Sign in Subscribe

Topic

Security

The practice of preventing unauthorized access, use, disclosure, disruption, modification, inspection, recording or destruction of information.

Understanding Digital Signatures: More Than Just a Hash

Digital signatures are a cornerstone of modern security practices, ensuring data integrity and authentication in various online communications. But there's often confusion between the terms "digital signature", "hash", and "digest". Let's delve deep into understanding these terms and their roles.

Unlocking Your Tech Success - 5 Essential Lessons

Ever wondered what it takes to thrive in the tech world, not just as a coder but as a tech-savvy communicator, a business bridge, and a problem-solver armed with certificates and Python? Let's unravel the answers together, shall we? Are you ready to dive into the electrifying world

Hawk Authentication bug - Firefox Accounts payload bypassing integrity validation

HawkAuth protocol is widely adopted by Firefox Accounts and appears in Postman in a very short list of supported API authentication methods which indicates HawkAuth is vastly more popular than you might first expect. Snyk Vulnerability Database | SnykCritical severity (9.3) Authentication Bypass in hawkLearn more about npm with Snyk

Certificate Pinning is powerful, but you probably shouldn't use it

Let's be clear about Certificate Pinning. It IS extremely useful. It IS valid, if you follow 1 rule, and are operating in 2 use case scenarios. It's simple; The 1 rule is that YOU control the CA for the pin. If you don't control

You should have a preference for EV Certificates in 2022 - when most think they are dead

Domain Validated (DV) Certificates may be growing in popularity since the browsers ceased showing the organisation name along with a green padlock, but the visual change is not material to the security characteristic associated with Extended Validation (EV) Certificates. When the visual changes occurred the mainstream non-technical or the uneducated

Zero-trust doesn't exist but that's OK

Where zero-trust might exist 1. Scenarios that have no data 2. Scenarios with data that are never connected to power Why? Because the moment data is accessible by a human, or a system with potential human access - you inherently trust that human. What about identity? Digital identity is the

You don't know OWASP

About a year ago I was just getting involved with the CSA Working Group [https://cloudsecurityalliance.org/research/contribute/] for CCM version 4 when I came across the OWASP CSA Project [https://wiki.owasp.org/index.php/Category:OWASP_CSA_Project] and went on a little adventure to learn more

Private AWS S3 - How hard could that be?

Applying private routing to AWS management APIs is hard. AWS S3 has had some poor press coverage, but to Amazon's credit it has always been subject to authentication by default and not leaked any customer data.

You're probably a Blue Team, not a Red Team

For those unfamiliar with Cybersecurity team colors, there are Blue Teams which are the defenders, and there are Red Teams who are simulating attackers with the goal to prove a circumvention of these defences. There are a few other colors too, the only other well known one is _Purple Team_

Everything in AWS is an API, is it secure?

EDIT: 2020-08-01 SHA-1 Windows content to be retired [https://techcommunity.microsoft.com/t5/windows-it-pro-blog/sha-1-windows-content-to-be-retired-august-3-2020/ba-p/1544373] in 2 days. Amazon is in an ever decreasing group of cryptography ignorant providers. EDIT: 2020-08-07 China believes TLS 1.3 privacy (hidden identity, not to be confused with confidentiality of data) is