Collaborate Disseminate
Do passkeys offer more security for intranet websites compared to passwords?
I know there are additional methods like 2FA to get more security, but I just want to look at a optional replacement for simple password-based authentication over… Continue reading Passkeys versus passwords for intranet websites
I’m creating a pastebin-style application which stores notes and has the following options:
Ephemeral, where it is deleted as soon as it is read
Encrypted, where the content is encrypted before being sent to the server (used to determine … Continue reading Encrypted Note Password Confirmation
Lately, my website has had a lot of fraudsters signing up and getting past my security checks.
I use vpnapi.io and stopforumspam.com to vet new registrations but all of the IPs this scammer is using are coming back clean – no VPN, not a To… Continue reading How are these scammers operating from valid IPs? [duplicate]
I would like to protect my web application and its API endpoints using an OpenAPI spec. However, I have not proactively documented my application using an OpenAPI specification.
I would like to utilize a tool to help me get started with ge… Continue reading How to generate an OpenAPI spec from web traffic? [closed]
I noticed that web apps like Gmail, Microsoft, Roundcube etc. when logging in, times out.
To be more specific – if I i.e. open up Gmail and enter the username or NOTHING AT ALL(!) and after two hours or so get back to the tab and try to lo… Continue reading What security feature is this exactly?
Scanning all of spidered URLs with a tool such as OWASP Zap can be computationally expensive on large apps. Have there been any studies on the adequate number of URLs (just the unique resources) to scan to have, let’s say, 95% confidence l… Continue reading Web app vulnerability scanning: how many URLs to check?
I have an HP printer which uses DHCP to connect to the local network (LAN). My DHCP forces a specific IP address to make it easier on me.
I also added the IP address in my /etc/hosts:
10.3.3.3 printer
Then I use http://printer/ in m… Continue reading Trying to access my HP printer via a device name failed today; would this be a new printer feature? [closed]
It is possible to clobber document attributes, e.g.:
<img name="cookie">
…
typeof(document.cookie)
//=> ‘object’
Is there any way to prevent this from happening, access the original value, or detect it has happened (b… Continue reading Is there a way to prevent/detect DOM Clobbering in the browser?
Let’s say I have an e-commerce organization. My organization has two security authorities A and B. The authority A manages access to data related to user orders, and the authority B manages access to data related to user payments.
My organ… Continue reading CVSS3 Scope change question
What is the best practice for allowing users to reset a passkey (WebAuthn)?
Should I just have them click a link in their email like it was a password, or is there a more secure way of doing it? In addition, is there best practice way of a… Continue reading What is the proper procedure to allow users to reset their passkey