What the !#@% is a Passkey?
A new login technique is becoming available in 2023: the passkey. The passkey promises to solve phishing and prevent password reuse. But lots of smart and security-oriented folks are confused about what exactly a passkey is. There’s a good reason for that. A passkey is in some sense one of two (or three) different things, depending on how it’s stored.
How the Wikimedia Foundation Balances Security and Open Information in Web Development - OpenJS Foundation
Background The Wikimedia Foundation is the non-profit that hosts Wikipedia and other free knowledge and open data projects. These projects are made possible by a global community who, together with...
![Threat Hunting: Detecting Browser Credential Stealing [T1555.003] - FourCore](https://rdl.ink/render/https%3A%2F%2Ffourcore.io%2Fimages%2Fbrowsercreds_threathunting%2Fheader.png?width=92&height=&ar=&mode=&format=avif&dpr=2)
Threat Hunting: Detecting Browser Credential Stealing [T1555.003] - FourCore
Adversaries can steal credentials, cookies and other private data from browsers using various techniques. We cover how you can simulate Credential Stealing From Browser s and detect it with your security tools. Sigma Rules Inside.
How To Secure Your Web App With HTTP Headers — Smashing Magazine
Web applications, be they thin websites or thick single-page apps, are notorious targets for cyber-attacks. In 2016, approximately 40% of data breaches originated from attacks on web apps — the leading attack pattern. Indeed, these days, understanding cyber-security is not a luxury but rather **a necessity for web developers**, especially for developers who build consumer-facing applications.
HTTP response headers can be leveraged to tighten up the security of web apps, typically just by adding a few lines of code. In this article, we’ll show how web developers can use HTTP headers to build secure apps. While the code examples are for Node.js, setting HTTP response headers is supported across all major server-side-rendering platforms and is typically simple to set up.
Content Security Policy, Your Future Best Friend — Smashing Magazine
The benefits of using a “content security policy” are many. In this article, Nicolas Hoffmann will introduce you to this technology, and he’ll explain why awareness is the most important advantage of CSP for website maintainers.
Salt Labs | Oh-Auth - Abusing OAuth to take over millions of accounts
It’s extremely important to make sure your OAuth implementation is secure. The fix is just one line of code away. We sincerely hope the information shared in our blog post series will help prevent major online breaches and help web service owners better protect their customers and users.
Securing Rails Applications — Ruby on Rails Guides
This manual describes common security problems in web applications and how to avoid them with Rails.After reading this guide, you will know: All countermeasures that are highlighted. The concept of sessions in Rails, what to put in there and popular attack methods. How just visiting a site can be a security problem (with CSRF). What you have to pay attention to when working with files or providing an administration interface. How to manage users: Logging in and out and attack methods on all layers. And the most popular injection attack methods.
