Bookmarks tagged with #security.
Show all
Show all
An Inside Look at the Relay Market Powering Token Resellers and Fraud
A look inside the gray-market reseller economy that gives mainland China cheap, structured, B2B-grade access to OpenAI, Anthropic, Google, and beyond
Saved
on: 2026-07-26
TLS certificates for internal services done right
No self-signing headaches, no TLS erros.
Saved
on: 2026-07-09
Canada is about to weaken every lock on your private messages — dontsurveil.me
Bill C-22 would force every messaging app in Canada to build a second key, and give the copy to the government. What's changed, what's happening now, what's next.
Saved
on: 2026-05-17
What is OAuth?
Wherein I [try to] answer a seemingly straightforward question: "WTF is OAuth, anyhow?"
Saved
on: 2026-02-21
Privacy is Marketing. Anonymity is Architecture.
Privacy is when they promise to protect your data. Anonymity is when they never had your data to begin with.
Saved
on: 2025-12-20
Sutra | Portfolio
A portfolio website for Bhargav. Software developer based in Berlin,Germany.
Saved
on: 2025-10-05
Cross-Site Request Forgery
Cross-Site Request Forgery countermeasures can be greatly simplified using request metadata provided by modern browsers.
Saved
on: 2025-08-13
A valid HTML zip bomb - ache
h1 id="a-valid-html-zip-bomb"a tabindex="0" class="anchor" href="/notes/html_zip_bomb"A valid HTML zip bomb/a/h1pimg src="/notes/res/zip_bomb_file.svg" alt="Illustration d'une bombe zip" height="150" width="150"/pa href="/notes/html_zip_bomb"/a
Saved
on: 2025-07-24
The cryptography behind passkeys - The Trail of Bits Blog
This post will examine the cryptography behind passkeys, the guarantees they do or do not give, and interesting cryptographic things you can do with them, such as generating cryptographic keys and storing certificates.
Saved
on: 2025-05-15
Everyone knows your location: tracking myself down through in-app ads
Recently I read about a massive geolocation data leak from Gravy Analytics, which exposed more than 2000 apps, both in AppStore and Google Play, that secretly collect geolocation data without user consent. Oftentimes, even without developers` knowledge.
I looked into the list (link here) and found at least 3 apps I have installed on my iPhone. Take a look for yourself!
This made me come up with an idea to track myself down externally, e.g. to buy my geolocation data leaked by some application.
Saved
on: 2025-02-03
lwthiker/curl-impersonate
curl-impersonate: A special build of curl that can impersonate Chrome & Firefox - lwthiker/curl-impersonate
Saved
on: 2025-01-18
Backdooring Your Backdoors - Another $20 Domain, More Governments
After the excitement of our .MOBI research, we were left twiddling our thumbs. As you may recall, in 2024, we demonstrated the impact of an unregistered domain when we subverted the TLS/SSL CA process for verifying domain ownership to give ourselves the ability to issue valid and trusted TLS/SSL certificates for any .MOBI domain.
This resulted in significant Internet-wide change, with Google petitioning the CAB Forum to wholly sunset the use of WHOIS for ownership validation when issuing CA-sig
Saved
on: 2025-01-12
delight-im/PHP-Auth
Authentication for PHP. Simple, lightweight and secure. - delight-im/PHP-Auth
Saved
on: 2024-12-08
New in Symfony 7.2: Stateless CSRF (Symfony Blog)
Symfony 7.2 introduces stateless CSRF protection, enabling secure token validation without relying on server-side sessions.
Saved
on: 2024-11-30
April King — Handling Cookies is a Minefield
Discrepancies in how browsers and libraries handle HTTP cookies, and the problems caused by such things.
Saved
on: 2024-11-21
What's inside the QR code menu at this cafe? - by peabee
Saved
on: 2024-09-23
OAuth from First Principles - Stack Auth
Stack Auth is the open-source Auth0 alternative. We are your login and signup page, and everything that comes with that.
Saved
on: 2024-09-09
OAuth from First Principles
Stack Auth is the open-source Auth0 alternative. We are your login and signup page, and everything that comes with that.
Saved
on: 2024-09-06
Things you wish you didn't need to know about S3
S3 is weirder than you think. Make sure you know all the quirks before they turn into vulnerabilities in your AWS infrastructure.
Saved
on: 2024-05-31
SSH Port
The SSH port is 22. This is the story of how it got that port number. And practical configuration instructions.
Saved
on: 2024-02-12
I looked through attacks in my access logs. Here's what I found
I've been self-hosting for over a decade. It's freeing because I own my data, and do not depend on any platform other than my cloud host, which I can easily switch off. Self-hosting gives much insight into what it takes to run a cloud service. Anyone who's had some practice doing this will likely tell you that the internet is a dangerous place.
🖖If you found this helpful or insightful leave a comment to let me know, or follow me on Mastodon - @nish@social.nishtahir.com
Exposing any IP onto th
Saved
on: 2024-01-28
Hacking htmx applications
With the normal flow of frontend frameworks moving from hipster to mainstream in the coming few months, during a test, you bump into this strange application that receives HTML with `hx-` attributes…
Saved
on: 2023-12-23
SMTP Smuggling - Spoofing E-Mails Worldwide
Introducing a novel technique for e-mail spoofing
Saved
on: 2023-12-22
Spoofing Emails from +2M Domains and Virtually Becoming Satan [pdf]
Saved
on: 2023-09-24
Web fingerprinting is worse than I thought - Bitestring's Blog
Saved
on: 2023-03-22
Role And Permission In Laravel 10 using Spatie: The Definitive Guide (2023)
Roles and permissions can make or break your web application. If you’re not careful, your users might end up running amok, wreaking havoc on your carefully crafted code. Roles and permissions are…
Saved
on: 2023-03-21
Clerk | Authentication and User Management
The easiest way to add authentication and user management to your application. Purpose-built for React, Next.js, Remix, and “The Modern Web”.
Saved
on: 2023-03-03
We’re drowning | snarfed.org
Matthew Childs / Reuters We live in a golden age of software reuse. We've never before had such a wealth of freely available code, in so many languages, so easy to find and install. And yet, we're drowning. We slap together rickety rowboats and toss them out on PyPI Ocean and npm Sea, then act…
Saved
on: 2022-10-20
I've locked myself out of my digital life
Imagine… Last night, lightning struck our house and burned it down. I escaped wearing only my nightclothes. In an instant, everything was vaporised. Laptop? Cinders. Phone? Ashes. Home server? A smouldering wreck. Yubikey? A charred chunk of gristle. This presents something of a problem. In order to recover my digital life, I need to be able to log in to things. This means I need to know my u…
Saved
on: 2022-06-08
Introducing Clerk: All of user management, not just authentication
The task came with a sense of helplessness. We knew what "great" looked like, but it was impractical to build all of that functionality.
Saved
on: 2021-02-09
The great SameSite confusion
In this post, I dissect a common misconception about the SameSite cookie attribute and I explore its potential impact on Web security.
TL;DR ¶ The SameSite cookie attribute is not well understood. Conflating site and origin is a common but harmful mistake. The concept of site is more difficult to apprehend than meets the eye. Some requests are cross-origin but same-site. SameSite only has effects on cross-site requests. SameSite paints a target on your subdomains’ back. Misguided practitioners may unduly eschew SameSite=Strict. The advent of SameSite ¶ You undoubtedly have heard of the SameSite cookie attribute. It made headlines when, in February 2020, Chrome started rolling out changes to SameSite’s default behaviour. Intended as a defence-in-depth mechanism against cross-site attacks, such as cross-site request forgery (CSRF) and cross-site script inclusion (XSSI), SameSite had been lying dormant at the heart of implementing browsers since its inception in 2016.
Saved
on: 2021-02-05
React Authentication: How to Store JWT in a Cookie | by Ryan Chenkie | Medi
If that’s the case, there’s a decent chance that your API is secured somehow. Maybe you’re making authentication and authorization happen with JSON Web Tokens. If so, there’s also a decent chance…
Saved
on: 2021-01-22
Ok Google: please publish your DKIM secret keys – A Few Thoughts on Cryptog
The Internet is a dangerous place in the best of times. Sometimes Internet engineers find ways to mitigate the worst of these threats, and sometimes they fail. Every now and then, however, a major …
Tags:
#security
Saved
on: 2020-11-17
The Ultimate WordPress Security Checklist
WordPress security checklist with the latest and updated methods to secure a WordPress site from a variety of security vulnerabilities.
Saved
on: 2020-09-10
How I helped fix Canadaʼs COVID Alert app
On July 31st, Canada's COVID Alert app was made available for general use, though it does not have support for actually reporting a diagnosis in most provinces, yet.
In Quebec, we can run the tracing
Tags:
#security
Saved
on: 2020-08-25
Keycloak
Keycloak - the open source identity and access management solution. Add single-sign-on and authentication to applications and secure services with minimum effort.
Saved
on: 2020-04-15
Rclone – Sync files and directories to many cloud storage providers | Hacker News
Saved
on: 2020-04-06
Should I encrypt, hash or encode?
Having a basic understanding of these terms can go a long way when writing code.
Tags:
#security
Saved
on: 2020-02-09
Developers: Get Ready for New SameSite=None; Secure Cookie Settings
UPDATE (10/28/2019): We've revised the 2nd and 3rd bullet points in the section "How to Prepare; Known Complexities" below. In May, Chrome ...
Saved
on: 2019-10-24
CSRF is (really) dead
A little while back I wrote a blog post about how "CSRF is dead". It focused on
SameSite cookies, a powerful yet simple feature to protect your website against
CSRF attacks. As powerful as it was, and as much as it will kill CSRF, you had
to enable it on your site, and that was the problem. Now, we're solving that
problem.
--------------------------------------------------------------------------------
SameSite Cookies
To understand the problem of CSRF and the solution that SameSite Cookie
Tags:
#security
Saved
on: 2019-09-07
mkcert: valid HTTPS certificates for localhost
(or for any other name)
The web is moving to HTTPS, preventing network attackers from observing or
injecting page contents. But HTTPS needs TLS certificates, and while deployment
is increasingly a solved issue thanks to the ACME protocol and Let's Encrypt,
development still mostly ends up happening over HTTP because no one can get an
universally valid certificate for localhost
[https://letsencrypt.org/docs/certificates-for-localhost/].
This is a problem because more and more browser features
Saved
on: 2019-01-07
I don't understand what's wrong with just using cookies for authentication. : r/PHP
Saved
on: 2018-10-21
How to manage any kind of secret with AWS Secrets Manager - Sander Knape
Saved
on: 2018-07-08
Cloud Armor - Denial of Service Defense | Google Cloud
Google Cloud Armor is a network security service that provides defenses against DDoS and application attacks, and offers a rich set of WAF rules.
Saved
on: 2018-03-22
Let's Encrypt CloudFront Cert Renewal with AWS Lambda · Dan Vittegleo
Saved
on: 2018-03-18
ACME v2 and Wildcard Certificate Support is Live - Issuance Policy - Let's
We’re pleased to announce that ACMEv2 and wildcard certificate support is live! With today’s new features we’re continuing to break down barriers for HTTPS adoption across the Web by making it even easier for every website to get and manage certificates. ACMEv2 is an updated version of our ACME protocol which has gone through the IETF standards process, taking into account feedback from industry experts and other organizations that might want to use the ACME protocol for certificate issuance an...
Tags:
#security
Saved
on: 2018-03-14
Paseto is a Secure Alternative to the JOSE Standards (JWT, etc.) - Paragon
Paseto (Platform-Agnostic Security Tokens) is everything JWT should be, but isn't (namely, secure)
Saved
on: 2018-03-05
The 2018 Guide to Building Secure PHP Software - Paragon Initiative Enterprises Blog
Everything a developer needs to know to build secure software in the PHP programming language in the year 2018
Saved
on: 2017-12-16
Troy Hunt: The 6-Step "Happy Path" to HTTPS
It's finally time: it's time the pendulum swings further towards the "secure by
default" end of the scale than what it ever has before. At least insofar as
securing web traffic goes because as of this week's Chrome 62's launch, any
website with an input box is now doing this when served over an insecure
connection:
It's not doing it immediately for everyone
[https://textslashplain.com/2017/10/18/chrome-field-trials/], but don't worry,
it's coming very soon even if it hasn't yet arrived for yo
Saved
on: 2017-10-19
We need to talk about Session Tickets
More specifically, TLS 1.2 Session Tickets.
Session Tickets, specified in RFC 5077 [https://tools.ietf.org/html/rfc5077],
are a technique to resume TLS sessions by storing key material encrypted on the
clients. In TLS 1.2 they speed up the handshake from two to one round-trips.
Unfortunately, a combination of deployment realities and three design flaws
makes them the weakest link in modern TLS, potentially turning limited key
compromise into passive decryption of large amounts of traffic.
How
Saved
on: 2017-09-28
Face ID, Touch ID, No ID, PINs and Pragmatic Security
I was wondering recently after poring through yet another data breach how many
people actually use multi-step verification. I mean here we have a construct
where even if the attacker has the victim's credentials, they're rendered
useless once challenged for the authenticator code or SMS which is subsequently
set. I went out looking for figures and found the following on Dropbox:
> "less than 1% of the Dropbox user base is taking advantage of the company’s
two-factor authentication feature": htt
Saved
on: 2017-09-14
Upgrading existing password hashes
Still using MD5 or SHA-1 to store user passwords and want to gracefully migrate to e.g. bcrypt? Want to do it properly to protect all passwords in the database? Here's how.
Saved
on: 2017-09-06
Single Sign On—You’re Probably Doing It Wrong | PHP Architect
Requiring users to log in individually to the websites they need for their work wastes time. Let’s fix that with a single sign-on service.
Saved
on: 2017-08-19
Creating a Symfony 3 Project with Basic User Handling
This post will walk through how to get setup using the Symfony 3 framework and the Friends of Symfony bundle so that your project can allow users to register, login and out, and view and edit their User profile.
Saved
on: 2017-08-18
Appcanary - Everything you need to know about HTTP security headers
Saved
on: 2017-05-16
How We Engineered CMS Airship to be Simply Secure - Paragon Initiative Enterprises Blog
A deep dive into the security engineering decisions that went into CMS Airship. A lot of the decisions we made are subtle.
Saved
on: 2017-03-20
Secure Headers for PHP
Recently I've been working on a drop in class to manage certain "Secure Headers" in PHP.
Saved
on: 2017-01-08
Let Your Whole Family Watch This Internet Security Basics Course
As the holidays get closer, you’re probably going to spend a lot of time with your family, many of whom will get shiny new devices. If they want your
Saved
on: 2016-12-19
CyberChef
The Cyber Swiss Army Knife - a web app for encryption, encoding, compression and data analysis
Saved
on: 2016-11-28
The definitive guide to form-based website authentication
Moderator note:
This question is not a good fit for our question and answer format with the topicality rules which currently apply for Stack Overflow. We normally use a "historical lock" ...
Saved
on: 2016-07-22
My First 10 Minutes On a Server - Primer for Securing Ubuntu | Codelitt
How to secure an ubuntu server against attacks.
Saved
on: 2016-06-15
Tips to handle Authentication in Redux #2 introducing redux-saga — Medium
After about 5 month from my first article Tips to handle Authentication in Redux, I think it’s time to share with you all how the actual redux ecosystem changed and improved the way I usually do…
Saved
on: 2016-05-25
Going dark: online privacy and anonymity for normal people
Last week we got news of the Rosebutt data breach
[http://motherboard.vice.com/read/rosebuttboard-ip-board]. This is a very
particular class of site and like many others we've recently seen compromised,
it's highly likely that members would have preferred to keep their identities
secret. It doesn't matter if you don't agree with the lifestyle choice of those
on the site and certainly I myself am not one to look around the house at
everyday items and think "I wonder if that could...". That's enti
Saved
on: 2016-05-19
Solve All Your Cryptography Problems in 3 Easy Steps - Paragon Initiative E
A layman's introduction to using Halite, our libsodium wrapper
Saved
on: 2016-05-12
Troy Hunt: Understanding CSRF, the video tutorial edition
Cross site request forgery is one of those attacks which remains enormously
effective yet is frequently misunderstood. I’ve been running a bunch of security
workshops for web developers around the globe recently and this is one of the
topics we cover that often results in blank stares when I first ask about it. It
usually unfolds that the developers have multiple resources at risk of a CSRF
attack and if it’s not a classic web form style resource, then it’s frequently
an API somewhere (you’re pa
Saved
on: 2016-03-21
One Login To Rule them All - Seamless and Secure Cross-Domain Authenticatio
How to authenticate a user on multiple domains without violating the Same Origin Policy.
Saved
on: 2016-03-08
Announcing Industry Best Practices for Securing AWS Resources | Amazon Web Services
Today, we are happy to announce that the Center for Internet Security (CIS) has published the CIS AWS Foundations Benchmark, a set of security configuration best practices for AWS. These industry-accepted best practices go beyond the high-level security guidance already available, providing AWS users with clear, step-by-step implementation and assessment procedures. This is the first […]
Saved
on: 2016-03-01
Keybase Book
Use Keybase for end-to-end encrypted chat messaging, file sharing, and team collaboration. Get the free app for iOS, Mac, Android, Windows, and Linux.
Saved
on: 2016-02-04
Is TLS Fast Yet?
TLS has exactly one performance problem: it is not used widely enough. Everything else can be optimized.
Saved
on: 2016-01-31
What web developers should know about SSL but probably don't.
Saved
on: 2015-12-22
php-digital-signer/README.md at master · jefersonbelmiro/php-digital-signer
php-digital-signer
Saved
on: 2015-12-21
Roave/SecurityAdvisories: :closed_lock_with_key: Security advisories as a simple composer exclusion list, updated daily
:closed_lock_with_key: Security advisories as a simple composer exclusion list, updated daily - Roave/SecurityAdvisories
Saved
on: 2015-12-10
sqlmap: automatic SQL injection and database takeover tool
Saved
on: 2015-12-02
Web Authentication Methods Explained | RisingStack
Cookies, tokens and other web authentication methods starting with HTTP Basic authentication and finishing up with signatures.
Saved
on: 2015-11-24
QA Platform
Accelerate progress up the cloud curve with Cloud Academy's digital training solutions. Build a culture of cloud with technology and guided learning experiences.
Saved
on: 2015-08-25
Implementing Secure User Authentication in PHP Applications with Long-Term Persistence (Login with "Remember Me" Cookies) - Paragon Initiative Enterprises Blog
Login forms with a remember me checkbox are a common requirement. We explore the security of login forms and a robust model for remember me checkboxes.
Saved
on: 2015-07-22
jenssegers/optimus: 🤖 Id obfuscation based on Knuth's multiplicative hashing method for PHP.
🤖 Id obfuscation based on Knuth's multiplicative hashing method for PHP. - jenssegers/optimus
Saved
on: 2015-07-21
Announcing Twitter and Digits Support for Amazon Cognito | Amazon Web Services
When Amazon Cognito was first launched, we included support for Facebook, Google, Login with Amazon, as well as unauthenticated identities. In response to customer requests, we added OpenID Connect support as well as developer authenticated identities to enable developers to extend Amazon Cognito to support any aribitrary provider. Even though it was possible to add […]
Saved
on: 2015-05-05
The Death of the Login — Medium
The login wall was a necessary evil that users had to live with. Most often users were forced to login and in return were promised customization and personalization. The internet companies got email…
Saved
on: 2015-03-04
Riimu/Kit-CSRF
Secure and simple CSRF library protected against timing and BREACH attacks - Riimu/Kit-CSRF
Saved
on: 2015-02-02
How to Solve Privacy, Security and Performance In Logging
How do you determine what log data to obfuscate? How do you deal with privacy and security in your logging without impacting application performance?
Saved
on: 2014-12-19
How to easily clean an infected computer (Malware Removal Guide)
Malicious software like viruses, spyware, ransomware, and other malware poses severe risks to Windows computers by infecting systems, damaging files, slowing
Saved
on: 2014-10-20
Passwordless authentication: Secure, simple, and fast to deploy ✩ Mozilla H
Passwordless is an authentication middleware for Node.js that improves security for your users while being fast and easy to deploy. The last months were very exciting for everyone interested in ...
Saved
on: 2014-10-15
satellizer/README.md at master · sahat/satellizer
Token-based AngularJS Authentication
Saved
on: 2014-08-18