29,185 reputation
1169144
bio website linkedin.com/in/avidouglen
location Israel
age 39
visits member for 3 years, 10 months
seen 14 hours ago

Security expert and experienced Windows programmer


14h
comment Identifying Memorable Composition Rules
This may help, just about exactly the survey you are wondering about: ted.com/talks/…
14h
comment What is the algorithm of bcrypt?
I'm not sure what you are asking that is not clearly answered on Wikipedia page for Bcrypt? If you have a specific question please clarify.
1d
comment Where are my passwords stored in browser?
Actually, if you click "remember me" in a web form, odds are it is being stored by the app in a cookie, though it is possible that it is in client storage. If you let the browser itself save it, via the popup/toolbar/whatever, then it depends on the browser mechanism. Either way, this is not a security question...
2d
comment How session cookies work?
en.wikipedia.org/wiki/HTTP_cookie
Sep
14
comment Is null-byte injection possible in Java filenames?
Sure, if you want to expand this in to a proper answer... :-)
Sep
11
comment Is null-byte injection possible in Java filenames?
Wow, thanks for the update Dave. Can you provide a link, and some more technical details?
Aug
31
comment For an HTTPS web application, is it worthwhile to encrypt the password before POSTing it, to keep a MITM attacker from harversting it?
This is a rare case in which I would hazard a guess as to the identity of the pentesters, and obvious incompetence aside, I would point out (if it is indeed the company I believe it to be) that they have a vested interest in this misguided thinking, having just spun off a startup company to build and sell such counter-productive products. As @aviv mentioned, their recommendations are worse than the "problem" they purport to solve - in fact I'd run across their product that does just that, at a client engagement... I didn't know it was a commercial product, I called it out as a vulnerability.
Aug
21
comment If you have option to choose between static code analysis vs dynamic code analysis which one would you pick and why?
Which would you rather, a dentist or a heart specialist? I can't afford to send you to both.
Aug
5
comment How to deal with misbehaving clients on an authoritative server?
This is squarely a security question, definitely not at all SF, not even programmers.se - its not about "how to do it", the question is basically "what do we do with misbehaving users / requests". If this was on programmers.se, it should be migrated here.
Jul
29
comment How should I distribute my public key?
hehe DNSSSEC lawl @PieterEnnes
Jul
21
comment Tools to make a security researchers life easier - tracking vulnerability research
+1, but I would just add that you should also include some security fields, starting with marking it as being "security", and having a risk, at the very least. Later you can add additional fields, like vuln class, exploitation, etc.
Jul
20
comment MAC vs DAC vs RBAC
Welcome to Information Security! This is related but not a duplicate, might have interest for you: security.stackexchange.com/a/348/33
Jul
17
comment Is “the oft-cited XKCD scheme […] no longer good advice”?
@wfaulk Password Safe is Bruce Schneier's creation, so his argument about the competition still stands. Your fail statement fails ;-)
Jul
17
comment Is “the oft-cited XKCD scheme […] no longer good advice”?
@Doorknob "random thing I thought of" - that is a contradiction. Humans do not think of random things, in fact humans are very poor generators of entropy. The emphasis and assumption is that these are actually random, i.e. NOT something you "think of".
Jul
10
comment What implementations are possible for dual control?
@makerofthings7 ymean CredProv, right? GINA is so 2004. ;-)
Jul
10
comment Is “the oft-cited XKCD scheme […] no longer good advice”?
No, that's not what the xkcd advises, I suggest you read it again - and the analysis in the relevant question here (linked above).
Jun
28
comment Why refresh CSRF token per form request?
@Gili yes, exactly as D.W. said, that was my intention exactly.
Jun
27
comment Why refresh CSRF token per form request?
@Gili yes, that's exactly the point.
Jun
27
comment Why refresh CSRF token per form request?
@Gili the problem with double-submit cookies is that this typically is referring to the normal, already-existing session cookie - and this should not be accessible to JavaScript (e.g. using the HttpOnly flag). Using this technique may prevent the CSRF attack, but would open the session cookie to other issues, such as making it more vulnerable to possible XSS vulnerabilities. There are techniques which work just fine, without causing other, separate vulnerabilities.
Jun
26
comment Why are brute-force password-cracking attacks not automatically detected and thwarted?
Well.... not "mostly". Reasonable systems, sure - but that's not "most"... ;-)