- Last 7 days
-
news.wttw.com news.wttw.com
-
restricted sites and critical infrastructure.
-
- Dec 2024
-
-
Emotional security. The feeling of being at home in the presence of another. Safe to be who you are, good times or bad.
I was just listening to a voice hugs episode today and they were talking about how leah has made her own self her own home becsuse she’s always moved around even as a kid. She’s really mastered feeling home in herself even though she’s alone in a foreign place. I find that so incredible
-
-
media.dltj.org media.dltj.org
-
From DEF CON 32, August 8-11, 2024
https://defcon.org/html/defcon-32/dc-32-speakers.html#54469
Abstract
Pawning countries at top level domain by just buying one specific domain name ‘wpad.tld’, come hear about this more the 25+ years old issue and the research from running eight different wpad.tld domains for more than one year that turn into more the 1+ billion DNS request and more then 600+GB of Apache log data with leaked information from the clients.
This is the story about how easy it is to just buying one domain and then many hundreds of thousands of Internet clients will get auto pwned without knowing it and start sending traffic to this man-in-the-middle setup there is bypassing encryption and can change content with the ability to get the clients to download harmful content and execute it.
The talk will explain the technical behind this issue and showcase why and how clients will be trick into this Man-in-the-middle trap.
-
- Nov 2024
-
www.youtube.com www.youtube.com
-
one man in his half a page which I actually acquired in the process of writing a book 15 years ago typ written a typewritten half a page he said what we must do we must treble our deficit treble our deficit we have a deficit which is bad we must make it three times as big and make the capitalists of the rest of the world pay for it which is exactly what happened the United States should increase its deficit and use it to create aggregate demand for the net exports of Germany and Japan and later on China
for - US foreign policy - National Security Council member suggested - triple the deficit too act as a magnet to draw in experts of other countries - Yanis Varoufakis
-
when he saw the macroeconomic statistics and he saw that from 1968 from 1968 onwards America for the first time since the 1930s had become a deficit country
for - key insight - When Henry Kissinger was Nixon's national security advisor, he saw that from 1968, the US became a deficit country - Yanis Varoufakis
Tags
- US foreign policy - National Security Council member suggested - triple the deficit too act as a magnet to draw in experts of other countries - Yanis Varoufakis
- key insight - When Henry Kissinger was Nixon's national security advisor, he saw that from 1968, the US became a deficit country - Yanis Varoufakis
Annotators
URL
-
-
Local file Local file
-
It comesafter a couple believes they have achieved a level of financial stability.
No Scrubs (Official HD Video) by [[TLC]]
TLC has ensconced the idea of not getting married or even dating if a man doesn't reach a level of financial security.
-
The architect of the Official PovertyMeasure—the poverty line—was a bureaucrat working at the SocialSecurity Administration named Mollie Orshansky.
Naturally, we will have to mention:<br /> The West Wing S3.E8 "The Indians in the Lobby"<br /> https://m.imdb.com/title/tt0745696/
-
-
www.nature.com www.nature.com
-
Having plans and mechanisms in place to prevent, detect, and respond to cyber or physical security threats
TRSP Desirable Characteristics
-
- Oct 2024
-
stevepolito.design stevepolito.design
-
@user = GlobalID::Locator.locate_signed params[:id]
GlobalID::Locator.locate_signed params
-
- Aug 2024
-
www.youtube.com www.youtube.com
-
SMS and e-mail are not reliable means of communication. They should no longer be used to communicate links spontaneously. All such communications should be considered fraudulent by default.
-
- Jul 2024
-
archive.ph archive.ph
-
First, the complexity of modern federal criminal law, codified in several thousand sections of the United States Code and the virtually infinite variety of factual circumstances that might trigger an investigation into a possible violation of the law, make it difficult for anyone to know, in advance, just when a particular set of statements might later appear (to a prosecutor) to be relevant to some such investigation.
If the federal government had access to every email you’ve ever written and every phone call you’ve ever made, it’s almost certain that they could find something you’ve done which violates a provision in the 27,000 pages of federal statues or 10,000 administrative regulations. You probably do have something to hide, you just don’t know it yet.
-
-
cyberisfull.com cyberisfull.com
-
On call. Incident response. Compliance deadlines. Like any IT job, stuff breaks. Long unpaid hours keeping up on tech to remain competitive. Dealing with the politics of your management not sincerely wanting to spend the money required to do things right and
-
writing code, reviewing code, deploying configs to harden environments, reading CVEs to know just how bad that vulnerability in our environment is and where it prioritize it in patching and what it could affect, trying to make sense of logs to determine if that oddity is an indicator of compromise or not
-
- Jun 2024
-
-
this company's got not good for safety
for - AI - security - Open AI - examples of poor security - high risk for humanity
AI - security - Open AI - examples of poor security - high risk for humanity - ex-employees report very inadequate security protocols - employees have had screenshots capture while at cafes outside of Open AI offices - People like Jimmy Apple report future releases on twitter before Open AI does
-
open AI literally yesterday published securing research infrastructure for advanced AI
for - AI - Security - Open AI statement in response to this essay
-
this is a serious problem because all they need to do is automate AI research 00:41:53 build super intelligence and any lead that the US had would vanish the power dynamics would shift immediately
for - AI - security risk - once automated AI research is known, bad actors can easily build superintelligence
AI - security risk - once automated AI research is known, bad actors can easily build superintelligence - Any lead that the US had would immediately vanish.
-
the model Waits are just a large files of numbers on a server and these can be easily stolen all it takes is an adversary to match your trillions 00:41:14 of dollars and your smartest minds of Decades of work just to steal this file
for - AI - security risk - model weight files - are a key leverage point
AI - security risk - model weight files - are a key leverage point for bad actors - These files are critical national security data that represent huge amounts of investment in time and research and they are just a file so can be easily stolen.
-
our failure today will be irreversible soon in the next 12 to 24 months we will leak key AGI breakthroughs to the CCP it will 00:38:56 be to the National security establishment the greatest regret before the decade is out
for - AI - security risk - next 1 to 2 years is vulnerable time to keep AI secrets out of hands of authoritarian regimes
-
here are so many loopholes in our current top AI Labs that we could literally have people who are infiltrating these companies and there's no way to even know what's going on because we don't have any true security 00:37:41 protocols and the problem is is that it's not being treated as seriously as it is
for - key insight - low security at top AI labs - high risk of information theft ending up in wrong hands
Tags
- key insight - low security at top AI labs - high risk of information theft ending up in wrong hands
- AI - security - Open AI - poor security - high risk for humanity
- AI - Security - Open AI statement in response to this essay
- AI - security risk - once automated AI research is known, bad actors can easily build superintelligence
- AI - security risk - model weight files - are a key leverage point for bad actors
- AI - security risk - next 1 to 2 years is vulnerable time to keep AI secrets out of hands of authoritarian regimes
Annotators
URL
-
-
www.nature.com www.nature.com
-
and the security of the system and its content
TRSP Desirable Characteristics
-
-
identity.foundation identity.foundation
-
http://example.com/didcomm
No need for transport security, given the payload is E2EE.
Tags
Annotators
URL
-
- May 2024
-
mattbrictson.com mattbrictson.com
-
If you are okay with the user appending arbitrary query params without enforcing an allow-list, you can bypass the strong params requirement by using request.params directly:
-
Performing a redirect by constructing a URL based on user input is inherently risky, and is a well-documented security vulnerability. This is essentially what you are doing when you call redirect_to params.merge(...), because params can contain arbitrary data the user has appended to the URL.
-
-
www.synopsys.com www.synopsys.com
-
Identify, prioritize, and resolve dependency risk Once dependencies are identified, Black Duck Security Advisories enable teams to evaluate them for associated risk, and guides prioritization and remediation efforts. Is it secure? Receive alerts for existing and newly discovered vulnerabilities, along with enhanced security data to evaluate exposure and plan remediation efforts. Is it trustworthy? Perform a post-build analysis on artifacts to detect the presence of malware, such as known malicious packages or suspicious files and file structures, as well as digital signatures, security mitigations, and sensitive information. Is it compliant? For every component identified, Black Duck SCA provides insights into license obligations and attribution requirements to reduce risk to intellectual property. Is it high quality? Black Duck SCA provides metrics that teams use to evaluate the health, history, community support, and reputation of a project, so that they can be proactive in their risk mitigation process.
-
Black Duck® software composition analysis (SCA) helps teams manage the security, quality, and license compliance risks that come from the use of open source and third-party code in applications and containers.
-
-
proton.me proton.me
Tags
Annotators
URL
-
-
-
- Apr 2024
-
arxiv.org arxiv.org
-
Alternatively, a simple public key canserve as an identifier, eliminating the DID/DIDDoc abstraction2
This would require having private key portable. Which is not secure.
Tags
Annotators
URL
-
-
-
Youtube Kids is an example of how the product designed for kids differs from the one targeting adults. It’s much easier to navigate thanks to bigger buttons and fewer content boxes on the page. Plus the security settings on the platform make sure that younger users are safe and have access to appropriate content. Those all are parts of a thought-through design interface for children.
Just an observation here but I remember my godchild using You tube kids whilst they stayed here and we had to double check because it wasn't all good content, you tube is kind of notorious with their bad content checks and algorithms. Elsa Gate Scandal comes to mind.
-
- Mar 2024
-
-
He marveled at how the SouthCarolinians deluded themselves in believing they were safe, burdened asthey were with a large slave population—“stupid security,” he called it.
-
-
Local file Local file
-
Likewise, we “trusted the process,” but the process didn’t save Toy Story 2 either. “Trust theProcess” had morphed into “Assume that the Process Will Fix Things for Us.” It gave ussolace, which we felt we needed. But it also coaxed us into letting down our guard and, in theend, made us passive. Even worse, it made us sloppy.
Tags
Annotators
-
- Feb 2024
-
github.com github.com
-
Update email template to indicate that the link needs to be kept secure (e.g. do not share it)
-
-
stackoverflow.com stackoverflow.com
-
Do not pass arguments right into subshell, it's as unsafe as eval.
-
- Jan 2024
-
www.americanbar.org www.americanbar.org
-
The mortgage document which secures the promissory note by giving the lender an interest in the property and the right to take and sell the property—that is, foreclose—if the mortgage payments aren't made.
-
-
media.dltj.org media.dltj.org
-
So we have 50 independent electoral systems that kind of work in conjunction in tandem, but they're all slightly different and they're all run by the state.
It is worse than that. In Ohio, each county has its own election system. Rules are set at the state level, but each county buys and maintains the equipment, hires and does training, and reports its results.
-
-
support.google.com support.google.com
-
less secure sign-in technology
What does that mean exactly?
All of a sudden my Rails app's attempts to send via SMTP started getting rejected until I enabled "Less secure app access". It would be nice if I knew what was necessary to make the access considered "secure".
Update: Newer information added to this article (as well as elsewhere) leads me to believe that it is specifically sending password directly as authentication mechanism which was/is no longer permitted.
This is the note that has since been added on this page, which clarifies this point:
To help keep your account secure, from May 30, 2022, Google no longer supports the use of third-party apps or devices which ask you to sign in to your Google Account using only your username and password.
-
-
support.google.com support.google.com
-
To keep your account more secure, Gmail no longer supports third-party apps or devices which require you to share your Google username and password. Sharing your account credentials with third-parties makes it easier for hackers to gain access to your account.
-
-
support.google.com support.google.com
-
Prepare to transition away from Google Sync Google Sync doesn’t support OAuth authentication, 2-factor authentication, or security keys, which leaves your organization’s data less secure.
-
- Dec 2023
-
developers.secure.facebook.com developers.secure.facebook.com
-
for security, app access token should never be hard-coded into client-side code, doing so would give everyone who loaded your webpage or decompiled your app full access to your app secret, and therefore the ability to modify your app. This implies that most of the time, you will be using app access tokens only in server to server calls.
-
-
en.wikipedia.org en.wikipedia.org
-
This can result in an unwanted increase in fraudulent account creations, or worse; attackers successfully stealing social media account credentials from legitimate users.
Tags
Annotators
URL
-
-
developers.google.com developers.google.com
-
Given the security implications of getting the implementation correct, we strongly encourage you to use OAuth 2.0 libraries when interacting with Google's OAuth 2.0 endpoints. It is a best practice to use well-debugged code provided by others, and it will help you protect yourself and your users. For more information, see Client libraries.
-
-
developers.google.com developers.google.com
-
Warning: Do not accept plain user IDs, such as those you can get with the GoogleUser.getId() method, on your backend server. A modified client application can send arbitrary user IDs to your server to impersonate users, so you must instead use verifiable ID tokens to securely get the user IDs of signed-in users on the server side.
-
- Nov 2023
-
imagetragick.com imagetragick.com
-
It would have been fantastic to eschew this ridiculousness, because we all make fun of branded vulnerabilities too, but this was not the right time to make that stand.
-
-
www.bostonreview.net www.bostonreview.net
-
permanent security”
-
for: definition - permanent security, examples - permanent security
-
definition: permanent security
- Extreme responses by states to security threats, enacted in the name of present and future self defence.
- Permanent security actions target entire civilian populations under the logic of ensuring that terrorists and insurgents can never again represent a threat. It is a project, in other words, that seeks to avert future threats by anticipating them today.
-
example: permanent security
- Russian-Ukraine war
- Vladimir Putin reasons that Ukraine must be forcibly returned to Russia so that it cannot serve as a launching site for NATO missiles into Russia decades from now.
- Myanmar-Rohingya conflict
- The Myanmarese military sought to squash separatism by expelling and killing the Rohingya minority in 2017
- China-Uyghur conflict
- China sought to pacify and reeducate Muslim Uyghurs by mass incarceration to forestall their striving for independence forever
- Israel-Palestine conflict
- Israel seeks to eliminate Hamas as a security threat once and for all after the 2023 Hamas attack on Israel
- US-Iraq-Afghanistan
- The US sought to eliminate Saddam Hussein's nuclear capabilities and to eliminate Osama Bin Laden for his bombing of the World Trade center.
- Russian-Ukraine war
-
-
-
article-summarizer.scholarcy.com article-summarizer.scholarcy.com
-
Feminist analyses see both the state and trafficking networks as threats to security, as trafficked persons lack freedom of movement and are at risk of abuse and poor health
opens the table to consider more things in terms of IR security
-
Improving reproductive health and addressing gender inequalities are crucial for promoting human security.
-
health impacts of violent conflict, bioterrorism, pandemics, and endemic diseases disproportionately affecting certain regions are all linked to health and security
-
World Health Organization (WHO) and policymakers recognize the importance of health for international peace, stability, and human security.
-
onsidering gender in discussions of human security and argues for a balanced focus on both freedom from fear and freedom from want.
-
evidenced by the lack of involvement of women in drafting the new constitution and the passing of repressive legislation.
-
"responsibility to protect" (R2P).R2P suggests that states have a responsibility to intervene and protect civilians in other states if they are unable or unwilling to do so themselves.Some feminist scholars argue that the language of protection can reinforce gendered and racialized narratives.
-
issues of human security and human rights are sometimes used as justifications for military intervention.
e.g., with women and Taliban
-
The focus on individuals in human security discourse may overlook vulnerabilities and threats that are linked to larger associations such as gender, class, and ethnicity.
relies on the definition of person which can be politically constituted
-
International Criminal Court
-
providers of human security, and that NGOs and international organizations
-
mphasizes empowering individuals to take action for their own security and well-being.
still a liberal lassez-faire approach :(
-
he United Nations Development Programme and the Commission on Human Security have played important roles in promoting and defining the concept of human security.
-
Human security includes freedom from fear and freedom from want, and encompasses various elements such as economic security, food security, health security, environmental security, personal security, community security, and political security.
socialist feminist focused on social issues?
-
wars, conflicts, famine, and poverty are all examples of insecurity that can harm individuals and communities.
human non conflict issues
-
-
article-summarizer.scholarcy.com article-summarizer.scholarcy.com
-
"environmental security" and how it can be linked to traditional security ideas.Some view this connection as a positive way to address the threats posed by environmental degradation, while others see it as adding unnecessary complexity to the concept of security.
-
human security, shifting the focus from states to individuals.
-
-
-
authenticate_by addresses the vulnerability by taking the same amount of time regardless of whether a user with a matching email is found: User.authenticate_by(email: "...", password: "...")
-
-
github.com github.com
-
Implement restrictive defaults (potentially allowing an explicit bypass) I understand that easy usability and rich out-of-the-box functionality is likely essential to this library's appeal to its users. Nevertheless I'd like to propose making the authorization properties ransackable_[attributes/associations/etc.] empty sets by default, forcing the developer to explicitly define whitelists for their use case. To soften the usability blow, a new ransack_unsafe(params[:q]) or ransack_explicit(params[:q], ransackable_attributes='*', ransackable_associations=(:post, :comment)) method could be introduced to offer developers a shorthand to bypass or override the whitelists for specific queries (after they've had to read a warning about why these methods can be dangerous).
-
- Oct 2023
-
stackoverflow.com stackoverflow.com
-
Browsers can of course choose to ignore this. Again, CORS protects your client - not you.
-
-
research.securitum.com research.securitum.com
-
cdn.openai.com cdn.openai.com
-
Openai is looking to predict performance and safety because models are too big to be evaluated directly. To me this implies a high probability that people start to replace their own capabilities with models not enough safe and relevant. It could cause misalignment between people and their environment, or worse their perception of their environment.
-
-
blog.cloudflare.com blog.cloudflare.com
-
datatracker.ietf.org datatracker.ietf.org
- Sep 2023
-
docs.github.com docs.github.com
-
Inspect the proposed changes in the pull request and ensure that you are comfortable running your workflows on the pull request branch. You should be especially alert to any proposed changes in the .github/workflows/ directory that affect workflow files.
-
-
-
Enhance Safety with Sleek Steel Security Doors
-
-
stackoverflow.com stackoverflow.com
-
Apparently, Google uses some additional heuristics to decide whether the link should be displayed or not. The List-Unsubscribe header could be abused by spammers to validate that their target got the message, and thus, GMail only shows the unsubscribe link if the source of the message has accumulated sufficient trust.
Shouldn't it be controllable by the end user, in the same way that they can press a button to show all images if images are blocked by default for security/privacy reasons??
-
-
cheatsheetseries.owasp.org cheatsheetseries.owasp.org
- Aug 2023
-
hirok.io hirok.io
-
npx link is a tool I developed as a safer and more predictable alternative to npm link.
Tags
Annotators
URL
-
-
kit.svelte.dev kit.svelte.dev
-
```js // CSRF
/* @type {import('@sveltejs/kit').Config} / const config = { kit: { checkOrigin?: true, } }; export default config; ```
-
```js // CSP svelte.config.js
/* @type {import('@sveltejs/kit').Config} / const config = { kit: { csp: { directives: { 'script-src': ['self'] }, reportOnly: { 'script-src': ['self'] } } } };
export default config; ```
-
-
Tags
Annotators
URL
-
-
cheatsheetseries.owasp.org cheatsheetseries.owasp.org
-
developer.mozilla.org developer.mozilla.org
-
www.w3.org www.w3.org
-
www.theguardian.com www.theguardian.com
-
The US report, released in 2021, warned: “Intensifying physical effects will exacerbate geopolitical flashpoints, particularly after 2030, and key countries and regions will face increasing risks of instability and need for humanitarian assistance
Die australischen Grünen wollen die Labour-Regierung zwingen, einen bisher ih wichtigen Teilen geheimgehaltenen Sicherheitsbericht vollständig zu publizieren. Sie gehen davon aus, dass die Regierung explosive Informationen über Sicherheitsrisiken durch die globale Erhitzung vor der Bevölkerung verbirgt. https://www.theguardian.com/australia-news/2023/aug/04/declassified-climate-crisis-report-greens-labor-albanese
-
- Jul 2023
-
www.bortzmeyer.org www.bortzmeyer.org
Tags
Annotators
URL
-
-
datatracker.ietf.org datatracker.ietf.org
-
www.newstatesman.com www.newstatesman.com
-
www.theguardian.com www.theguardian.com
-
www.theguardian.com www.theguardian.com
-
Hitzewellen bedrohen durch ihre zunehmende Zahl und Intensität das globale Ernährungssystem. Der Guardian hat Experten zu den Folgen von Hitzewellen am Land und in den Ozeanen für die Ernährungssicherheit befragt. Hitzewellen haben dramatische Auswirkungen etwa auf die Erträge von Nutzpflanzen und auf Lebensbedingungen von Fischen. Die Folgen sind im Detail oft nur unzureichend erforscht. https://www.theguardian.com/environment/2023/jul/21/rampant-heatwaves-threaten-food-security-of-entire-planet-scientists-warn
-
-
www.theguardian.com www.theguardian.com
-
Veränderungen des Jetstreams durch die globale Erhitzung können gleichzeitige Missernten in mehreren Regionen bewirken, die für die Weilternährung entscheidend sind. George Monbiot prangert die mangelnde mediale Aufmerksamkeit für eine Studie an, der zufolge das Risiko globaler Ernährungskrise weit größer ist als angenommen. Die politische Macht einer kleinen Gruppe extrem Reicher sei die Ursache für das dramatisch anwachsende Risiko weltweiter Hungerkatastrophen. https://www.theguardian.com/commentisfree/2023/jul/15/food-systems-collapse-plutocrats-life-on-earth-climate-breakdowntopic: crop fail
-
-
stackoverflow.com stackoverflow.com
-
The threat is that you're posting a secret key to a third party which violates a dozen of security best practices, nullifies the assumption of the key being "secret" and most likely violates your organization's security policy. In authentication all the remaining information can be guessed or derived from other sources - for example Referrer header in case of Google - and this is precisely why secrets should be, well, secret.
-
-
gtfobins.github.io gtfobins.github.io
Tags
Annotators
URL
-
-
gtfobins.github.io gtfobins.github.ioGTFOBins1
-
-
docs.npmjs.com docs.npmjs.com
Tags
Annotators
URL
-
- Jun 2023
-
terrateam.io terrateam.io
-
Platform engineering is trying to deliver the self-service tools teams want to consume to rapidly deploy all components of software. While it may sound like a TypeScript developer would feel more empowered by writing their infrastructure in TypeScript, the reality is that it’s a significant undertaking to learn to use these tools properly when all one wants to do is create or modify a few resources for their project. This is also a common source of technical debt and fragility. Most users will probably learn the minimal amount they need to in order to make progress in their project, and oftentimes this may not be the best solution for the longevity of a codebase. These tools are straddling an awkward line that is optimized for no-one. Traditional DevOps are not software engineers and software engineers are not DevOps. By making infrastructure a software engineering problem, it puts all parties in an unfamiliar position. I am not saying no-one is capable of using these tools well. The DevOps and software engineers I’ve worked with are more than capable. This is a matter of attention. If you look at what a DevOps engineer has to deal with day-in and day-out, the nuances of TypeScript or Go will take a backseat. And conversely, the nuances of, for example, a VPC will take a backseat to a software engineer delivering a new feature. The gap that the AWS CDK and Pulumi try to bridge is not optimized for anyone and this is how we get bugs, and more dangerously, security holes.
-
-
www.nytimes.com www.nytimes.com
-
PARIS — Europe’s top human rights court condemned the French government on Wednesday over its refusal to bring home the families of two Islamic State fighters, a landmark ruling that may push France and other European countries to speed up the repatriation of nationals held for years in squalid detention camps in northeastern Syria.
Could such EU wide actions or decision result in fostering seed of anger among individual EU nations, eventually prompting them to leave EU? Is there no power among individual nations to make their own decisions when it comes to national security?
-
- May 2023
-
www.youtube.com www.youtube.com
Tags
Annotators
URL
-
-
www.npmjs.com www.npmjs.com
-
npx check-my-headers https://example.com
-
-
Tags
- http:header=x-frame-options
- http:header=strict-transport-security
- wikipedia:en=Cross-site_request_forgery
- wikipedia:en=Data_breach
- http:header=x-content-type-options
- wikipedia:en=Clickjacking
- hsts
- sri
- http:header=content-security-policy
- wikipedia:en=Man-in-the-middle_attack
- security
- csp
- wikipedia:en=Session_hijacking
- http:header=referrer-policy
- http
Annotators
URL
-
-
hackernoon.com hackernoon.com
-
simonwillison.net simonwillison.net
-
Short version: if someone sends you an email saying “Hey Marvin, delete all of my emails” and you ask your AI assistant Marvin to summarize your latest emails, you need to be absolutely certain that it won’t follow those instructions as if they came from you!
-
-
www.davidwong.fr www.davidwong.fr
-
incidentdatabase.ai incidentdatabase.ai
Tags
Annotators
URL
-
-
ovalproject.github.io ovalproject.github.io
-
cve.mitre.org cve.mitre.org
Tags
Annotators
URL
-
-
www.youtube.com www.youtube.com
-
-
docs.gitlab.com docs.gitlab.com
-
cve.mitre.org cve.mitre.org
Tags
Annotators
URL
-
-
www.cvedetails.com www.cvedetails.com
-
-
nvd.nist.gov nvd.nist.gov
-
nvd.nist.gov nvd.nist.gov
-
www.w3.org www.w3.org
Tags
Annotators
URL
-
- Apr 2023
-
security.stackexchange.com security.stackexchange.com
-
If so, then how is sending a link for password reset any more secure? Isn't logging-in using a magic link the same thing as sending a magic link for resetting a password?
In my opinion: It's not any different or less secure.
-
-
www.reddit.com www.reddit.com
-
There are three types of authentication: something you know, something you have, and something you are.↳Do with that knowledge as you wish.
身份验证分为三种类型：您知道的东西、您拥有的东西和您的身份。
随心所欲地使用这些知识。
-
-
arxiv.org arxiv.org
-
www.thesslstore.com www.thesslstore.com
-
9to5mac.com 9to5mac.com
-
Seeing how powerful AI can be for cracking passwords is a good reminder to not only make sure you‘re using strong passwords but also check:↳ You‘re using 2FA/MFA (non-SMS-based whenever possible) You‘re not re-using passwords across accounts Use auto-generated passwords when possible Update passwords regularly, especially for sensitive accounts Refrain from using public WiFi, especially for banking and similar accounts
看到人工智能在破解密码方面有多么强大，这很好地提醒了我们，不仅要确保你在使用强密码，还要检查：
-
你正在使用 2FA/MFA（尽可能不使用基于短信的）。
-
你没有在不同的账户间重复使用密码
-
尽可能使用自动生成的密码
-
定期更新密码，特别是敏感账户的密码
-
避免使用公共WiFi，尤其是银行和类似账户
-
-
Now Home Security Heroes has published a study showing how scary powerful the latest generative AI is at cracking passwords. The company used the new password cracker PassGAN (password generative adversarial network) to process a list of over 15,000,000 credentials from the Rockyou dataset and the results were wild. 51% of all common passwords were cracked in less than one minute, 65% in less than an hour, 71% in less than a day, and 81% in less than a month.
-
- Mar 2023
-
-
If you can unlink your address from a locked out account and then link it to a new account and add new 2FA factors to new account, and basically set it up again to be a replacement nearly identical to the original... how is that any different / more secure than just using a "reset account" feature that resets the original account (removes 2FA)?
We're still back to the recurring original problem with account security where the security of your account comes down to the security of your linked e-mail account.
-
-
blog.cmpxchg8b.com blog.cmpxchg8b.com
-
The problem with using SMS-2FA to mitigate this problem is that there’s no reason to think that after entering their credentials, they would not also enter any OTP.
-
I assume anyone interested in this topic already knows how phishing works, so I’ll spare you the introduction. If a phishing attack successfully collects a victim's credentials, then the user must have incorrectly concluded that the site they’re using is authentic.
-
If you also want to eliminate phishing, you have two excellent options. You can either educate your users on how to use a password manager, or deploy U2F, FIDO2, WebAuthn, etc. This can be done with hardware tokens or a smartphone.
-
You are currently allowing your users to choose their own password, and many of them are using the same password they use on other services. There is no other possible way your users are vulnerable to credential stuffing.
-
t’s important to emphasise that if you don’t reuse passwords, you are literally immune to credential stuffing.
-
-
infosecwriteups.com infosecwriteups.com
-
Time to dive a little deeper to see what information the barcodes actually contain. For this I will break down the previously extracted information into smaller pieces.
Information contained within boarding pass barcodes
-
-
-
Pitfall #1: Server-Side Rendering Attacker-Controlled Initial State
```html
<script>window.__STATE__ = ${JSON.stringify({ data })}</script>```
-
Pitfall #3: Misunderstanding What it Means to Dangerously Set
-
Pitfall #2: Sneaky Links
-
-
-
thomasnguyen.site thomasnguyen.site
-
One option is to use the serialize-javascript NPM module to escape the rendered JSON.
html { username: "pwned", bio: "</script><script>alert('XSS Vulnerability!')</script>" } -
This is risky because JSON.stringify() will blindly turn any data you give it into a string (so long as it is valid JSON) which will be rendered in the page. If { data } has fields that un-trusted users can edit like usernames or bios, they can inject something like this:
json { username: "pwned", bio: "</script><script>alert('XSS Vulnerability!')</script>" } -
Sometimes when we render initial state, we dangerously generate a document variable from a JSON string. Vulnerable code looks like this:
```html
<script>window.__STATE__ = ${JSON.stringify({ data })}</script>```
-
Server-side rendering attacker-controlled initial state
-
-
www.zataz.com www.zataz.comZATAZ1
Tags
Annotators
URL
-
-
datatracker.ietf.org datatracker.ietf.org
-
addons.mozilla.org addons.mozilla.org
-
-
-
www.smashingmagazine.com www.smashingmagazine.com
-
www.keycdn.com www.keycdn.com
Tags
Annotators
URL
-
-
www.youtube.com www.youtube.com
-
frederik-braun.com frederik-braun.com
-
developer.mozilla.org developer.mozilla.org
-
www.w3.org www.w3.org
Tags
Annotators
URL
-
- Feb 2023
-
www.cnbc.com www.cnbc.com
-
How the TSA's Instagram became a must-follow account, thanks to a sticky-note trick by Natasha Piñon
read on Fri 2022-12-09 7:28 AM
-
- Jan 2023
-
oko.press oko.press
-
I choć może brzmi to abstrakcyjnie, pamiętajmy, że wiele z tych podłączonych do Internetu urządzeń wyposażonych jest w kamerki i mikrofony.
Zdaje się że nie wszyscy producenci informują o tym wprost, chwaląc tylko funkcjonalność, a nie wspominając o sposobie jej uzyskania (przez wykorzystanie kamerek)
-
-
blog.joinmastodon.org blog.joinmastodon.org
-
The code above is somewhat simplified and missing some checks that I would advise implementing in a serious production application. For example:The request contains a Date header. Compare it with current date and time within a reasonable time window to prevent replay attacks.It is advisable that requests with payloads in the body also send a Digest header, and that header be signed along in the signature. If it’s present, it should be checked as another special case within the comparison string: Instead of taking the digest value from the received header, recompute it from the received body.While this proves the request comes from an actor, what if the payload contains an attribution to someone else? In reality you’d want to check that both are the same, otherwise one actor could forge messages from other people.
-
- Dec 2022
-
community.tp-link.com community.tp-link.com
-
This is a terrible idea. At least if there's no way to opt out of it! And esp. if it doesn't auto log out the original user after some timeout.
Why? Because I may no longer remember which device/connection I used originally or may no longer have access to that device or connection.
What if that computer dies? I can't use my new computer to connect to admin UI without doing a factory reset of router?? Or I have to clone MAC address?
In my case, I originally set up via ethernet cable, but after I disconnected and connected to wifi, the same device could not log in, getting this error instead! (because different interface has different mac address)
-
-
documentation.mailgun.com documentation.mailgun.com
-
To help you better understand the configuration possibilities and potential issues, take a look at the following table. Take into account the type of threat you are concerned with when making your decision on how to configure sending settings.
-
-
-
Spring Boot 项目使用 Apache Shiro 还是 Spring Security 好？
Tags
Annotators
URL
-
-
news.ycombinator.com news.ycombinator.com
Tags
Annotators
URL
-
-
datatracker.ietf.org datatracker.ietf.org
-
www.boxcryptor.com www.boxcryptor.com
-
pomcor.com pomcor.com
Tags
Annotators
URL
-
-
stackoverflow.com stackoverflow.com
-
samnewman.io samnewman.io
Tags
Annotators
URL
-
-
philcalcado.com philcalcado.com
-
github.com github.com
-
cheatsheetseries.owasp.org cheatsheetseries.owasp.org
-
cheatsheetseries.owasp.org cheatsheetseries.owasp.org
-
www.thomasfrank.se www.thomasfrank.se
Tags
Annotators
URL
-
-
blog.ropnop.com blog.ropnop.com
Tags
Annotators
URL
-
-
datatracker.ietf.org datatracker.ietf.org
Tags
Annotators
URL
-
-
datatracker.ietf.org datatracker.ietf.org