I mean this file is usually open to everyone. And it contains information that might be useful for a hacker. Do you know how to protect it against anyone except search engine crawlers? I am working on a post about it.

I recently noticed on some product pages on Amazon, that the text in the "Customer questions & answers" section is bold. It's not bold on 99% of other product pages. It seems this is caused by an unclosed <b> tag, which originates from the "Product description" section above it.

Example page: https://www.amazon.com/bayite-Drilled-Ferrocerium-Starter-Survival/dp/B00S6F4RDC/

So, it seems that Amazon is a bit too trusting of the html supplied by those who create / supply the product description html. If they can't even ensure that users supply only clean, well-formed html in product descriptions...I wonder what else one could accomplish with some creativity when submitting a product description.

Scary.

Today’s ubiquitous client-server architecture is problematic. It limits the power of our smartphones, and not only. It limits our privacy.

As you know, computing went from local servers to cloud servers. That solved a lot of problems but created epic new problems, as well.

One of these problems is ID, which is currently addressed by the username/password, and sometimes by a one-time password. Then, generation of auth tokens: short-lived, long-lived, etc. That allows access to the data. Those tokens are granted to devices and applications.

Next, here’s the problem with the cloud.

The only reliable way to get data out of the mobile phone is to upload it to a cloud server. To access the data you must log in and find the piece of data you just uploaded, and the way the industry is going is to put everything in the cloud, then access it, and synchronize it with multiple different devices using services like Google, iCloud, etc.

All these services maintain authentication and access control in the cloud. These service providers then begin gathering incredible amounts of information about you. The uploaded data is unencrypted, and your control over it becomes…non-existent.

We were looking for a technical solution that would put the phone at the control point of the application workflow. We wanted to make the phone into the mother-of-all.

For this, we needed an architecture that could allow another party to be able to connect to the mobile device, easily check and validate identity, and based on user-controlled auth logic, grant or deny access.

Of course, all the while maintaining end-to-end encryption and trust integrity.

From an encryption standpoint, the TLS sessions are terminated at the cloud servers, then data is opened and relayed to the other party.

The challenge is how do you implement this additional encryption and how do you implement it in a web browser in particular?

We now have a streamlined answer to these problems that cuts through all this nonsense by relying on existing security infrastructure.

Basically, we make the mobile into the server, and give it a public hostname under our domain that can stay with this app instance forever. We further equip it with a publicly trusted cert and a tunnel.

To get the cert, the app must first request it with an App ID and a shared secret which is never sent through the internet. Then, all subsequent communication will require proof of the cert. This is basically two-factor authentication on steroids.

So why is this significantly better? We rely on the browser’s native encryption which is, of course, not accessible from javascript and/or console. The auth goes against the mobile device directly.

With this, you can integrate mobile device capabilities into web apps and offer features that will seem like magic to most users.

Definitely ask us if you have questions about what we've written!

From https://beame.io

" Bad bots are the worst... First the plugin adds a hidden trigger link to the footer of your pages. You then add a line to your robots.txt file that forbids all bots from following the hidden link. Bots that then ignore or disobey your robots rules will crawl the link and fall into the trap...

...I call it the “one-strike” rule: bots have one chance to obey your site’s robots.txt rule. Failure to comply results in immediate banishment. "

Jeff Starr

Wordpress plugin Black Hole for Bad Bots (doesnt work with page caching)

or use this robots.txt

https://github.com/mitchellkrogza/nginx-ultimate-bad-bot-blocker/blob/master/robots.txt/robots.txt

Smart devices, which are part of the IoT ecosystem (Internet of Things), are not only increasingly prevalent at homes. They also find their way into businesses of all sizes including enterprises. Unfortunately, the cybersecurity of IoT devices leaves a lot to be desired and is often overlooked. Read on »

I work in the computer security industry and am looking for a webfilter for my home use. I'd prefer something open source, with a strong support base, and very customizable. Here are a list of features I am looking for.

• Content Filtering - Web and email; the more filtering methods that are provided the better. I allow neighbors to connect to my wireless and would like to mitigate my liability. Also, I'd rather provide my neighbors, their kids, my siblings, etc. with the meaningful content, not an unlimited spank bank.

• Security -

  • Email, attachment, download, etc. scanning for viruses and malware.

  • Attack detection and mitigation - DoS, spoofing, etc.

  *Automatic updates to detection measures and signatures.

  • DLP - Scanning outbound information. This is less important but is a "nice to have feature." This would be more configured to protect my work than anything else.

• Ease of Use - I'd like something with a lot of functionality and customizability, but it would be ideal if general setup was fairly intuitive.

• Hardware Guide - Having examples of setup and installation on SBCs or other limited power devices would be ideal.

Anything you think I'm missing please let me know.

Hello.Where can i get information about web security,most attacked vulnerability?

Hi everyone,

I hope you're all doing well!

I wanted to share a tool that could be very useful for those of you building web and mobile applications, especially when it comes to securing your APIs.

We all know that the security aspect of most websites is often under-tested. Attackers can bypass the UI and call APIs directly, extracting more information than intended and discovering business logic vulnerabilities.

What if you could remove your APIs and source code from the attackers' landscape entirely? Codesealer does just that with end-to-end API encryption. By concealing all API endpoints behind an opaque /x endpoint and encrypting all API requests beyond TLS, it prevents request forgery and manipulation.

And all this without any code changes on your side. Sounds cool?

I'd love to hear your thoughts on this approach.