? I.e. attacker needs to break most of the chunks - how many depends on how the threshold is configured, but still would be most of them. So it seems to me that it is unlikely to be effectively better, as I explained, in which case you are worse off for the added cryptocomplexity with no benefit.
Apr
29
comment Is there a layer 1, 2, 5 and 6 DDoS attack?
As an aside, you should know that the OSI model is irrelevant, since it is not in use and the TCP/IP model does not fit well with the OSI model. Despite that, the terminology - such as "layer 7" meaning the application layer - still has stuck, which is why you wont often see layers 5/6 mentioned, since these dont strictly exist as such in TCP/IP...
Apr
22
comment Solution for Protocol Downgrade Attacks
Hi djrecker, welcome to Information Security. Can you please elaborate your question a bit, explain what you mean. What protocol, what kind of attack? How does SCSV solve this, why doesn't TLS? What exactly are you looking for, and include any background information and previous research you may have done... (I'd rather not close this unless necessary, so it doesn't go back to crypto.se).
Apr
22
comment Why does the user pick the password?
@SteveDL or even further, perhaps those developers are themselves malicious towards other sites.... xkcd.com/792
Apr
22
comment Popular Security “Cargo Cults”
@Hyppy That's the point, these are "cargo cults" - i.e. not correct. As to your point - SHA-2 is not acceptable for password protection either - see security.stackexchange.com/a/31846/33
Apr
22
comment Why does the user pick the password?
@RenéG that's great, you have a super strong password... that you then went and shared on a few dozen different sites. At that point it doesn't matter how much entropy there is, one of the other sites knows your password. xkcd.com/792