Collaborate Disseminate
I have recently seen some legacy systems which used an unofficial Google API to perform spell checking. Clients would send a list of words to http://www.google.com/tbproxy/spell which would respond with spelling suggestions.
I am curious i… Continue reading Was Google’s unofficial spell check API part of a huge data breach?
During a web application penetration test, while attempting to access a system resource (win.ini), I encountered a specific 404 error. The server revealed certain sensitive information in the process.
Physical Path
C:\inetpub\wwwroot\we… Continue reading Sensitive path: Is it possible to exploit any particular attack? [closed]
I need to protect sensitive data by doing data encryption at rest. Context : I have at least the data of 20 app to protect. I want protection from those with legitimate access to the virtual machine hosting the database (sysadmin) or the d… Continue reading What are good data-at-rest encryption strategies for sensitive data?
TL;DR Is it possible to create an end-to-end encrypted web application where newly created users are able to access data encrypted before their creation?
My plan is to develop a (let’s call it a Customer-Managing-App). This app should als… Continue reading How to implement secure E2EE for a managing App
We will be putting our own server in a data centre using a colocation service. Our server and our physical SonicWALL hardware firewall will both be stored in a strong server steel safe that will be locked by a PIN number. The 60kg safe w… Continue reading Can an employee of a data centre steal our sensitive data stored on our server located in a colocation rack via an "inside job"? [closed]
I’ve been reading a bunch on how caching of web pages is handled, I feel like I have a good grasp on everything, but I’ve encountered something I don’t understand.
I’m testing a site and it sends the same caching headers on every HTTPS res… Continue reading Why is one particular page not being cached, and the others are? all have same caching headers [migrated]
I was registering on isc2 website for a certification exam and saw that the date of birth was a "required" field to be filled out. I skimmed through their privacy policy, etc, but didn’t see a reason why this piece of data was b… Continue reading isc2 website is asking for date of birth to register for exam, should i be concerned? [closed]
This dialog pops up upon running the command.
The dialog is essentially saying: "By using this software, it is the user’s sole responsibility for any sensitive information provided to Microsoft and other party."
When you open Li… Continue reading ListDLLs command (Listdlls.exe) Shady EULA
I work in the medical field across multiple locations, often outside of areas where internet is easily accessible. As part of my work, I keep a few different patient records on a Mac laptop. In the interest of patient privacy and protectio… Continue reading Privacy when using professional data recovery [closed]
During my penetration testing on the target, I noticed that passwords were being saved in the IndexedDB file even when i did not saved in the browser.
To verify this, I logged out, closed the browser, and upon reopening the IndexedDB file,… Continue reading Insecure Local Storage [closed]