#security (142 links)
- Google Authenticator is not iOS 7 compatible, will erase your tokens | Hacker News news.ycombinator.com
There are alternatives to Google Authenticator? Good stuff.
- Cloak VPN :: Push Button Security getcloak.com
A service for your Mac, iPhone, and iPad that keeps you safe from prying eyes on public wi-fi.
- Part2 - browsersec - Browser Security Handbook, part 2 - Browser Security Handbook - Google Project Hosting code.google.com
Solid same-origin policy info and much, much more.
- Member Access WordPress Plugin chrisabernethy.com
This is what the internet should be about: remotely setting things on fire.
- How To Safely Store A Password | codahale.com codahale.com
"Use bcrypt. Use bcrypt. Use bcrypt. Use bcrypt. Use bcrypt. Use bcrypt. Use bcrypt. Use bcrypt. Use bcrypt." Thanks, Pete.
Honking great lists of things to remember.
Answer: no. Clever hack with security implications. "In effect, this is taking the old phishing trick of homoglyph attacks—an attack consisting of using confusing look-a-like URLs like paypa1.com with the numeral one replacing the letter ell—and adding a dash of cross-site scripting but where you become the agent of infection: the supposed “censorship” may be shocking enough to cause you to forward the link."
- NGS Software - world leading software security ngssoftware.com
- Hardened-PHP Project - PHP Security - Suhosin hardened-php.net
An advanced protection system for PHP installations [...] designed to protect servers and users from known and unknown flaws in PHP applications and the PHP core.
- The Web Application Security Consortium / Web Application Security Scanner List projects.webappsec.org
- Web Application Exploits and Defenses jarlsberg.appspot.com
This codelab shows how web application vulnerabilities can be exploited and how to defend against these attacks. The best way to learn things is by doing, so you'll get a chance to do some real penetration testing, actually exploiting a real application.
Possible PassPack replacement (should one ever be required).
- Show My Code | Free Online decompiler showmycode.com
A Firefox extension produced as a collaboration between The Tor Project and the Electronic Frontier Foundation. It encrypts your communications with a number of major websites.
- Bad Neighborhood - Login LockDown WordPress Security Plugin bad-neighborhood.com
Login LockDown records the IP address and timestamp of every failed WordPress login attempt. If more than a certain number of attempts are detected within a short period of time from the same IP range, then the login function is disabled for all requests from that range. This helps to prevent brute force password discovery.
- just another blog: nginx basic auth (htpasswd) fenidik.blogspot.com
- Your PasswordCard passwordcard.org
Your PasswordCard has a unique grid of random letters and digits on it. The rows have different colors, and the columns different symbols. All you do is remember a combination of a symbol and a color, and then read the letters and digits from there.
An active web application security reconnaissance tool. It prepares an interactive sitemap for the targeted site by carrying out a recursive crawl and dictionary-based probes. The resulting map is then annotated with the output from a number of active (but hopefully non-disruptive) security checks. The final report generated by the tool is meant to serve as a foundation for professional web application security assessments.
- KrazyDad » Blog Archive » Mayor of the North Pole krazydad.com
Last Sunday, while checking into the Hill Street Cafe in Burbank using the foursquare iPhone app, I idly wondered, “Can I become the mayor of the North Pole?” So I tried checking into a nearby 7-Eleven. It worked. I tried the Griffith Observatory about 5 miles away. It worked. I tried Disneyland, which is about an hour away. It didn’t work, but I now had an afternoon hacking project.
- PHP Security Consortium: PHPSecInfo phpsec.org
Provides an equivalent to the phpinfo() function that reports security information about the PHP environment, and offers suggestions for improvement.
- Bulletproof backups for MySQL | Carsonified carsonified.com
What my shell script does is allow you to automate correctly backing up a standard MySQL database, or databases, with full end-to-end encryption to an offsite location.
- Web Security: Are You Part Of The Problem? - Smashing Magazine smashingmagazine.com
- Ultimate Htaccess Tutorial for .htaccess files askapache.com
Insanely obsessive htaccess gubbins.
- Carsonified » The Definitive Guide to GET vs POST carsonified.com
There is a lot misuse of GET over POST and vice versa. Both HTTP methods can achieve the same goals, but an incorrect choice between them can lead to unexpected and potentially harmful outcomes.
- Verified by Visa: a conversion rate killer? | Blog | Econsultancy econsultancy.com
Banks and card providers haven't really done enough to educate customers about the system, or to make the forms more usable, but retailers can at least minimise some of the damage to conversion rates by doing as much as they can to advise customers about what to expect during the checkout process.
- Orbicule | Undercover | iPhone orbicule.com
Hurrah, Undercover iPhone version is out. "If your iPhone is stolen, Undercover will pretend to be a game. This will encourage the thief to wait a few seconds for the game to load, enabling Undercover to get accurate location information. This location information is then added to your account and transmitted to the police station where you reported the theft."
Take a look at Verified By Visa. Allegedly this protects cardholders - by training them to expect a process in which there’s absolutely no way to know whether you are being phished or not.
- Send Me Home - World Peace through Wandering Items sendmehome.com
A free tool that lets you assign a unique code to anything.
- Password Manager + Automatic Form Filler for Mac OS X agilewebsolutions.com
Probably a better bet than passwordmaker. "use strong and unique passwords for every site and never forget any of them".
- Role Manager - Wordpress im-web-gefunden.de
WordPress Version 2.0 introduces the concept of Roles. Each Role is allowed to perform a set of tasks called Capabilities. This Plugin allows you to define and manage multiple subscriber profiles - called Roles and their Capabilities.
- Police vet live music, DJs for 'terror risk' • The Register theregister.co.uk
"A dozen London boroughs have implemented a "risk assessment" policy for live music that permits the police to ban any live music if they fail to receive personal details from the performers 14 days in advance."
"I have been asked by my work place to provide my passport." Not just employers; looks like it's becoming standard practice for recruiters to ask even if trading as a limited company. Something to do with the Immigration, Asylum and Nationality Act 2006.
- The point of “Open” in OpenID simonwillison.net
Open means that providers and consumers are free to use the protocol in whatever way they wish. If they want to only accept OpenID from a trusted subset of providers, they can go ahead.
- Clickpass clickpass.com
"Log into websites with the click of a button - never again be locked out". Powered by OpenID.
- Orbicule | Weblog orbicule.com
I always have this problem: "It turns out that all you have to do is hold down the option (alt) key during startup and once you enter your firmware password you will be able to select a disk."
- Securing Leopard - Checklist - Securethoughts securethoughts.net