/id retweeted
📖 CloudSecList Issue 304 just got released, w/ content from @Cloudflare @permisosecurity @salesforceben @trailofbits @slashid_dev and more!
cloudseclist.com/issues/issu…
![📖 [The CloudSecList] Issue 304](https://pbs.twimg.com/card_img/2114419984013099009/dRbw9HZa?format=png&name=280x280_2)
/id retweeted
I can't stop thinking about this blog post where they replaced Redis with SQLite—and surprisingly, SQLite was faster!
What's interesting is that Redis was running locally, SQLite was storing the data on disk. So it was memory (Redis) vs disk (SQLite), but Redis needed to communicate through IPC.
ALT Test Results chart showing SQLite to be faster than Redis
/id retweeted
Collection of insane and fun facts about SQLite. Let's go!
SQLite is the most deployed and most used database. There are over one trillion (1000000000000 or a million million) SQLite databases in active use.
It is maintained by three people. They don't allow outside contributions.
/id retweeted
Show me you have no idea how to build an application auth control that can detect and prevent excessive auth attempts, without showing me
/id retweeted
/me reads this and weeps like a small child who cannot play fortnite past 7pm.
Thank you Verizon for showing how shoddy appsec is today.
/id retweeted
📖 CloudSecList Issue 227 just got released, w/ content from @slashid_dev @NetSPI @infracloudio @ramimacisabird @PaloAltoNtwks @plerionhq and more!
cloudseclist.com/issues/issu…
![📖 [The CloudSecList] Issue 227](https://pbs.twimg.com/card_img/2111879608882561024/X69ff9ro?format=png&name=280x280_2)
/id retweeted
It’s time to migrate users to strong, passwordless authentication. Credential stuffing is still way too common
🚨BREAKING: Genetics firm 23andMe confirms user data theft in a credential stuffing attack.
The hackers released 1 million lines of data targeting Ashkenazi Jews.
Readers added context they thought people might want to know
More context: the company’s servers were not breached. The attackers logged in to user accounts that had simple or reused passwords, and leveraged the “DNA relatives” feature to gain more information. “The information does not appear to include actual, raw genetic data.”
wired.com/story/23andme-…
/id retweeted
Unfortunate outcome for caddy-security, but now I see @slashid_dev has a pretty slick commercial product for protecting internal apps with SSO.
slashid.dev/blog/gate-passke…
xitter.gq/trailofbits/status/170…
Our review of caddy-security (a Caddy plugin designed to enhance web app security through authN/authZ features) revealed high-severity issues such as XSS, OAuth replay attacks, IP spoofing, and open redirects.
buff.ly/44Qo6lm
/id retweeted
If you are looking for an alternative to Caddy to protect internal applications with Passkeys or SSO via Google/Okta/AzureAD, take a look at Gate! slashid.dev/blog/gate-passke…
Our review of caddy-security (a Caddy plugin designed to enhance web app security through authN/authZ features) revealed high-severity issues such as XSS, OAuth replay attacks, IP spoofing, and open redirects.
buff.ly/44Qo6lm
/id retweeted
🔖 Passkeys, the end of passwords and account takeovers?
A deep-dive blogpost on how to implement Passkeys and how to think about the threat model and security guarantees they offer. From @slashid_dev
slashid.dev/blog/passkeys-se…
/id retweeted
@slashid_dev handles Authentication Security for Developers.
We tried to create a clean, dynamic, smooth hero that doesn’t disturb the website’s usability. We succeeded.
See this shot on Dribbble:
dribbble.com/shots/20589983-…
#usability #uiux #development #webdesign #design
/id retweeted
✅ How to *actually* roll out YubiKeys/WebAuthN
Industry advice is to "just do it"
But it's actually really hard in practice
8 resources on lessons learned from companies who've done it 🧵
/id retweeted
This is a great blog post on and example of modern cryptography engineering in the cloud.
Don't accept "we use at-rest encryption" from SaaS vendors in the cloud, you want to see them implement designs like this that actually mitigate risks of compromise of their cloud accounts.
We published an overview of the cryptographic primitives and the architecture of our
Data Vault module.
slashid.dev/blog/app-layer-e…
/id retweeted
There’s a nice intersection between delivering on top of public cloud infrastructure and securing your users data.
If you’re into it, or you are trying to solve GDPR compliance issues, read it!
We published an overview of the cryptographic primitives and the architecture of our
Data Vault module.
slashid.dev/blog/app-layer-e…
/id retweeted
Australia recently faced big breaches. They will increase penalties for major data breaches. "A$50m [€32.23m]/ three times the value of the benefit obtained through the misuse of information/30% of turnover in the relevant period". MUCH higher than #GDPR! ministers.ag.gov.au/media-ce…
