36,258 reputation
1485155
bio website linkedin.com/in/avidouglen
location Israel
age 40
visits member for 4 years, 7 months
seen 28 mins ago

Security expert and experienced Windows programmer


Jun
30
comment What are the drawbacks of login request throttling?
Personally, I am very anti-CAPTCHA in almost all scenarios it is commonly used (and in general, for that matter). That said - if this is a threat that you need to mitigate, I would suggest implementing a conditional CAPTCHA - e.g. after the 2nd time it gets locked. That said, at some point other mitigations are called for, e.g. blocking (or graylisting) the IP, etc.
Jun
30
comment What are the drawbacks of login request throttling?
@paj28 "short" is very context-dependent. While there is a valid threat of repeated locking, such that even 5 minute timeout would cause an account DoS - I at least have not seen that. It would likely be either very targeted (eg a personal attack, which is easier to handle), or a hit-and-run style to blanket all the thousands of users, once. Persistent account lockout for many users (i.e. repeatedly locking each account every 5 minutes) seems that would require quite a bit of resources.
Jun
29
comment What are the drawbacks of login request throttling?
@paj28 it varies. Basic technical solution is short lockouts, as the OP mentioned. Others have put in CAPTCHAs (which, while I am not a fan, can help raise the bar a bit). Oh yeah, and then there is always that one that decides to abolish lockouts altogether :-S
Jun
28
comment What are the drawbacks of login request throttling?
@paj28 that is not correct, I have seen this at non-megascale sites also - banking apps, auction and sale sites, even corporate systems...
Jun
23
comment How critical is it to keep your password length secret?
The total amount of entropy provided the by password length is not too difficult to calculate, or rather the MAXIMUM entropy... let's assume passwords can be any length between 1 character and 32, then it is 5 bits of entropy at most, with of course a heavy bunching down near the bottom by the minimum required length. Of course, some banks will restrict you to 12 characters (minimum 6), so that's only 2.5 bits AT MOST. All that is of course assuming that the length is secret, which its not...
Jun
23
comment Why do so many banks have relatively weak e-banking security?
@NateKerkhofs Shame on you! SwiftOnSecurity definitely IS the real Taylor Swift, she said so herself! ;-)
Jun
22
comment Dom based Xss Query - location.hash
@m1ke or even a simple "document.write()", or any element.append, or or or...
Jun
21
comment Why is it insecure to store the session ID in a cookie directly?
@gabeio 1) While I appreciate the offer, its big task to cover all relevant dependencies and such. So thanks, but I'm not going to review all the relevant code. 2) Usually it is not the crypto library that is broken, but how it is used. 3) HMAC is not what is typically known as "signing", so if the devs are confusing between known terminology it just enforces what I suggested, the chance of getting something wrong in the implementation. 4) all that aside, it doesn't matter, since what I said still stands: crypto is delicate, don't throw it around contextless, if you do you may break something.
Jun
21
comment Why is it insecure to store the session ID in a cookie directly?
On the other hand, the downside of just throwing on some cryptodust all willy nilly without considering the context and threats, is that these things are delicate. If you throw on broken crypto, on top of an already strong sessionid, you might weaken it needlessly. (I'm not saying that library's crypto IS broken - but I am saying it is a non-negligible probability that it might be).
Jun
21
comment Why is it insecure to store the session ID in a cookie directly?
Again, if the session id is properly constructed - long, random, etc - then guessing the session id is irrelevant, and tamper detection does not add any significant protection from that threat. I still don't understand why you are worried about tampering as a threat - if the attacker tampers with his sessionid, then it would no longer be valid... which is exactly what we want.
Jun
21
comment Why is it insecure to store the session ID in a cookie directly?
@gabeio My point is that there is typically no need for this, however if you have a specific threat you are worried about then that is what should be mitigated specifically.
Jun
21
comment Why is it insecure to store the session ID in a cookie directly?
@gabeio What is the threat you are trying to mitigate here? An attacker trying to guess valid sessionids? If so, then tampering is irrelevant, as long as you don't accept invalid ids (though you might want to look at some rate limiting). Or are you worried about something more esoteric, like SQL injection based on the sessionid? Well then you should prevent SQLi by using all the proper mitigations, and anyway the sessionid should just be a lookup to retrieve the session data (usually in memory, though this could be in some persistent state db).
Jun
21
comment Is it a good idea to use the user's username as a salt when hashing a password like hash(username_str + password_str)?
See also this ancient answer on SO - stackoverflow.com/a/536756/10080 (it predates security.se...)
Jun
21
comment Why is it insecure to store the session ID in a cookie directly?
Hi, welcome to Information Security. I'm not sure what makes you think that it is at all insecure to store the user's sessionid in his cookie (as long as you do it right). From what I can tell, you found that some random js library does something unintuitive. That doesn't mean it is insecure, or that that is the reason for it. You shouldn't be surprised if this is a halfbaked idea...
Jun
18
comment Trying to keep high school students out of the Wi-Fi network
Here is a non-technical idea: This is a school, right? So educate them. Teach them the importance of consequences, acceptable use, the illegality of hacking... and yes, proper use of the internet. I mean, give them access, to a separate filtered network if need be, and create some curriculum around that. Classes, internet safety, strict compliance with whatever AUP, etc... Give them access to the network, and use it to teach them to be good internet citizens. And, how to use the internet productively, to assist in their education.
Jun
18
comment How to delete skype chat history?
Mancho, please notice what site you are on. This is a security site, random questions on general computer usage do not belong here. Please read the help center.
Jun
17
comment Close XSS vulnerability
Find the string in the page's source. What does it look like? You need to figure out if it is being blocked somewhere along the way, or if it is really inject but simply does not work.
Jun
17
comment Close XSS vulnerability
IE also has a pretty strong XSS blocker (even though it is possible to bypass, but then same with Chrome...)
Jun
17
comment Should I change the password of my password manager regurlarly?
I think your assumption should be made explicit: you are assuming that this is a strong password, which wouldn't be brute forced in any reasonable timeframe. A weak password, on the other hand, might potentially benefit in certain circumstances from a password change - but then, you'd be better off just swapping to a strong password, anyway.
Jun
17
comment What issues are most important to cover in Corporate Security Policy?
@JohnnyUtahh not really relevant, that was just when we were bootstrapping the site, from a set of merged proposals...