#security (165 links)
- canarytokens.net canarytokens.org
You'll be familiar with web bugs, the transparent images which track when someone opens an email. They work by embedding a unique URL in a page's image tag, and monitoring incoming GET requests.
Imagine doing that, but for file reads, database queries, process executions, patterns in log files, Bitcoin transactions or even Linkedin Profile views. Canarytokens does all this and more, letting you implant traps in your production systems rather than setting up separate honeypots.
Your DNS Setup can have a great effect on performance and DDoS resilience. Early Saturday morning we got alerted by Rackspace that a major DDoS attack was…
- Never see localhost SSL warnings again certsimple.com
If you've done any web development you'll be used to seeing this every time you connect to https://localhost : Unless your OS has already been hacked - at which…
- About rel=noopener mathiasbynens.github.io
0m6 you’ve been h4ck3d!!1one!shift!!!1 💩 About rel=noopener What problems does it solve? You’re currently viewing index.html. Imagine the following is…
- Anatomy of a Hijack - James Smith floppy.org.uk
- Tinfoil tinfoilsecurity.com
Security scanner than integrates with CI.
- Let's Encrypt letsencrypt.org
Arriving Mid-2015 Let’s Encrypt is a free, automated, and open certificate authority.
- Josh Emerson - How to secure your site in an afternoon joshemerson.co.uk
- Sandstorm sandstorm.io
Take control of your web by running your own personal cloud server with Sandstorm.
- Schadenfreude - Charlie's Diary antipope.org
You can't do this shit on an amateur basis and not get burned. Handling money makes you a target: the more money, the bigger the bullseye: and you can't write secure software on the run or patch up a proof of concept to production quality on a shoestring budget.
- How do I back up Lastpass? askleo.com
The "clunky, insecure but simple and reasonably effective" strategy.
- Is Gmail secure enough for my private emails? theguardian.com
At the moment, if you want an alternative to Gmail, your best bet is probably FastMail, which is owned by Opera Software (Opera is Norwegian), registered in Micronesia (.fm), and based in Australia. Unfortunately, according to Wikipedia: "Its servers are located in New York City with a backup in Norway."
- How to remain secure against NSA surveillance theguardian.com
The NSA has turned the fabric of the internet into a vast surveillance platform, but they are not magical. They're limited by the same economic realities as the rest of us, and our best defense is to make surveillance of us as expensive as possible. Trust the math. Encryption is your friend. Use it well, and do your best to ensure that nothing can compromise it.
We offer secure email accounts including calenders and address books that synchronize to all your devices.
- al3x/sovereign · GitHub github.com
A set of Ansible playbooks to build and maintain your own private cloud: email, calendar, contacts, file sync, IRC bouncer, VPN, and more.
- Google Authenticator is not iOS 7 compatible, will erase your tokens | Hacker News news.ycombinator.com
There are alternatives to Google Authenticator? Good stuff.
- Cloak VPN :: Push Button Security getcloak.com
A service for your Mac, iPhone, and iPad that keeps you safe from prying eyes on public wi-fi.
- Part2 - browsersec - Browser Security Handbook, part 2 - Browser Security Handbook - Google Project Hosting code.google.com
Solid same-origin policy info and much, much more.
- Member Access WordPress Plugin chrisabernethy.com
This is what the internet should be about: remotely setting things on fire.
"Use bcrypt. Use bcrypt. Use bcrypt. Use bcrypt. Use bcrypt. Use bcrypt. Use bcrypt. Use bcrypt. Use bcrypt." Thanks, Pete.
Via thegingerbloke.
Honking great lists of things to remember.
Answer: no. Clever hack with security implications. "In effect, this is taking the old phishing trick of homoglyph attacks—an attack consisting of using confusing look-a-like URLs like paypa1.com with the numeral one replacing the letter ell—and adding a dash of cross-site scripting but where you become the agent of infection: the supposed “censorship” may be shocking enough to cause you to forward the link."
Via alastc.
- Hardened-PHP Project - PHP Security - Suhosin hardened-php.net
An advanced protection system for PHP installations [...] designed to protect servers and users from known and unknown flaws in PHP applications and the PHP core.
- The Web Application Security Consortium / Web Application Security Scanner List projects.webappsec.org
This codelab shows how web application vulnerabilities can be exploited and how to defend against these attacks. The best way to learn things is by doing, so you'll get a chance to do some real penetration testing, actually exploiting a real application.
Possible PassPack replacement (should one ever be required).
- Show My Code | Free Online decompiler showmycode.com
A Firefox extension produced as a collaboration between The Tor Project and the Electronic Frontier Foundation. It encrypts your communications with a number of major websites.
- Bad Neighborhood - Login LockDown WordPress Security Plugin bad-neighborhood.com
Login LockDown records the IP address and timestamp of every failed WordPress login attempt. If more than a certain number of attempts are detected within a short period of time from the same IP range, then the login function is disabled for all requests from that range. This helps to prevent brute force password discovery.
- just another blog: nginx basic auth (htpasswd) fenidik.blogspot.com
- Your PasswordCard passwordcard.org
Your PasswordCard has a unique grid of random letters and digits on it. The rows have different colors, and the columns different symbols. All you do is remember a combination of a symbol and a color, and then read the letters and digits from there.
Via tomtaylor.
An active web application security reconnaissance tool. It prepares an interactive sitemap for the targeted site by carrying out a recursive crawl and dictionary-based probes. The resulting map is then annotated with the output from a number of active (but hopefully non-disruptive) security checks. The final report generated by the tool is meant to serve as a foundation for professional web application security assessments.
Via paul.irish.
- KrazyDad » Blog Archive » Mayor of the North Pole krazydad.com
Last Sunday, while checking into the Hill Street Cafe in Burbank using the foursquare iPhone app, I idly wondered, “Can I become the mayor of the North Pole?” So I tried checking into a nearby 7-Eleven. It worked. I tried the Griffith Observatory about 5 miles away. It worked. I tried Disneyland, which is about an hour away. It didn’t work, but I now had an afternoon hacking project.