37,103 reputation
1488159
bio website linkedin.com/in/avidouglen
location Israel
age 40
visits member for 4 years, 8 months
seen yesterday

Security expert and experienced Windows programmer


1d
comment Do card issuers give merchants new expiry dates for recurring payments?
"expiration date" - are you talking about e.g. credit cards?
1d
comment Is this code javascript vulnerable to DOM based XSS?
The simple answer is: it depends. Depends on a lot of information not present in the question, and is not possible to include in the question.
1d
comment Is sending a string (representing a HTTP message) over SSL the same as sending a HTTPS message?
@begueradj I absolutely agree with you on that, except that usually it doesn't help but hinders. That's why I said your first 3 sentences are great, the rest is misleading and confusing (besides being technically wrong...)
1d
comment Is sending a string (representing a HTTP message) over SSL the same as sending a HTTPS message?
It has been pointed out (see comments) that the OSI model is an over-generalisation and does not fit very well here. This is true. However, the use of this model is to demonstrate that SSL sits "somewhere" in between TCP and HTTP. It is not strictly accurate, and is a vague abstraction of reality.
1d
comment Is sending a string (representing a HTTP message) over SSL the same as sending a HTTPS message?
begueradj, SSL doesn't act on ANY layer of the OSI model, and neither does TLS - because they do not use the OSI model. Despite the misleading comment from Wikipedia that @Scott posted.
1d
comment Is sending a string (representing a HTTP message) over SSL the same as sending a HTTPS message?
@immibis yes, that is what I meant when I said "the CONNECT method is not anything special in HTTPS, it is part of the HTTP spec." Did I miss anything there?
2d
comment Is sending a string (representing a HTTP message) over SSL the same as sending a HTTPS message?
I really wanted to upvote you - except for the OSI model part. SSL is definitely NOT on OSI layer 5, since SSL has nothing to do with the OSI model, it lives in TCP/IP. OSI model is irrelevant ;-)
Jul
29
comment Security Implications of Neglecting the Extra Byte for NULL Termination in C/C++ Arrays
Cyan, part of the problem is that, as usual, Gibson did not quite understand the topic he was discussing, thus conflating terms often and making a general mess of things. You'd be best off completely ignoring what he said, since it's only value is in confusion. You should start fresh with a proper explanation.
Jul
29
comment OpenVPN redirect-gateway def1 bypass-dhcp not working on 3G
Hi @Gabriel, welcome to Information Security. Please do not crosspost on other SE sites, instead flag the question to be migrated over. Thanks!
Jul
26
comment How can I decrypt my files from “Cryptowall” encryption?
Also - I am sorry to say, I just had to deal with this myself (for a family member, not myself) and sadly enough it looks like they are one of the few that got crypto right - which means there is no simple way to break it :-( I really hope to be proven wrong...
Jul
26
comment How can I decrypt my files from “Cryptowall” encryption?
For one thing, stop running random programs you find on the internet - this is how you got caught in the first place! ;-)
Jul
24
comment How hard is it to intercept SMS (two-factor authentication)?
You're talking about two step authentication, not two factor. SMS cannot be a valid "something you have" authentication factor, for several reasons - but it is a good out-of-band solution, and does improve security in some scenarios.
Jul
24
comment The best algorithm for defensing DOS attack
Are you talking about DDoS? Or flooding? Or brute forcing? I think you need to read up on the basics here.
Jul
24
comment How to define the rate in rate limiting
Also, what does this have anything to do with CSP (Content Security Policy)?
Jul
24
comment How to define the rate in rate limiting
Your question is very unclear - what kind of requests? why are you rate limiting them? What are the risks and attacks you're trying to mitigate?
Jul
22
comment The best algorithm for defensing DOS attack
DoS is not an attack, it is a result, the damage from the attack. There are many different types of attacks that could result in a DoS (e.g. account lockouts, flooding, BO crashes, infinite looping, SYN flood, etc etc), and each one needs to be mitigated differently. Please be more specific about the attack you're trying to defend against.
Jul
22
comment Should I implement incorrect password delay in a website or a webservice?
@tylerl well put, however the only problem I have with this is the consideration for IPs. The problem with that is often IPs are not used by a single user - corporate proxies, shared IPs, rotating DHCP for some dialups, heck some ISPs even use NAT for their users. So cooldowning by IP could effectively DoS all other users on that IP.
Jul
21
comment Norton Security disables Windows Firewall
My recommendation? Uninstall Norton (in)security, and all other similar malware.
Jul
20
comment Should I implement incorrect password delay in a website or a webservice?
Doing account lockout properly does entail a short timed lockout, i.e. automatically releasing the account after some X number of minutes. And, in the case of the attacker that keeps trying to lockout many accounts (or the same account over and over again) - here is where you need to get fuzzy, and maybe implement a "gray list". I.e. usually not a great idea to lock by IP, but sometimes you need to, or maybe you slow that specific IP down some more. Point is that if an IP is doing so many failed logins - that IP needs some "special" attention.
Jul
20
comment Securing web applications with only a reverse proxy
Also known as "turtle security" - hard shell on the outside, soft and gooey on the inside.