#security (142 links)
- Security checklists | Google Workspace Help knowledge.workspace.google.com
- Security - Fleet handbook fleetdm.com
We configure Google Workspace beyond the default settings to reduce the risk of malicious or vulnerable apps being used to steal data. Our current configuration balances security and productivity and is a starting point for any organization looking to improve the security of Google Workspace.
Youch.
- A field guide to sandboxes for AI luiscardoso.dev
- We should all be using dependency cooldowns blog.yossarian.net
TL;DR: Dependency cooldowns are a free, easy, and incredibly effective way to mitigate the large majority of open source supply chain attacks. More individual projects should apply cooldowns (via tools like Dependabot and Renovate) to their dependencies, and packaging ecosystems should invest in first-class support for cooldowns directly in their package managers.
- Learning lessons from the cyber-attack blogs.bl.uk
Today, we’ve published a paper about the cyber-attack that took place against the British Library last October. Our hope is that doing this will help other organisations to plan and protect themselves against attacks of this kind.
- Ory ory.sh
API-first Identity Management, Authentication and Authorization.
- Learn and Test DMARC learndmarc.com
- Passkeys - Apple Developer developer.apple.com
- Passkeys now support external providers | Hacker News news.ycombinator.com
- Calling time on DNSSEC - Matt Brown mattb.nz
- 2FA Directory 2fa.directory
An independent source of information on which services support MFA/2FA and help consumers demand MFA/2FA on the services that currently don’t.
- How to Yubikey: A Configuration Cheatsheet | Hacker News news.ycombinator.com
- How to Yubikey: a configuration cheatsheet debugging.works
- Managed Apple IDs: What are they for? 9to5mac.com
In short: not much unless doing device management.
- A Yubico FAQ about passkeys yubico.com
- Google Workspace Admin Security Guide — Digital Defense Fund digitaldefensefund.org
Some reasonable tips here.
- Ask HN: IT Security Checklist for Startups? | Hacker News news.ycombinator.com
This guidance is for domains which: * never send email like defensively registered domains or legacy domains * previously sent email but do not any more
- Same-Site Cookies By Default | text/plain textslashplain.com
- Slack Security Incident for Keybase CEO keybase.io
- Mozilla Observatory observatory.mozilla.org
- Security Checklist securitycheckli.st
- How to Keep Messages Secure teenvogue.com
- DNS leak test dnsleaktest.com
- canarytokens.net canarytokens.org
<blockquote> You'll be familiar with web bugs, the transparent images which track when someone opens an email. They work by embedding a unique URL in a page's image tag, and monitoring incoming GET requests.
Imagine doing that, but for file reads, database queries, process executions, patterns in log files, Bitcoin transactions or even Linkedin Profile views. Canarytokens does all this and more, letting you implant traps in your production systems rather than setting up separate honeypots.</blockquote>
- How to Secure Your WordPress Blog/Site hostingfacts.com
- Anatomy of a Hijack - James Smith floppy.org.uk
- Let's Encrypt letsencrypt.org
<blockquote>Arriving Mid-2015 Let’s Encrypt is a free, automated, and open certificate authority.</blockquote>
- Josh Emerson - How to secure your site in an afternoon joshemerson.co.uk
- Sandstorm sandstorm.io
<blockquote>Take control of your web by running your own personal cloud server with Sandstorm.</blockquote>
- Schadenfreude - Charlie's Diary antipope.org
<blockquote>You can't do this shit on an amateur basis and not get burned. Handling money makes you a target: the more money, the bigger the bullseye: and you can't write secure software on the run or patch up a proof of concept to production quality on a shoestring budget.</blockquote>
- How do I back up Lastpass? askleo.com
The "clunky, insecure but simple and reasonably effective" strategy.
- Is Gmail secure enough for my private emails? theguardian.com
<blockquote>At the moment, if you want an alternative to Gmail, your best bet is probably FastMail, which is owned by Opera Software (Opera is Norwegian), registered in Micronesia (.fm), and based in Australia. Unfortunately, according to Wikipedia: "Its servers are located in New York City with a backup in Norway."</blockquote>
- How to remain secure against NSA surveillance theguardian.com
<blockquote>The NSA has turned the fabric of the internet into a vast surveillance platform, but they are not magical. They're limited by the same economic realities as the rest of us, and our best defense is to make surveillance of us as expensive as possible. Trust the math. Encryption is your friend. Use it well, and do your best to ensure that nothing can compromise it.</blockquote>
- MyKolab.com mykolab.com
<blockquote>We offer secure email accounts including calenders and address books that synchronize to all your devices. </blockquote>
- al3x/sovereign · GitHub github.com
<blockquote>A set of Ansible playbooks to build and maintain your own private cloud: email, calendar, contacts, file sync, IRC bouncer, VPN, and more.</blockquote>