28,850 reputation
1168143
bio website linkedin.com/in/avidouglen
location Israel
age 39
visits member for 3 years, 9 months
seen 7 hours ago

Security expert and experienced Windows programmer


Aug
5
comment How to deal with misbehaving clients on an authoritative server?
This is squarely a security question, definitely not at all SF, not even programmers.se - its not about "how to do it", the question is basically "what do we do with misbehaving users / requests". If this was on programmers.se, it should be migrated here.
Jul
29
comment How should I distribute my public key?
hehe DNSSSEC lawl @PieterEnnes
Jul
22
comment Google indexed pictures or content
@MarkC.Wallace unless the answer was removed!
Jul
21
comment Tools to make a security researchers life easier - tracking vulnerability research
+1, but I would just add that you should also include some security fields, starting with marking it as being "security", and having a risk, at the very least. Later you can add additional fields, like vuln class, exploitation, etc.
Jul
20
comment MAC vs DAC vs RBAC
Welcome to Information Security! This is related but not a duplicate, might have interest for you: security.stackexchange.com/a/348/33
Jul
17
comment Is “the oft-cited XKCD scheme […] no longer good advice”?
@wfaulk Password Safe is Bruce Schneier's creation, so his argument about the competition still stands. Your fail statement fails ;-)
Jul
17
comment Is “the oft-cited XKCD scheme […] no longer good advice”?
@Doorknob "random thing I thought of" - that is a contradiction. Humans do not think of random things, in fact humans are very poor generators of entropy. The emphasis and assumption is that these are actually random, i.e. NOT something you "think of".
Jul
10
comment What implementations are possible for dual control?
@makerofthings7 ymean CredProv, right? GINA is so 2004. ;-)
Jul
10
comment Is “the oft-cited XKCD scheme […] no longer good advice”?
No, that's not what the xkcd advises, I suggest you read it again - and the analysis in the relevant question here (linked above).
Jun
28
comment Why refresh CSRF token per form request?
@Gili yes, exactly as D.W. said, that was my intention exactly.
Jun
27
comment Why refresh CSRF token per form request?
@Gili yes, that's exactly the point.
Jun
27
comment Why refresh CSRF token per form request?
@Gili the problem with double-submit cookies is that this typically is referring to the normal, already-existing session cookie - and this should not be accessible to JavaScript (e.g. using the HttpOnly flag). Using this technique may prevent the CSRF attack, but would open the session cookie to other issues, such as making it more vulnerable to possible XSS vulnerabilities. There are techniques which work just fine, without causing other, separate vulnerabilities.
Jun
26
comment Why are brute-force password-cracking attacks not automatically detected and thwarted?
Well.... not "mostly". Reasonable systems, sure - but that's not "most"... ;-)
Jun
25
comment Convincing my manager to use salts
I want to point out that I wouldn't blame the manager in this case - I blame the consultant who did a pisspoor job of halfsplaining salts to the clueless boss. He obviously heard that explanation from somewhere...
Jun
25
comment Convincing my manager to use salts
This answer belongs on The Workplace.
Jun
24
comment digitally signing a document
What is wrong with cryptographic digital signatures? Or are you just not familiar with the concept. Signing algorithms such as RSA, DSA, etc do all of this very well (with the exception of the ink signature image). No reason to create a new square wheel...
Jun
20
comment Properly secure an API
What @DavidHoude asked. I'm not sure what your actual question is?
Jun
20
comment In two step authentication, should I check step 1 before proceeding to step 2 or check both at the end?
+1. This is not a good idea, there is no real reason to be having this second step. Either the user knows the password and is authenticated after the first step, or... or not. Why even bother with asking additional letters? This does not add any level of security. Some banks used to do this a few years ago, when they bought into the snake oil that his counts as a "second factor". It does not.
Jun
19
comment How can I convince my customers not to send Credit Card data over email?
"The hackers can steal all emails" would help much more for the common non-techie person. Or maybe "The NSA steals your CC to buy their supercomputers!"
Jun
17
comment How is the new “Dyer” malware bypassing SSL?
Abbas, @edvinas.me comment actually shoots straight to the heart of the issue - once you allow the malware to run on your machine, it is no longer your machine. The precise mechanism used to bypass SSL is uninteresting, since there are trivially many possible options. It's like asking "which functions did they use" or "what language did they write it in" - possibly relevant for some niche research, but not really important to your risk model or mitigations.