This is different than row-level security because row-level security is going to allow you to restrict the actual data that’s shown to them not the actual report that’s shown

Refresh tokens are bearer tokens. It's impossible for the authorization server to know who is legitimate or malicious when receiving a new access token request. We could then treat all users as potentially malicious.

How could we handle a situation where there is a race condition between a legitimate user and a malicious one?

But what about a Refresh Token flow? When using a refresh token, confidential clients also have to authenticate. Public clients, such as browser-based applications, do not authenticate during the Refresh Token flow. So in a typical frontend application, refresh tokens issued to frontend web applications are bearer tokens.   In practice, this means that if an attacker manages to steal a refresh token from a frontend application, they can use that token in a Refresh Token flow. To counter such attacks, the OAuth 2.0 specifications mandate that browser-based applications apply a security measure known as refresh token rotation.

When public clients (e.g., native and single-page applications) request access tokens, some additional security concerns are posed that are not mitigated by the Authorization Code Flow alone.

Please note - any callback URL that you use with the POST oauth/request_token endpoint will have to be configured within your developer App's settings in the app details page of developer portal.

It would be nice if we could get some official word on whether this repository is affect by the catastrophic CVE-2021-44228 that is currently affecting a considerable percentage of softwares around the globe. From my limited understanding and looking at the refreshingly concise list of dependencies in the pom.xml, I would think this project is not affected, but I and probably others who are not familiar with the projects internals would appreciate an official word.

I understand that typically, it wouldn't make much sense to comment on every CVE that doesn't affect a product, but considering the severity and pervasiveness of this particular issue, maybe an exception is warranted.

As the British prime minister WilliamGladstone put it at the time in the Edinburgh Review, speaking of the remarkablePrussian success in the Franco-Prussian War: ‘Undoubtedly, the conduct of thecampaign, on the German side, has given a marked triumph to the cause ofsystematic popular education.’

it was clear that the European and US competitors werebenefiting from these changes to the curriculum in advances in commerce, inindustry, and even on the battlefield.

DHS’s mission to fight disinformation, stemming from concerns around Russian influence in the 2016 presidential election, began taking shape during the 2020 election and over efforts to shape discussions around vaccine policy during the coronavirus pandemic. Documents collected by The Intercept from a variety of sources, including current officials and publicly available reports, reveal the evolution of more active measures by DHS. According to a draft copy of DHS’s Quadrennial Homeland Security Review, DHS’s capstone report outlining the department’s strategy and priorities in the coming years, the department plans to target “inaccurate information” on a wide range of topics, including “the origins of the COVID-19 pandemic and the efficacy of COVID-19 vaccines, racial justice, U.S. withdrawal from Afghanistan, and the nature of U.S. support to Ukraine.”

How safe are investors’ assets on the KuCoin exchange? At KuCoin, we’re very much vigilant of security and cyber threats, and we ensure that our exchange is safe for trading. KuCoin allows you to trade with confidence, knowing that your digital assets are safe on the exchange. Micro-withdrawal wallets, industry-level multilayer encryption, and dynamic multi-factor authentication are a few of the levels of protection that we employ. KuCoin offers 24/7 customer support via live chat and online ticket on its help center. The supporting staff are very responsive and patient. Also, KuCoin has established about 23 local communities in Europe, SEA and other regions, providing users with highly localized service and support.

BTCM: User funds security has been the Achilles heel of the digital asset industry since its inception. Can you share how KuCoin handles its security infrastructure? Johnny Lyu: As a global exchange, security is one of our top priorities. We developed all the infrastructure and systems on our own to ensure its stability and security. We have plenty of security mechanisms to protect the crypto assets of our users and we are working with many third parties like Chainalysis and white-hats to improve the level of security. It is worth mentioning that we recently reached a strategic cooperation with Onchain Custodian, Singapore’s crypto asset custody platform. Onchain Custodian offers a custody service for the safekeeping of KuCoin crypto assets. The custodial funds are backed by Lockton, the world’s largest private insurance brokerage company, which means users’ assets on KuCoin will be double secured.

"I thought WSL ran as root in Windows" ... ABSOLUTELY NOT! Do you think we're crazy? ;) When opened normally, your Bash instances are launched with standard Windows user rights. If you want to edit your Windows hosts file, you must do so from an elevated Bash instance ... though only do this with enormous care - any other script you run in the same elevated Bash Console will also get admin rights to the rest of your machine!!

To truly alleviate poverty on a large scale, we must fix a system in which normallife experiences such as childbirth can translate into economic insecurity. Mostof the poor are not unexplainable anomalies in an otherwise well-functioningsociety. Instead, they are the normal consequence of structural arrangementsguaranteed to produce economic insecurity.

let's start giving a bit of a recap of all these vulnerabilities that I talked about and be basically aligned to what we defined as intercept for example

How do I turn off the requirement to have a lock screen?Today, I'm suddenly unable to use any Google related apps on my phone, because I am now REQUIRED to set up a lock screen on my phone. I get that you want to be super-secure for businesses using enterprise devices. I am not a business. I'm some guy who just happens to have a domain name. My only "employee" is me. I have a two email addresses: My real first name, and the shorter version that most people call me. I do NOT want a lock screen on my phone. I don't want to be forced to give myself permission to use apps on my phone. Why am I now required to add all this bull$%^? Nobody is hacking my interwebs. Give me a f#$%^& break! I don't need a lock screen. I've been using this account for everything (gmail, youtube, etc) for over five years now. I'm not interested in deleting it and going back to my gmail.com account. I'm also not interested in being forced to click multiple times just to use my phone. Let me disable it.So, how do I turn this garbage off?

In a clickjacking attack, the attacker creates a malicious website in which it loads the authorization server URL in a transparent iframe above the attacker’s web page. The attacker’s web page is stacked below the iframe, and has some innocuous-looking buttons or links, placed very carefully to be directly under the authorization server’s confirmation button. When the user clicks the misleading visible button, they are actually clicking the invisible button on the authorization page, thereby granting access to the attacker’s application. This allows the attacker to trick the user into granting access without their knowledge.

It was first unveiled during a multimillion dollar heist which led to a hard fork of Ethereum. Reentrancy occurs when external contract calls are allowed to make new calls to the calling contract before the initial execution is complete.

The more community members are free to gain governance power and influence the protocol, the easier it is for attackers to use that same mechanism to make malicious changes. 

Something has shifted online: We’ve arrived at a new era of anonymity, in which it feels natural to be inscrutable and confusing—forget the burden of crafting a coherent, persistent personal brand. There just isn’t any good reason to use your real name anymore. “In the mid 2010s, ambiguity died online—not of natural causes, it was hunted and killed,” the writer and podcast host Biz Sherbert observed recently. Now young people are trying to bring it back. I find this sort of exciting, but also unnerving. What are they going to do with their newfound freedom?

If your security locks you out of your own home just because you changed your trousers, that would be shockingly bad security.If your security permanently locks you out of your accounts because you restored your Chrome settings from backup, how is that any better?

Retirement Income Replacement Rate

What is Open source security?

Open Source Advantages and Risk Profile · 96% of applications include some form of OSS · 67% of applications contain open source vulnerabilities · 90% of software ...

Learn how to detect vulnerable open source components and keep your products secure.

The Dangers of Open-Source Vulnerabilities, and What You Can Do About It

The goal is to gain “digital sovereignty.”

The main flaw with Lineage is the phone’s bootloader must remain unlocked

DOMPurify - a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG

It detects bots/spiders and serves them a clean page

An Introduction to PLAN E Grand Strategy for the Twenty-First-Century Era of Entangled Security and Hyperthreats

The HRF design intends to operationalize entangled security (figure 8). It provides orchestration logic at ecoregional, nation-state, and local levels and is expected to vary  according to context. It comprises four main task groups: HRF support; planetary security; human security; and state security.

The hyperthreat can be outmaneuvered by humans reconfiguring their activities in two ways: security by design and security by dispersal. National security in the Anthropocene is increasingly achieved by designing systems and settlements so that enhanced security is incorporated from the start. For example, it can be imagined that each time a person refuels a car with petrol, this action empowers the hyperthreat. This leads to global warming, which creates ocean acidification and in turn reduced fish stocks, while also creating pressures for resource wars, thereby influencing whether a soldier or civilian dies and how much taxpayer resources are required for material security missions. In contrast, zero-emission transportation technologies can “design out” the slow violence and threats associated with a fossil-fuel-intensive lifestyle. This is similar for plastic use, in which case the “threat” is embodied in the high polluting design of consumable products and lifestyle activities. Likewise, other health threats and longer-term costs are embodied in hidden toxins or sugars in food products. Accordingly, peace, health, and a different form of national prosperity can be created through design, which requires a longer-term and mesh-intervention viewpoint. OP VAK has a role to play in achieving security and safety by design by linking apparently benign activities with their devastating impacts.    

Crop harvests for direct food use insufficient to meet the UN’s food security goal

Many companies send our passwords via email. Whether these emails come from our IT department, a colleague, a SaaS solution or elsewhere, it's not a good idea to send and receive passwords via email.

You cannot override defaults via query parameters - this is for security reasons. The only defaults that can be overridden are dynamic segments via substitution in the URL path.

> So disabling JS completly via about:config is not a solution. It is. Works for me (yes, no NoScript, the real thing). My main Firefox profile is like that, then I have a secondary profile for the cases I really need it for — that gets used less than once a month. Oh, and no cookies either. Luckily, hackaday works fine like that (even cookieless commenting: big kudos and thanks! That’s why I keep returning here). And LWN (I temporarily enable cookies to post), and more than 95% of the sites I care about. As it turns out, I care less and less for the other 5%: so this number is actually shrinking.

I fully agree the best solution for security is “javascript.enabled = false”

Lets go back to the original “browser as a document” instead of “browser as OS”.

As I said up-thread, it was promised from Day 1 that browsers would always execute client-side Javascript safely. That was central to its acceptance.

You don’t need microsecond timing on a freaking website – except maybe in graphics and sound, and such functionality could be wrapped and secured in an API. So think that browser makers deserve a bigger slice of blame for making their users so vulnerable. User safety needs to become important again.

It is best practice not to use user input to dictate where your app is going to redirect, this is highly exploitable.

he transitionary approach is advisable when datasecurity plays a vital role.

gives the man and his kinship group certain rights of control over the woman

This is also known as the nonprofit industrial complex

an accident in which there is a collision with terrain, water, or obstacle during the course of a flight, without indication of loss of control.

For example, suppose your API returns a 401 Unauthorized status code with an error description like The access token is expired. In this case, it gives information about the token itself to a potential attacker. The same happens when your API responds with a 403 Forbidden status code and reports the missing scope or privilege.

Now, assume your client attempts to access a resource that it MUST NOT access at all, for example, because it belongs to another user. What status code should your API return? Should it return a 403 or a 401 status code?You may be tempted to return a 403 status code anyway. But, actually, you can't suggest any missing permission because that client has no way to access that resource. So, the 403 status code gives no actual helpful information. You may think that returning a 401 status code makes sense in this case. After all, the resource belongs to another user, so the request should come from a different user.However, since that resource shouldn't be reached by the current client, the best option is to hide it.

Special case: Can be used instead of 404 to avoid revealing presence or non-presence of resource

Mabry says if you own a Hyundia or Kia, you better add extra security so you don't become the next target.

because they improve my daily interaction

Edge computing is an emerging new trend in cloud data storage that improves how we access and process data online. Businesses dealing with high-frequency transactions like banks, social media companies, and online gaming operators may benefit from edge computing.

‘Security’ takes manyforms. There is the security of knowing one has a statistically smallerchance of getting shot with an arrow. And then there’s the security ofknowing that there are people in the world who will care deeply if oneis.

When the embedded document has the same origin as the embedding page, it is strongly discouraged to use both allow-scripts and allow-same-origin, as that lets the embedded document remove the sandbox attribute — making it no more secure than not using the sandbox attribute at all.

Before we prove this lemma, we explain why such a lemma is useful for proofs in the quantumrandom oracle model.

Pretty much anything that can be remembered can be cracked. There’s still one scheme that works. Back in 2008, I described the “Schneier scheme”: So if you want your password to be hard to guess, you should choose something that this process will miss. My advice is to take a sentence and turn it into a password. Something like “This little piggy went to market” might become “tlpWENT2m”. That nine-character password won’t be in anyone’s dictionary. Of course, don’t use this one, because I’ve written about it. Choose your own sentence — something personal.

A full-featured software TPM is a large and complicated software stack

It's all too complex for our little brains to handle. And like any situation of excess complexity, we collapse dimensions until we have a structure we can comprehend. The problem, in this case, is that our simplifications create tunnels large enough for the trucks of hacker to drive through—with ease.

As many have observed, login is a broken system. Until we can be identified by factors that are unique to our personhood (biometrics, etc.) that we don't have to remember or store somewhere, these problems will persist. People have too many passwords for too many accounts.

That's not how flatpack works; the executable is hidden in a container and you need to set up the whole environment to be able to call it. Delivering a well-isolated, not-to-be-run-from-outside environment is the whole point.

Continuous threat and system behaviormonitoring• Management of access rights and privileges• Use of testbeds for assessing new threats in fielded systems• Supply-chain diligence• Certification and accreditation standards • Formal methods for identification of vulnerabilities

Sure you can abuse session but I don't like that since there is the risk of exposing credentials to client side code.

A combination of good cross-site scripting hygiene, a secure HTTP only cookie for authentication and a CSRF token is a good combination for building a secure ecosystem for your PWA and web API.

And at the end of the day, Gates is not accountable to governments or to communities. He was not elected, and there is no mechanism for him to be recalled, challenged, or held responsible for faulty policies. He could suddenly decide that he was no longer interested in supporting agriculture in Africa. In that case, the new food system Gates is importing to the African continent would collapse. Political and economic systems are being drastically altered, all at the whim of one person, one foundation.In fact, the differences between this situation — powerful individuals and institutions deciding to mess with the social, political, and economic realities of countries — and the earlier form of colonialism are thin. It’s still advertised as “good intent” and the desire to “civilize” an “uncivilized” people. The only difference is that neocolonialism is quieter and more covert. By design, it provokes less outrage. But the essential power structures remain the same.

t's also why it is so annoying to people who actually know what they are doing, when randomly the browser decides to take over a function provided for decades by the OS network stack, and with no notice start bypassing all the infrastructure they set up to their liking (like your hosts file) and funelling all their browsing habits to some shady company (Cloudflare).

This is more secure than simply opening up your server’s firewall to allow connections to port 5901, as that would allow anyone to access your server over VNC. By connecting over an SSH tunnel, you’re limiting VNC access to machines that already have SSH access to the server.

Highly Secure by Default

Remote Access is something that we are really excited about because it will allow our support team to give you a seamless and high level of support that is truly unmatched. When you need extra help, you can enable the Remote Access toggle with a single click. This will send a secure token to the Elegant Themes support staff that they can use to log in to your WordPress Dashboard. No passwords are shared and there is no need to send the token to our team yourself. It all works seamlessly in the background. While remote access is enabled, our team will be able to log in to your website and help explore whatever problems you are experiencing. You can even enable it preemptively before chatting with our support team so that we can jump right in if necessary. By default, our support staff will have limited access to your website using a custom WordPress support role. You can also enable full admin access if requested. Remote access is automatically disabled after 4 days, or when you disable Divi. You can also turn it off manually after an issue has been resolved, and of course, Remote Access can only be enabled by you, the website owner, and not by Elegant Themes or anyone else. The Remote Access system is wonderful because it saves tons of time during support chat, and it saves you the hassle of having to debug certain complicated issues yourself. It allows us to take a hands on approach to solving problems quickly, instead of wasting hours or days chatting back and forth.

a class of attacks that were enabled by Privacy Badger’s learning. Essentially, since Privacy Badger adapts its behavior based on the way that sites you visit behave, a dedicated attacker could manipulate the way Privacy Badger acts: what it blocks and what it allows. In theory, this can be used to identify users (a form of fingerprinting) or to extract some kinds of information from the pages they visit

You cannot break security if you do not understand a system better than the people who made the system, and you cannot defend your organization if you do not understand how those systems work to the same degree.

"Highly complex memorized secrets introduce a new potential vulnerability: They are less likely to be memorable, and it is more likely that they will be written down or stored electronically in an unsafe manner. While these practices are not necessarily vulnerable, statistically some methods of recording such secrets will be. This is an additional motivation not to require excessively long or complex memorized secrets."

Forcing employees to use a complex password with special characters in it means everyone is just going to add an exclamation point at the end of their existing password. This is why your accounts payable clerk has a yellow sticky note on their cubicle wall with their password on it. They just want to get their job done, and you're making it harder for them with no discernible improvement to security.

Zoom told its users that their video calls were end-to-end encrypted when actually they were protected by TLS encryption. Zoom generated and stored the keys to its users’ encrypted information on its servers rather than on its users’ devices, meaning anyone with access to those servers could monitor the unencrypted video and audio content of Zoom meetings. These servers are located around the world, often in countries where companies can be forced to share user data with law enforcement organizations. What’s worse is that, according to the most recent lawsuit, Zoom’s response made it clear that it “knew that it did not use the industry-accepted definition of E2E encryption and had made a conscious decision to use the term ‘end-to-end’ anyway”.

The confession-book, I suppose, has disappeared. It is twenty years since I have seen one. As a boy I told some inquisitive owner what was my favourite food (porridge, I fancy), my favourite hero in real life and in fiction, my favourite virtue in woman, and so forth.

U.S. Senate Subcommittee on Communications, Technology, Innovation, and the Internet, "Optimizing for Engagement: Understanding the Use of Persuasive Technology on Internet Platforms," 25 June 2019, www.commerce.senate.gov/2019/6/optimizing-for-engagement-understanding-the-use-of-persuasive-technology-on-internet-platforms.