Collaborate Disseminate
Background scenario:
So we had a problem where our system (Alice’s shiny widgets) generated a PDF with a quote amount for 10 widgets. Someone (Eve) took the PDF, altered it to increase the price by 20%, they then presented the PDF as an ex… Continue reading How useful is PDF signing in real world usage?
Could you please help me in understanding key areas which we need to be concentrated on Secure Design/Architecture reviews?
How Threat Modeling can be achieved ? If there is any examples / scenarios ?
Continue reading What all key areas need to be focused in Secure Design Reviews?
Best practice in term of security for the web are enforced by major actors like Google or Mozilla, but it feels a bit like something is messed up in the global design.
To mitigate all man in the middle and other types of att… Continue reading Is TLS security for web server reliable or suffer a major design flaw
Recently Telegram announced using CDN in some territories where they don’t want to place main servers.
Although the internals are not explained, according to provided diagram and information, a key is passed from Telegram ser… Continue reading Can CDN contents be decrypted by officials in new Telegram security design?
I am creating API that will serve information about users and user generated content and give the ability to upload it. I am not sure if it would be good move to include account creation in the API. I am not creating the webs… Continue reading Account creation in API
I recently purchased a satellite communicator that allows me to send a map of my location to friends and family while I’m hiking in the wilderness.
While testing out my product, I noticed that the url was constructed as so:
… Continue reading Should I contact the manufacturer if their product allows access to other users’ location information?
I recently purchased a satellite communicator that allows me to send a map of my location to friends and family while I’m hiking in the wilderness.
While testing out my product, I noticed that the url was constructed as so:
http://www.ex… Continue reading Should I contact the manufacturer if their product allows access to other users’ location information?
Note that this question describe hypothetical case, that is never meant to be used in real world.
Server communicates with clients with message structure: client_id, initialization_vector, encrypted body. Each client each day exchange wit… Continue reading Is it secure to not expire keys in symmetric encryption?
As the question says, I would like to know the difference(s) between an Architecture review and a Design review. If someone could explain the two using an example, such as an Architecture review of a network and the Design review of the sa… Continue reading Difference between Architecture review and a Design review
Two-factor authentication is growing in popularity as a security measure. For example, Google, Facebook, Twitter, and many other services all have two-step security options today as well as many banks and credit unions.
I’m wondering whet… Continue reading Is using Google Voice number for two-factor authentication a big mistake?