Security

Want to know what SaaS stack a B2B company runs on? You don’t need a data leak or an insider - the company publishes it for you. Look at their sub-processor list. Most B2B companies are contractually required to disclose every third-party vendor that touches customer data. These sub-processor pages are public, they’re kept up to date, and they quietly reveal a competitor’s entire tech stack: cloud provider, monitoring, customer support, AI/ML vendors, and more. ...

Sandbox your tools before they harm you

Keep yourself secure - Always run third-party CLI tools inside Docker

For 6-months, this website was compromised. I am not sure what exactly happened, but it was most likely password-reuse, which lend itself to this problem. The problem became apparent when I first noticed an unusual link to a ride-sharing service. Later, I saw more of those links. That’s when I realized that I couldn’t merely sit and scan every blog post manually and decided to write a small interactive link checker tool. This tool whitelists the starting domain and allows you to whitelist URLs on a per-domain basis. The whitelist is persisted at the end of execution and will be used next time you use the tool. ...

Just completed reading " The Tangled web: A guide to securing modern applications" by Michael Zalewski. The book is surprisingly small given the amount of information it covers about the interaction of web browsers, websites, and client-side web technologies. The book starts with a discussion of what a valid URL could look like ( https://yahoo.com:80@google.com/microsoft.com - think which site is being connected to here) and then discusses several fundamental building blocks of the modern web (like cookies) as well as standard technologies (like Flash) in depth. The issue of the same-origin policy and how it differs from DOM to the cookie to pseudo URLs are explained with amazing clarity. One of the best things about this book is that it makes regular references to RFCs for authoritative answers and the corresponding deviant [and undefined] behavior implemented by the browsers. The book also covers HTML5 security features in detail. While reading the book, occasionally I felt information overload but I think the “Tangled web” and not the book “Tangled web” is responsible for that. ...

Came across a few interesting posts like this on my wall today.

As the world moves towards cloud-based storage and computing, the task of storing our data on a PC hard disk is being replaced with cloud-based storage providers. This includes our emails, social data, professional data, and financial data. Accessing this data requires authentication, despite its various limitations, username and password are still the standard way of authentication [though OpenID is slowly becoming popular]. One thing which is crucial in this case is how web services store user’s password.

This article illustrates some examples of how the Indian government deals with (Information) Technology. Some of these projects are unheard of while some generated unnecessary hype.

CERT-In is a low-profile (Indian) government organization. The Government of India established the Computer Emergency Response Team (“CERT-IN”) to ensure Internet security. Many institutions, including the Ministry of Home Affairs, courts, the intelligence services, the police, and the National Human Rights Commission, may call on it for specialist expertise. CERT-IN’s stated mission is “to enhance the security of India’s Communications and Information Infrastructure through proactive action and effective collaboration” [ Source] I had a chance to visit CERT-In last week. The experience was overall good, unlike the typical dirty government office with laid-back employees, I saw employees enthusiastic about their work (and a colorful office).

A primer on HTTPS warnings and error messages