Collaborate Disseminate
Haven’t been using Uber for quite a while and now just bumped into this feature called "Verify my Ride":
Verify Your Ride is a PIN verification feature that provides an
optional extra layer of protection to ensure you’re getting… Continue reading How does Uber PIN ("Verify my Ride") feature secure anything?
Where the custom origin server for an AWS CloudFront distribution is an EC2 instance accessible with a public DNS record, do CloudFront edge locations talk to it over the open Internet — as opposed to AWS-only network?
If they use AWS-only… Continue reading Do CloudFront edges talk to custom origins over open (non-AWS) networks?
There is obviously no doubt that hypervisors technically can inspect the virtualized hardware of the guests: read the RAM, see what the CPU is doing etc.
The question is: how far have modern hypervisors advanced into actually offering it a… Continue reading How easy can hypervisors see into the guest OS?
Logging in to websites using mainstream IDs (Google/Facebook/Github etc.) by means of OAuth (or similar) has nowadays become a feature that people expect.
Not that long ago the corresponding user experience included popups a… Continue reading Can websites detect if visitors are logged in to mainstream ID providers and collect their IDs?
I do not use Facebook but recently I created an account for the purpose of connecting it to an app. I uploaded several photos of myself to Facebook, did what I needed with the app and deleted the photos.
The next day I tried to login to m… Continue reading How can Facebook verify my face if it should not have one?
We are raising a SaaS product that allows businesses to setup and orchestrate selling of a certain class of goods/services. This product has an API in its core and an ecosystem of various apps around it. These include web app… Continue reading Public API security: authentication vs. rate limiting etc
Often there is a need to use unofficial Linux software repositories (e.g. media codecs, wireless card drivers etc.) and hence the need to decide whether to trust them.
I am trying to figure out how much time I should be spen… Continue reading Are there known incidents of Linux malware coming from unofficial repositories?
AWS provides the ability to encrypt EBS volumes, the value of which I am wondering about. In the “Overview of Security Processes (October 2016)” whitepaper, page 24, they say:
Encryption of sensitive data is generally a g… Continue reading What is the threat model for AWS EBS volumes encryption?