Collaborate Disseminate
I’m new to Vault and its patterns but think they’re great, having to manually unseal a Vault instance gives some great security. However it seems like those benefits are somewhat reduced by a weak link — authenticating servi… Continue reading Best practices for automated service authentication with Vault
I am going to be using a Symfony SMB Bundle like this to browse a Windows File System through PHP.
To do this – I’ll create a Web API that will return a list of files and directories in a directory so you can browse through … Continue reading Sending Credentials On Each Request
My girlfriend’s Macbook Air gave off a loud, electrical pop! and instantly became an expensive metallic paperweight with a slight odour of burnt things (though that may have been High Sierra). Apple have (finally) agreed to r… Continue reading Apple asked for password to recover data during repair, I said no
2017 will be remembered for some of the worst hacks and data leaks. Equifax, WannaCry, Goldeneye and Uber’s concealment of the leak of 57 million user records have apparently taught the average internet user nothing about security. Users still ha… Continue reading ‘starwars’ joins the top 100 worst passwords list in 2017
I have looked all over online as well as this site to try to find out more information regarding the security of this, but haven’t found anything. In my particular case, the product is a website, but I think this question app… Continue reading Is it good or bad practice to allow a user to change their username?
Dutch IT security consultancy/service provider Fox-IT has revealed on Thursday that it has suffered a security breach, which resulted in some files and emails sent by the company’s customers to be intercepted by an unknown attacker. The attack On… Continue reading Security company Fox-IT reveals, details MitM attack they suffered in September
I work as a tester at a company that makes network security appliances, I am having some discussions with a developer about a feature.
The feature is that the notification e-mails sent to the user by the appliance will be se… Continue reading Is it a bad idea to ask for user e-mail and e-mail password?
I work as a tester at a company that makes network security appliances, I am having some discussions with a developer about a feature.
The feature is that the notification e-mails sent to the user by the appliance will be se… Continue reading Is it a bad idea to ask for user e-mail and e-mail password?
Before you screen “No, never!”, please read on 🙂
Question:
Is hard-coding IAM creds with extremely restricted permissions (only GET requests to s3) ok? I realize that there are other ways, but they all involve a good amount… Continue reading Should I expose AWS Credentials on github?
This is interesting research and data: With Google accounts as a case-study, we teamed up with the University of California, Berkeley to better understand how hijackers attempt to take over accounts in the wild. From March 2016 to March 2017, we analyzed several black markets to see how hijackers steal passwords and other sensitive data. […] Our research tracked several… Continue reading Google’s Data on Login Thefts