Submitted 3 days ago by shellsharks@infosec.pub to cybersecurity@infosec.pub
Weekly thread to discuss whatever you’re working on, big or small, at work or in your free time.
Been diving into the Tor Browser codebase recently and as a consequence now lifting over a few goodies in the privacy and security departments from there to Konform Browser
This week I gave up on trying to convince the teamlead an oauth access token lifetime of 5 years is too much. Yes, an access token, not an API key. There’s no revocation mechanism either.
At home I fixed RBAC for traefic, after wading through config and in the end basically just flipping switches until it worked. It does work now though so admin apps are inaccessible to family accounts. Still somewhat open for suggestions as I’m not 100% convinced by traefic yet.
Overthrowing a small 3rd world country for kicks
Spent some time looking for ideas on how to do a security training (compliance requirement) that didn’t suck. Cribbing from some reddit posts, I think I’m going to give everyone a notecard with something like “Is Bob Bobson a client here”, have them pair up, and do a little phone conversation roleplay where one person is a visher trying to trick the other into revealing the piece of information, while the other person gets practice saying “No.” Seemed like a good way to let the staff dip a toe into thinking like an attacker.
Oka@sopuli.xyz 3 days ago
If I told you it wouldnt be secure.
shellsharks@infosec.pub 3 days ago
Ah, the ol’ security through obscurity trick… (not recommended) 😁
Oka@sopuli.xyz 2 days ago
Ok fine, im storing passwords as plaintext on a public facing database hosted locally…
…without sanitizing inputs