I am currently employed at a financing company operating in both the USA and Canada. My current task involves exploring alternative methods to validate new credit applications.
Presently, we rely on a one-time SMS message for our new custo…
I’m building a tool and users will run it by downloading a binary. What I’m considering is good ways to secure this for the user. There’s for me easy ways like "Recommend running this on a new temporary VM without internet access"…
Consider me the average Linux user. I know the basics of shell scripting and intermediate Python. However, I have very limited knowledge of system admin or security related matters.
Background:
Say that I have a Python application just in …
I’m working on idea for a project the goal is to allow a user to share their encrypted content with friends while ensuring the server and none friends maintains zero knowledge of the actual content.
Here’s an example structure of a user:
U…
I am using the note taking app Color Note (www.colornote.com) on my mobile phone that is using Android 7.1.1 to take some notes (old device). I am not using their cloud sync capability, and my email/any personal accounts aren’t connected t…
Is it necessary to implement both Content-Security-Policy and X-Content-Type-Options for ensuring the security of a website?
Spoofy is a program that checks if a list of domains can be spoofed based on SPF and DMARC records. You may be asking, “Why do we need another tool that can check if a domain can be spoofed?” Well, Spoofy is different and here is why: Authorita…
What are the risks to allow a "blob:" directive to the script-src CSP? Is it safe?
I have a list of allowed domains defined in script-src, but nonetheless I got an error specifying the violation of the CSP directive when trying t…
A pure python library for identifying the use of known or very weak cryptographic secrets across a variety of platforms. The project is designed to be both a repository of various “known secrets” (for example, ASP.NET machine keys found in examples…
There is an Azure-based internal database server and is not public-facing. There is another front-end application. A specific user group can connect with a VPN. There is no encryption applied at the disk level. So what risk or specific ga…
