Collaborate Disseminate
Is it possible to develop an application in such a way that its data in memory cant be stolen by recent attacks such as Meltdown, Spectre, Foreshadow, Fallout. Zombieload? All mitigations focus on patching hardware, BIOS or OS. But could s… Continue reading Application level protection against Meltdown, Spectre, Foreshadow, Fallout. Zombieload
I found a private key which seems to be in the putty private key format.
The key has the following header:
—- BEGIN SSH2 ENCRYPTED PRIVATE KEY —-
Subject: <sensitive>
Comment: <sensitive>
P2/56wAAA/MAAAA3a…. Continue reading Crack Putty Private Key (PPK)
X-Content-Type-Options helps to protect against attacks that take advantage of the browser trying to interpret HTTP responses with an incorrectly stated Content-Type.
But what happens when the HTTP response sets the X-Conten… Continue reading X-Content-Type-Options without content-type
There are many vulnerable web applications see OWASP directory. However, several aren’t maintained or a targeting students. Does anyone know a good vulnerable web application such as the one Troy hosts and develops that is op… Continue reading Realistic vulnerable web application [on hold]
Edit: As I am asked to clarify this question I will state it in one sentence: What is a good lockout policy for web applications, why, on what does it depend?
It is hard to find a best practice regarding account lockout poli… Continue reading Account lockout policy guidelines [on hold]
I’m looking for one or more books on modern authentication, identity management and access control. Some of the topics I would like covered are:
SPML vs SCIM
XACML and the cloud?
SSO: SAML, OAuth2, OpenID Connect, Kerberos,… Continue reading Book on IAM and the Cloud