31,294 reputation
1275149
bio website linkedin.com/in/avidouglen
location Israel
age 39
visits member for 4 years, 1 month
seen 8 hours ago

Security expert and experienced Windows programmer


8h
comment How does Authy's 2FA work, if it doesn't connect to the server?
@tetsuo that's what I was saying - SMS can never be a 2nd factor (at least not the "something you have" part), since that's not how SMS really works - you don't actually have to have the designated phone to receive it. Your explanation of Authy just proves this... Or anyway, it would be a pretty poor implementation of "something you have" if you do try it...
2d
comment Multiple Gmail accounts on the same device
@TerryChia I disagree. This goes directly to protecting your privacy online, and privacy is completely on topic here (soconfusing yes, this is the correct site for privacy q's). However, the problem is the 2nd part of Terry's comment - there really is no way of knowing for sure. Moreover it could easily change in the future... Also, why just google? the same q could apply to any email provider, social network (e.g. facebook), and so on.
Dec
21
comment How The Sony Hack Was Traced, and So Quickly?
twitter.com/SwiftOnSecurity/status/546426218489208832
Dec
21
comment Why study Information Security?
Bewildered welcome to Information Security! I suggest you take a few moments to take the tour, so you can see how this site works - we don't have much conversational, subjective style questions here. Your are welcome to jump in to the DMZ (InfoSec chatroom) though - always happy to be conversational and subjective there! Btw I was going to comment that it sounds like you know EXACTLY why you are interested, but @cremefraiche already answered you... :-)
Dec
18
comment Is SSL more secure than encoding?
Heck, I would even say "anyone with the technical capabilities to intercept your message over the air" would be able to see right through it.
Dec
18
comment Is SSL more secure than encoding?
Q: "If you call a dog's tail a leg, how many legs would the dog have?" A: "Four, because it doesn't matter a damn what you call the tail, it's still not a leg."
Dec
18
comment Is SSL more secure than encoding?
Why on earth would you call that security? It's not even "... by obscurity". It's like that guy from the kids' song, Yankee Doodle - just cuz you call it "macaroni", doesn't mean it is anything BUT a feather.
Dec
18
comment Things to remember while building a password manager
Also required is in-memory protection, and don't forget about the component properties, and if this is in .NET or Java you have to worry about immutable strings, and and and...
Dec
18
comment Things to remember while building a password manager
There is no such thing as a "simple" or "basic" password manager. Unless it is broken, and worthless...
Dec
18
comment Things to remember while building a password manager
@Curious: Because a password manager is never simple.
Dec
16
comment What Man-made Physical Threat Could Pose Severe Danger to a Server Farm?
Not my realm of expertise, but I would lean more towards something with the HVAC - broken AC units, for example, will quickly lead to massive server overheating and crashes, sometimes worse. You could try to make that extreme... In that scenario (as one of the answers stated a threat to machines but not people), it would be more reasonable to deal with up-to-minute backups, since the protocol is (usually) to shut down servers in an orderly fashion and perform failover to the backup site - but not in an immediate "flip the switch" fire style. But then again as I said, this is not my expertise.
Dec
11
comment Remote Registry allows bypass of 2FA enforcement with 1FA
ephams.com/2013/08/09/…
Dec
11
comment Remote UAC bypass and Microsoft does not regard it as security Boundry
Or, equally likely, didnt realize that he already approved the UAC prompt when he opened MMC.exe in the first place.
Dec
11
comment Confusion about keepass portable and keyfile on an USB-stick
Correct. You would need a very strong password for your cloud service, and remember that - and you would also need to remember another, different, very strong password for your keepass database. I recommend Diceware passphrases - easy to remember, and can be ridiculously strong (I have no problem keeping half a dozen 5-word passphrases in memory, and I'm practically senile. Though any more than that would be a problem...)
Dec
11
comment Remote UAC bypass and Microsoft does not regard it as security Boundry
@raven for the record (relating to your comments elsewhere) it is not "the mods" downvoting your questions, it is the community as a whole - because they were not good questions. Likewise, if your questions get closed, it is not because we don't like your SUPERHACK, again it is because it is not a good question, that fits well on our site. Please take a few minutes to take the tour, and peruse the help center.
Dec
9
comment generate certificate at runtime and validate
Resetting close votes so this doesn't wrongly get migrated to the wrong site. It belongs here.
Dec
8
comment Application-Server connection security
@VBTheory Even before the drawing board - a bit more studying perhaps. There is no magic in security, you need to understand why you choose any mitigation, how it mitigates, and etc. A bit more background (e.g. on the relative merits of PHP) wouldnt hurt either... Good luck.
Dec
7
comment PBKDF2: can the salt be known from the hash?
Wait, the password is being salted with... the same password? That does not sound healthy, regardless of the KDF. In effect instead of KDF(password + salt) you're basically doing KDF(password + password), right?
Dec
7
comment Is there scan-me-for-vulnerabilities services?
Interesting, yes (at least to some people), but off-topic for this site - because as the links above state, recommendation questions are not a good fit for StackExchange. Please take a few minutes to take the tour, and check out the help center on this subject.
Dec
7
comment Is there scan-me-for-vulnerabilities services?
@litigious.formalism umm... no you haven't? The problem with the question is that questions asking for recommendations of a product / tool / service / [any other X] are not a good fit for StackExchange, for the reasons mentioned above.