Collaborate Disseminate
A bit of a “business as usual” week this one, but then this business is never really “usual”! I start out with a talk at McAfee’s MPOWER conference in Sydney and a bit of chatter about some upcoming ones (including the one I still can’t talk…
I run a workshop titled Hack Yourself First in which people usually responsible for building web apps get to try their hand at breaking them. As it turns out, breaking websites is a heap of fun (with the obvious caveats) and people really get into the exercises. The first one…
Continue reading Locking Down Your Website Scripts with CSP, Hashes, Nonces and Report URI
Loads of bits and pieces this week ranging from travel (including something truly awesome that I can’t go into detail on just yet) to Report URI to HIBP. There’s also the competition for the Lenovo ThinkPad where I talk about the 4 finalists and if you’re reading this within about…
Here’s something I hear quite a bit when talking about security things:
Our site isn’t a target, it doesn’t have anything valuable on it
This is usually the retort that comes back in defence of some pretty shady practices and in the mind of the defendant, it’s a perfectly reasonable…
I’ve actually had a day off today. Well mostly – I am still writing this piece and publishing a data breach – but I’ve pretty much spent the day between pool, beach and jet ski hence my being a bit dishevelled today 😀
Be that as it may, it’s been a…
It seems that there is no limit to human ingenuity when it comes to working around limitations within one’s environment. For example, imagine you genuinely wanted to run a device requiring mains power in the centre of your inflatable pool – you’re flat out of luck, right? Wrong!
Or imagine…
Continue reading Bypassing Browser Security Warnings with Pseudo Password Fields
What if I told you… that you can get visitors to your site to automatically check for a bunch of security issues. And then, when any are found, those visitors will let you know about it automatically. And the best bit is that you can set this up in a…
How do you authenticate people based on data attributes they know when that very information is continually popping up in data breaches? It’s a hard problem with no easy answers. Continue reading Security Sense: How Do You Do Knowledge Based Authentication When All Knowledge is Public?
I’m between (short domestic) trips, I’m playing with my new iPad and I’m working on something really, really cool I’m going to be talking about next week. Seriously, this is a big thing that’s been in the works for a while now and I’ll be covering it in detail in…
Friends who follow what I’m up to these days will see that I’m often away from home in far-flung parts of the world. What that means is a lot of time on planes, a lot of time in airports (which is where I’m writing this now) and a lot of…
Continue reading Do Something Awesome with Have I Been Pwned and Win a Lenovo ThinkPad!