Pinboard (earth2marsh) https://pinboard.in/u:earth2marsh/public/ recent bookmarks from earth2marsh Nearly Half of LG Smart TV Apps Contain Residential Proxy SDKs 2026-07-02T00:04:38+00:00 https://spur.us/blog/smart-tv-apps-residential-proxy-sdks earth2marshSmart TVs are almost ideal proxy hosts. They sit on the same home network as everything else, but they do not feel like computers, so people rarely audit them like computers. There is no battery drain to notice, no cellular bill to spike, no app switcher full of suspicious background activity. A TV can stay plugged in, signed in, and online for years while the user thinks of it as furniture.]]> security iot privacy television appliances https://pinboard.in/ https://pinboard.in/u:earth2marsh/b:423729a7051a/ The Smart TV in Your LivingRoom Is a Node in the AIScraping Economy - Include Security Research Blog 2026-06-07T04:45:16+00:00 https://blog.includesecurity.com/2026/06/the-smart-tv-in-your-livingroom-is-a-node-in-the-aiscraping-economy/ earth2marshApproach 1: DNS block (trivial, effective for network-routed devices): proxyjs.brdtnet.com proxyjs.luminatinet.com proxyjs.bright-sdk.com clientsdk.bright-sdk.com clientsdk.brdtnet.com Blocking proxyjs.* kills the peer tunnel without affecting any customer who legitimately uses Bright Data’s customer-facing proxy service on a different domain.]]> sdks proxies relays sneaky security television https://pinboard.in/ https://pinboard.in/u:earth2marsh/b:98d20340bfef/ The Elephant in The Biz: outsourcing of critical IT and cybersecurity functions risks UK economic security | by Kevin Beaumont | Sep, 2025 | DoublePulsar 2025-10-05T12:39:25+00:00 https://doublepulsar.com/the-elephant-in-the-biz-outsourcing-of-critical-it-and-cybersecurity-functions-risks-uk-economic-96205e0585bf earth2marshEssentially, we’ve ended up in a situation where to deliver shareholder value, large organisations are incentivised to outsource core IT and cybersecurity functions to a low cost managed service providers abroad — and then when hit with ransomware, the insurance will cover paying the ransom (some insurers will actually push for payment to criminal groups, to cover their potential losses). This cycle plays into the ransomware economy, where the same criminal groups can then reinvest the money into purchasing exploits and gaining initial access to other organisations. Because ransomware is such big business, many of the groups have far bigger research and development funds than the organisations they’re attacking. Especially when the organisations they’re attacking have outsourced key areas to low cost providers. The net effect is ransomware and extortion groups continue to gain access to more organisations, and risk UK economic security. It is only a matter of time before they hit some kind of essential UK service that directly impacts millions of people — by which point millions of people will be asking what is being done about the problem. And the answer is: not enough. When we’re at the stage of having to look at urgent furlough schemes for JLR’s suppliers to rightly save jobs, it isn’t so much a sign as the canary in the coalmine has died, but that the coalmine is also about to collapse on people.]]> ransomware security it incentives https://pinboard.in/ https://pinboard.in/u:earth2marsh/b:aa9e9bfbccd4/ The Security Principles Guiding 1Password’s Approach to AI | 1Password 2025-09-19T16:57:55+00:00 https://blog.1password.com/security-principles-guiding-1passwords-approach-to-ai/ earth2marshAt 1Password, we strive to make security effortless and universal. When it comes to AI, that means enabling organizations to use AI tools effectively without compromising our core security values of privacy, transparency, and trust. As we empower our customers to securely adopt AI, we are building around a clear set of principles. Below are the security principles that will guide how we build, adopt, and integrate AI—today and in the future. ]]> ai llms security principles https://pinboard.in/ https://pinboard.in/u:earth2marsh/b:ef9fd256a17c/ Chromium Docs - The Rule Of 2 2025-08-09T15:41:49+00:00 https://chromium.googlesource.com/chromium/src/+/main/docs/security/rule-of-2.md earth2marshThe Rule Of 2 When you write code to parse, evaluate, or otherwise handle untrustworthy inputs from the Internet — which is almost everything we do in a web browser! — we like to follow a simple rule to make sure it's safe enough to do so. The Rule Of 2 is: Pick no more than 2 of untrustworthy inputs; unsafe implementation language; and high privilege. ]]> coding safety security bestpractices guidance code inputs https://pinboard.in/ https://pinboard.in/u:earth2marsh/b:c961aebb22d1/ The Cyber Resilience Act: A Five Alarm Fire – tecosystems 2025-08-06T13:57:40+00:00 https://redmonk.com/sogrady/2025/08/06/cra-five-alarm-fire/ earth2marshBased on the financial downsides here, optimistic observers are concluding that the CRA could be a game changer in open source economics. As companies digest the potential penalties involved, they will be obligated to establish commercial relationships with open source projects they currently rely on at no cost. That means more money going from vendors relying on open source to those producing it, which would be a boon for developers. It also raises the question of what happens to product prices when manufacturers are compelled to pay for software they have to date consumed at no cost, but that’s outside the scope of this exercise.]]> security resilience opensource licensing Europe regulation https://pinboard.in/ https://pinboard.in/u:earth2marsh/b:1157a1627dbc/ Manage API accesses with a Personal Access Token | Managing an Organization - Organizations | Gandi Documentation — Gandi Documentation documentation 2025-05-21T19:33:37+00:00 https://docs.gandi.net/en/managing_an_organization/organizations/personal_access_token.html earth2marshIn the contrary of the API keys, which gave a single API access to all the products of all the organizations related to the username, for an undetermined duration, and that can be provided to several persons, a PAT has : a limited duration, limited (or full) permissions on all or part of the products (called resources) of an organization, several “instances” of a token with the same duration and permissions, but named differently, so you know who uses which token. Personal Access Tokens (PATs) allow you to improve the security of your products, and to manage in detail the access to your products using Gandi Public API.]]> apis PATs tokens authorization security https://pinboard.in/ https://pinboard.in/u:earth2marsh/b:5445a0f68656/ The 6 Fundamental Forces of Information Security Risk 2025-02-13T06:53:42+00:00 https://www.philvenables.com/post/the-6-fundamental-forces-of-information-security-risk earth2marsh4. Entropy is King Unchecked controls fail over time, untested resilience fades gradually and then suddenly. Constant counterbalance is needed. Everything degrades unless countered with a force to keep it in place. This is why continuous control monitoring and, in effect, “control reliability engineering” is so essential]]> security risks information https://pinboard.in/ https://pinboard.in/u:earth2marsh/b:021a7cb5a44a/ Why Good Security Fails: The Asymmetry of InfoSec Investment  2025-02-13T06:49:04+00:00 https://www.philvenables.com/post/why-good-security-fails-the-asymmetry-of-infosec-investment earth2marshSo, why does this happen? Simple, it is because many organizations do not put in processes to counteract this natural tendency. This is especially hard for distributed organizations where security resources are embedded in business units, engineering teams or across a network of suppliers. But it’s also a challenge for the security team’s own resources. This is an example of one of the fundamental Forces of Security: Entropy is King. So, what can we do to put in place the counter forces to sustain security?]]> security culture failure organizations https://pinboard.in/ https://pinboard.in/u:earth2marsh/b:b5a116e29ffe/ API Discovery | GitLab 2025-01-09T02:08:54+00:00 https://docs.gitlab.com/ee/user/application_security/api_security/api_discovery/ earth2marshAPI Discovery Tier: Ultimate Offering: GitLab.com, Self-managed, GitLab Dedicated History API Discovery analyzes your application and produces an OpenAPI document describing the web APIs it exposes. This schema document can then be used by the API security testing analyzer or API Fuzzing to perform security scans of the web API. Supported frameworks Java Spring-Boot When does API Discovery run? API Discovery runs as a standalone job in your pipeline. The resulting OpenAPI document is captured as a job artifact so it can be used by other jobs in later stages. API Discovery runs in the test stage by default. The test stage was chosen as it typically executes before the stages used by other security features such as API security testing and API fuzzing.]]> apis discovery opensource pipelines security platformengineering https://pinboard.in/ https://pinboard.in/u:earth2marsh/b:4b1eba46e2d0/ Snikket Chat | Simple, secure and private messaging 2024-12-27T15:49:04+00:00 https://snikket.org/ earth2marshChat that is simple, secure, and private Everything you expect from an easy-to-use messaging platform, but now under your control.]]> protocol privacy security chat messaging opensource https://pinboard.in/ https://pinboard.in/u:earth2marsh/b:eea55781fef6/ Postman Data Leaks: The Hidden Risks Lurking in Your Workspaces | CloudSEK 2024-12-23T21:41:28+00:00 https://cloudsek.com/blog/postman-data-leaks-the-hidden-risks-lurking-in-your-workspaces earth2marshSensitive data leaks in Postman workspaces pose significant risks, exposing API keys, credentials, and tokens that can lead to unauthorized access, data breaches, and reputational harm. A year-long investigation revealed over 30,000 publicly accessible workspaces leaking sensitive information, including business data and customer PII. Improper access controls, accidental sharing, and storing data in plaintext were major contributors to these vulnerabilities. Adopting best practices like using environment variables, limiting permissions, and implementing external secrets management is critical to mitigate these risks and secure collaborative development environments.]]> postman security secrets https://pinboard.in/ https://pinboard.in/u:earth2marsh/b:8503754bb610/ Lee Holmes | Security Risks of Postman 2024-12-23T21:39:43+00:00 https://www.leeholmes.com/security-risks-of-postman/ earth2marshHere is a rough playbook for how you can eliminate Postman in your company. Your mileage may vary, of course. Determine your population of Postman users. We were able to get this list through endpoint URL usage data of users connecting to https://identity.getpostman.com. Instruct these users to: Log in (or open) Postman, go the History tab. Review any entries with an “Authorization” header, or other sensitive headers. Rotate any credentials associated with any of these that have been saved. Review any entries that use URL-based authorization]]> postman security migration https://pinboard.in/ https://pinboard.in/u:earth2marsh/b:bedb6070b682/ Remove Personal Info from Google - DeleteMe 2024-12-06T00:44:23+00:00 https://joindeleteme.com/ earth2marshDeleteMe makes it quick, easy and safe to remove your personal data online.]]> data privacy security optout https://pinboard.in/ https://pinboard.in/u:earth2marsh/b:1532ff41a120/ EasyOptOuts.com 2024-12-06T00:43:31+00:00 https://easyoptouts.com/ earth2marshYour name, address, and phone number are available for anyone to view on people-search sites. Unless you opt out, your privacy is compromised. We make it easy and affordable to remove yourself from over 160 websites.]]> optout privacy data security https://pinboard.in/ https://pinboard.in/u:earth2marsh/b:c7a8f7bb137f/ Ente Auth - Open source 2FA authenticator, with E2EE backups 2024-12-05T22:14:27+00:00 https://ente.io/auth/ earth2marshOpen source 2FA authenticator, with end-to-end encrypted backups
Authy has dropped all support for its desktop apps. It is no longer possible to export data from Authy using methods 1 and 2. You will either need a rooted android phone or you will need to reconfigure 2FA for each of your accounts.
]]> 2fa mfa authentication privacy security opensource tools https://pinboard.in/ https://pinboard.in/u:earth2marsh/b:69cc3173070d/ API Security: 10 Issues and How To Secure | CrowdStrike 2024-11-21T23:26:57+00:00 https://www.crowdstrike.com/en-us/cybersecurity-101/cloud-security/api-security/ earth2marshLet’s look at 10 of the most prevalent API security issues (according to OWASP) and explore how to prevent them. 1. Broken object-level authorization This risk occurs when an API does not correctly enforce object-level authorization, allowing attackers to access or modify data they should not have access to. To prevent this issue, use a centralized access control mechanism to manage object-level authorization. This mechanism should be able to enforce access control policies at the object level and handle complex relationships between objects. 2. Broken user authentication This risk occurs when an API does not properly authenticate users, allowing attackers to impersonate legitimate users and access sensitive data. To mitigate the risks that broken user authentication presents, implement multi-factor authentication and use secure password storage mechanisms. Multi-factor authentication adds an extra layer of security by requiring the possession of multiple devices to log in. Secure password storage mechanisms, such as hashing and salting, make it more difficult for attackers to crack passwords. 3. Broken object property-level authorization In systems that use large objects, a typical risk is that one object exposes more data than necessary. Even when the system uses object-level authorization, an object may still have properties that include sensitive data. The solution is to use encryption to protect sensitive data and limit the amount of data exposed. Encryption can help protect data in transit and at rest. Filtering object properties before sending them to a client can help reduce the impact of a data breach. 4. Lack of resources and rate limiting When an API does not properly allocate resources or enforce rate limits, attackers can launch denial-of-service attacks. To prevent these attacks, implement rate limiting and resource allocation mechanisms. Rate limiting can keep attackers from overwhelming the API with requests, and resource allocation mechanisms help ensure that resources are allocated fairly and efficiently. 5. Broken function-level authorization This risk occurs when an API doesn’t require authorization for each of its endpoints. This can allow attackers to call endpoints that should only be used by an administrator. Using a centralized access control mechanism to manage function-level authorization can help mitigate this risk. The access control mechanism should be able to enforce access control policies at the function level and should be capable of handling complex relationships between functions. 6. Server-side request forgery When an API accepts a URL from a client to fetch data from a third-party service and doesn’t validate the URL, it allows an attacker to submit malicious URLs that can expose internal services or scan the API for open ports. Employing URL allowlists or filtering internal hostnames and IPs can help prevent this problem. 7. Security misconfiguration Following safe coding practices and regularly updating software and security configurations are key steps to configuring APIs securely so attackers can’t exploit vulnerabilities. Using secure defaults, disabling unnecessary features, and regularly updating software and security configurations are just a few best practices for hardened security configuration. 8. Lack of protection from automated threats Automation can allow attackers to exploit regular business flows for financial gain by referring bots to a paid referral program or buying a limited product excessively to resell it later. Though some of these activities may not be illegal, they can still lead to reputation loss or financial losses for the organization. To keep this risk at bay, ensure that purchasing flows include reasonable limitations per person and referral programs are paid out only when a proof of personhood has been supplied. Device fingerprinting and blocking of suspicious IPs like Tor exit nodes are also recommended measures. 9. Improper asset management When an API does not properly manage assets such as keys and certificates, unauthorized users can gain access to sensitive information. This is another reason it’s critical to employ secure coding practices and regularly update software and security configurations. Asset management can also include using secure defaults and disabling unnecessary features. 10. Unsafe consumption of third-party APIs APIs often use APIs from third parties to get their work done. In many cases, these third-party APIs are treated as inherently secure. But these APIs can still become an attack vector into a system, allowing malicious users to indirectly send problematic inputs, such as SQL injections or forged URLs. Sanitizing inputs is vital — not just inputs from clients but from all systems that can enter data into your API. Employing allowlists for hostnames and restricting redirects can help ensure the safety of third-party APIs.]]> apis security https://pinboard.in/ https://pinboard.in/u:earth2marsh/b:ae9e19264039/ Passkeys: A Shattered Dream 2024-10-23T02:40:37+00:00 https://fy.blackhats.net.au/blog/2024-04-26-passkeys-a-shattered-dream/ earth2marshSince then Passkeys are now seen as a way to capture users and audiences into a platform. What better way to encourage long term entrapment of users then by locking all their credentials into your platform, and even better, credentials that can't be extracted or exported in any capacity.]]> passkeys security enshittification https://pinboard.in/ https://pinboard.in/u:earth2marsh/b:cd3099ba9bd1/ Incident Report: Leaked GitHub Personal Access Token - The Python Package Index Blog 2024-10-08T03:52:29+00:00 https://blog.pypi.org/posts/2024-07-08-incident-report-leaked-admin-personal-access-token/ earth2marshWhile developing cabotage-app5 locally, working on the build portion of the codebase, I was consistently running into GitHub API rate limits. These rate limits apply to anonymous access. While in production the system is configured as a GitHub App, I modified my local files to include my own access token in an act of laziness, rather than configure a localhost GitHub App. These changes were never intended to be pushed remotely.]]> leaks tokens apis security https://pinboard.in/ https://pinboard.in/u:earth2marsh/b:a1f48fe6dee7/ Doppler | Centralized Cloud-Based Secrets Management Platform 2024-09-30T17:05:28+00:00 https://www.doppler.com/ earth2marshSecurely manage, orchestrate, and govern secrets at scale with Doppler’s developer-first cloud hosted platform.]]> configuration security devops secrets https://pinboard.in/ https://pinboard.in/u:earth2marsh/b:c9cfca2b2713/ Exploring the SameSite cookie attribute for preventing CSRF 2024-08-29T19:07:10+00:00 https://simonwillison.net/2021/Aug/3/samesite/ earth2marshCSRF is an extremely common and nasty vulnerability—especially since it’s a hole by default: if you don’t know what CSRF is, you likely have it in your application. Traditionally the solution has been to use CSRF tokens—hidden form fields which “prove” that the user came from a form on your own site, and not a form hosted somewhere else. OWASP call this the Double Submit Cookie pattern. Web frameworks like Django implement CSRF protection for you. I built asgi-csrf to help add CSRF token protection to ASGI applications.]]> security webdev cookies csrf https://pinboard.in/ https://pinboard.in/u:earth2marsh/b:d1467da0f0f8/ Coding error in forgotten API blamed for massive data breach • The Register 2024-08-17T05:41:43+00:00 https://www.theregister.com/2024/06/21/optus_data_breach_faulty_api/ earth2marshThe data breach at Australian telco Optus, which saw over nine million customers' personal information exposed, has been blamed on a coding error that broke API access controls, and was left in place for years. A Wednesday court filing [PDF] includes an account of the incident penned by Australia's Communications and Media Authority (ACMA), which is using its regulatory powers to pursue Optus. The Authority alleges that Optus stored customer info and made it accessible to authenticated customers at www.optus.com.au and api.optus.com.au – described as the "Main" and "Target" domains. Retrieving that info required use of APIs that the filing describes as "Target APIs." The Target domain existed to segregate API traffic from static content at the Main domain, and had been internet-facing since 2017. The Target APIs were secured by "various access controls designed to prevent unauthorized access." But in 2018 a coding error broke one of those access controls, and meant it didn't work on either the Target or Main domain. Optus spotted that error … in 2021, when it fixed it – but only for the Main domain. The problem was not detected on the Target domain, and therefore wasn't fixed. The Target domain, however, remained online and internet-facing. The court filing suggests it "was not decommissioned despite a lack of any need for it." In September 2022, an attacker "was able to bypass access controls and send requests to the Target APIs." Doing so returned customer information for 9.5 million people – and sent Optus and its Singaporean owner, Singtel, into a world of pain.]]> apis security breaches examples https://pinboard.in/ https://pinboard.in/u:earth2marsh/b:6512f5b17c31/ Developer Ecosystems for Software Safety – Communications of the ACM 2024-06-21T01:10:21+00:00 https://cacm.acm.org/practice/developer-ecosystems-for-software-safety/ earth2marshthe rate at which common types of defects are introduced during design, development, and deployment is systemic—it arises from the design and structure of the developer ecosystem, which means the end-to-end collection of systems, tooling, and processes in which developers design, implement, and deploy software. This includes programming languages, software libraries, application frameworks, source repositories, build and deployment tooling, the production platform and its configuration surfaces, and so forth. In short, the safety and security posture of a software application or service is substantially an emergent property of the developer ecosystem that produced it.
Cloud platforms. When deployment environments are based on “bare-metal” servers and network devices, engineers are exposed to the full complexity and nonuniformity of their configuration surfaces. In contrast, cloud platforms provide a higher-level abstraction and a consistent vocabulary of configuration points, and they expose common functionality (such as databases) as managed services. This reduces cognitive load caused by differences between configuration surfaces of different types of network devices and the need to manage lower-level aspects of servers that host higher-level services such as databases.
]]> google quality security devex governance software development https://pinboard.in/ https://pinboard.in/u:earth2marsh/b:07d0b0ca62a6/ Zooko's triangle - Wikipedia 2024-06-16T21:06:11+00:00 https://en.m.wikipedia.org/wiki/Zooko%27s_triangle earth2marshZooko's triangle is a trilemma of three properties that some people consider desirable for names of participants in a network protocol:[1] Human-meaningful: Meaningful and memorable (low-entropy) names are provided to the users. Secure: The amount of damage a malicious entity can inflict on the system should be as low as possible. Decentralized: Names correctly resolve to their respective entities without the use of a central authority or service.]]> trilemmas network tradeoffs usability security decentralization https://pinboard.in/ https://pinboard.in/u:earth2marsh/b:0e3a900511ea/ Attack Techniques: Trojaned Clipboard – text/plain 2024-06-05T20:05:13+00:00 https://textslashplain.com/2024/06/04/attack-techniques-trojaned-clipboard/ earth2marshToday in “Attack techniques so stupid, they can’t possibly work” — the trojan clipboard technique. The attacking website convinces the victim user to copy something dangerous to their clipboard, and then paste it into a powerful and trusted context.]]> security attacks clipboard examples https://pinboard.in/ https://pinboard.in/u:earth2marsh/b:2a04b1602a36/ The State of API Security in 2024 | Resource Library 2024-03-28T17:54:44+00:00 https://www.imperva.com/resources/gated/reports/The-State-of-API-Security-in-2024-report.pdf earth2marshAPI calls make up a massive 71% of all web traffic Widespread API usage is expanding the attack surface for bad actors. These threats make it critical for organizations to understand the risks and complexities of APIs and the importance of API Security. The Imperva State of API Security Report examines the current API threat landscape and provides key security insights for 2024. Based on real-time attack data targeting APIs, the report provides actionable intelligence gathered by Imperva’s Threat Research Team. Also available here: https://www.imperva.com/resources/resource-library/reports/the-state-of-api-security-in-2024-report-ty?lang=EN&asset_id=6789&gated=1]]> apis security reports https://pinboard.in/ https://pinboard.in/u:earth2marsh/b:175b5b8ae6d0/ AI and Trust - Schneier on Security 2023-12-16T05:41:42+00:00 https://www.schneier.com/blog/archives/2023/12/ai-and-trust.html earth2marshIn this talk, I am going to make several arguments. One, that there are two different kinds of trust—interpersonal trust and social trust—and that we regularly confuse them. Two, that the confusion will increase with artificial intelligence. We will make a fundamental category error. We will think of AIs as friends when they’re really just services. Three, that the corporations controlling AI systems will take advantage of our confusion to take advantage of us. They will not be trustworthy. And four, that it is the role of government to create trust in society. And therefore, it is their role to create an environment for trustworthy AI. And that means regulation. Not regulating AI, but regulating the organizations that control and use AI.
More specifically, we tend to assume that something’s implementation is the same as its interface. That is, we assume that things are the same on the inside as they are on the surface.
]]> ai trust security ethics regulation https://pinboard.in/ https://pinboard.in/u:earth2marsh/b:144b4adb35a6/ How AWS uses automated reasoning to help you achieve security at scale | AWS Security Blog 2023-10-11T04:35:52+00:00 https://aws.amazon.com/blogs/security/protect-sensitive-data-in-the-cloud-with-automated-reasoning-zelkova/ earth2marshZelkova uses automated reasoning to analyze policies and the future consequences of policies. This includes AWS Identity and Access Management (IAM) policies, Amazon Simple Storage Service (S3) policies, and other resource policies. These policies dictate who can (or can’t) do what to which resources. Because Zelkova uses automated reasoning, you no longer need to think about what questions you need to ask about your policies. Using fancy math, as mentioned above, Zelkova will automatically derive the questions and answers you need to be asking about your policies, improving confidence in your security configuration(s).]]> aws policies reasoning security https://pinboard.in/ https://pinboard.in/u:earth2marsh/b:994840107c99/ SolarWinds: The Untold Story of the Boldest Supply-Chain Hack | WIRED 2023-05-02T18:35:39+00:00 https://www.wired.com/story/the-untold-story-of-solarwinds-the-boldest-supply-chain-hack-ever/ earth2marshtechnology hacking breaches security software supplychain https://pinboard.in/ https://pinboard.in/u:earth2marsh/b:c8549b756baa/ The SSO Wall of Shame | A list of vendors that treat single sign-on as a luxury feature, not a core security requirement. 2022-06-14T00:28:39+00:00 https://sso.tax/ earth2marsh authentication enterprise security sso features packaging pricing https://pinboard.in/ https://pinboard.in/u:earth2marsh/b:a4926164446c/ How to win at CORS - JakeArchibald.com 2022-05-31T06:11:29+00:00 https://jakearchibald.com/2021/cors/ earth2marsh CORS (Cross-Origin Resource Sharing) is hard. It's hard because it's part of how browsers fetch stuff, and that's a set of behaviours that started with the very first web browser over thirty years ago. Since then, it's been a constant source of development; adding features, improving defaults, and papering over past mistakes without breaking too much of the web. Anyway, I figured I'd write down pretty much everything I know about CORS ]]> browser cors security webdev javascript https://pinboard.in/ https://pinboard.in/u:earth2marsh/b:122572faa8ec/ Lupinia Studios - I'm a Scam Prevention Expert, and I Got Scammed 2022-04-04T18:00:05+00:00 http://www.lupinia.net/writing/tech/scammed.htm earth2marsh scams fraud security phishing finance banking https://pinboard.in/ https://pinboard.in/u:earth2marsh/b:4df8412a31c6/ API production readiness assurance 2022-03-23T17:40:00+00:00 https://up9.com/ earth2marsh apis analysis analytics security kubernetes https://pinboard.in/ https://pinboard.in/u:earth2marsh/b:360422a0e9d9/ Are All Your APIs Insecure? - by Bruno Pedro 2022-03-10T16:42:47+00:00 https://apichangelog.substack.com/p/bq-2022-03 earth2marsh apis security gateways https://pinboard.in/ https://pinboard.in/u:earth2marsh/b:09c3a805a3bc/ Configure Google Cloud Armor using OpenAPI | by Christoph Grotz | Google Cloud - Community | Jan, 2022 | Medium 2022-02-15T05:05:23+00:00 https://medium.com/google-cloud/configure-google-cloud-armor-using-openapi-64ba16ac040e earth2marsh google security OpenAPI tools apis https://pinboard.in/ https://pinboard.in/u:earth2marsh/b:4b7e5e21e0e0/ Taking charge of the API security lifecycle - Cyber Protection Magazine 2021-10-27T21:21:53+00:00 https://cyberprotection-magazine.com/taking-charge-of-the-api-security-lifecycle/ earth2marsh apis security challenges https://pinboard.in/ https://pinboard.in/u:earth2marsh/b:6ef3b2d5479e/ CSRF Token handling in SAP API Management | SAP Blogs 2021-09-30T05:28:30+00:00 https://blogs.sap.com/2021/09/18/csrf-token-handling-in-sap-api-management/ earth2marshcsrf apis policies security https://pinboard.in/ https://pinboard.in/u:earth2marsh/b:7a264d59c05e/ New password guidelines say everything we thought about passwords is wrong | VentureBeat 2021-05-28T15:07:39+00:00 https://venturebeat.com/2017/04/18/new-password-guidelines-say-everything-we-thought-about-passwords-is-wrong/?s=09 earth2marshsecurity practices bestpractices passwords rotation expiry complexity https://pinboard.in/u:earth2marsh/b:5492fc6e8a4e/ Stop Downloading Google Cloud Service Account Keys! | by Ryan Canty | Medium 2020-11-28T20:27:51+00:00 https://medium.com/@jryancanty/stop-downloading-google-cloud-service-account-keys-1811d44a97d9 earth2marsh google security apis tokens authorization secrets bestpractices https://pinboard.in/ https://pinboard.in/u:earth2marsh/b:bd41bac6c61e/ Authorization Request - OAuth 2.0 Simplified 2020-08-21T00:37:09+00:00 https://www.oauth.com/oauth2-servers/pkce/authorization-request/ earth2marsh security apis oauth pkce https://pinboard.in/ https://pinboard.in/u:earth2marsh/b:a8bee1ad2812/ Why OAuth API Keys and Secrets Aren't Safe in Mobile Apps | Okta Developer 2020-08-21T00:36:02+00:00 https://developer.okta.com/blog/2019/01/22/oauth-api-keys-arent-safe-in-mobile-apps earth2marsh mobile secrets security apis oauth https://pinboard.in/ https://pinboard.in/u:earth2marsh/b:37edd9b8ffb3/ Access Control for GraphQL, Part 1 2020-04-09T16:18:07+00:00 https://www.pingidentity.com/en/company/blog/posts/2020/graphql-access-control-part-1.html earth2marsh apis graphql security https://pinboard.in/ https://pinboard.in/u:earth2marsh/b:7ac703823516/ JavaScript Libraries Are Almost Never Updated Once Installed 2020-03-11T01:31:57+00:00 https://blog.cloudflare.com/javascript-libraries-are-almost-never-updated/ earth2marsh javascript security cloudflare updates development https://pinboard.in/ https://pinboard.in/u:earth2marsh/b:943dfe2028cb/ Changes to access token and secret management - Announcements - Twitter Developers 2020-01-24T17:47:51+00:00 https://twittercommunity.com/t/changes-to-access-token-and-secret-management/130851 earth2marsh twitter apis secrets keys change security communication example reference https://pinboard.in/ https://pinboard.in/u:earth2marsh/b:6bc7fe50309b/ Why We Don’t See Many Public GraphQL APIs - Marc-André Giroux - Medium 2019-10-22T00:10:10+00:00 https://medium.com/@__xuorig__/why-we-dont-see-many-public-graphql-apis-ad972bcb201e earth2marsh asc2019 graphql security https://pinboard.in/ https://pinboard.in/u:earth2marsh/b:e89cf484380c/ Getting started with security keys — PaulStamatiou.com 2019-10-22T00:03:04+00:00 https://paulstamatiou.com/getting-started-with-security-keys/ earth2marsh 2fa bestpractices howto security keys https://pinboard.in/ https://pinboard.in/u:earth2marsh/b:93329ee707fa/ Same-Site Cookies By Default | text/plain 2019-10-02T00:07:19+00:00 https://textslashplain.com/2019/09/30/same-site-cookies-by-default/ earth2marsh cookies security web privacy https://pinboard.in/ https://pinboard.in/u:earth2marsh/b:750afba08e8f/ Ben Franklin's Famous 'Liberty, Safety' Quote Lost Its Context In 21st Century : NPR 2019-06-11T16:42:28+00:00 https://www.npr.org/2015/03/02/390245038/ben-franklins-famous-liberty-safety-quote-lost-its-context-in-21st-century earth2marsh quotes context history liberty security ben_franklin taxation https://pinboard.in/ https://pinboard.in/u:earth2marsh/b:36e1f956e401/ Trusted Types help prevent Cross-Site Scripting  |  Web  |  Google Developers 2019-03-05T17:26:46+00:00 https://developers.google.com/web/updates/2019/02/trusted-types earth2marsh browser security javascript xss apis google https://pinboard.in/ https://pinboard.in/u:earth2marsh/b:110ae9c4707c/ Can you ever (safely) include credentials in a URL? – Intelligent Security 2019-03-05T17:13:15+00:00 https://neilmadden.blog/2019/01/16/can-you-ever-safely-include-credentials-in-a-url/ earth2marsh security apis resources urls deprecation patterns https://pinboard.in/ https://pinboard.in/u:earth2marsh/b:5e99f0a51fe0/ OAuth: When Things Go Wrong - Speaker Deck 2019-03-01T18:59:00+00:00 https://speakerdeck.com/aaronpk/oauth-when-things-go-wrong earth2marsh oauth security presentation okta apis https://pinboard.in/ https://pinboard.in/u:earth2marsh/b:da3b384db0b8/ When To Use Which (OAuth2) Grants and (OIDC) Flows – Robert Broeckelmann – Medium 2019-02-19T18:29:47+00:00 https://medium.com/@robert.broeckelmann/when-to-use-which-oauth2-grants-and-oidc-flows-ec6a5c00d864 earth2marsh authentication authorization oauth security oidc saml2 saml https://pinboard.in/ https://pinboard.in/u:earth2marsh/b:7b4965db792d/ API Security news, community, tools, standards, newsletter 2019-02-12T17:24:21+00:00 https://apisecurity.io/ earth2marsh security apis openapi https://pinboard.in/ https://pinboard.in/u:earth2marsh/b:aea1e8311581/ Security Checklist 2019-02-02T15:57:46+00:00 https://securitycheckli.st/ earth2marsh checklist internet security privacy https://pinboard.in/ https://pinboard.in/u:earth2marsh/b:26083d2131f4/ Nobody Cares About OAuth or OpenID Connect | Okta Developer 2019-01-26T18:20:09+00:00 https://developer.okta.com/blog/2019/01/23/nobody-cares-about-oauth-or-openid-connect earth2marsh authentication oauth openid security okta https://pinboard.in/ https://pinboard.in/u:earth2marsh/b:8ecfa4c5b33e/ An Insider’s Take on API Strategy | Okta 2019-01-14T21:52:10+00:00 https://www.okta.com/blog/2019/01/an-insiders-take-on-api-strategy/ earth2marsh survey apis security okta https://pinboard.in/ https://pinboard.in/u:earth2marsh/b:52073f650313/ javascript - Why does Google prepend while(1); to their JSON responses? - Stack Overflow 2018-11-13T23:32:59+00:00 https://stackoverflow.com/questions/2669690/why-does-google-prepend-while1-to-their-json-responses earth2marsh javascript json security apis https://pinboard.in/ https://pinboard.in/u:earth2marsh/b:4f9329ab8eba/ Why Facebook's api starts with a for loop - DEV Community 👩‍💻👨‍💻 2018-11-13T23:32:14+00:00 https://dev.to/antogarand/why-facebooks-api-starts-with-a-for-loop-1eob earth2marsh json javascript security webdev vulnerability apis facebook https://pinboard.in/ https://pinboard.in/u:earth2marsh/b:4d4a6cdcde2e/ Troy Hunt: Here's Why Your Static Website Needs HTTPS 2018-08-14T16:21:01+00:00 https://www.troyhunt.com/heres-why-your-static-website-needs-https/ earth2marsh security https spoofing static sites https://pinboard.in/u:earth2marsh/b:1a3423c4a057/ Troy Hunt: Pwned Passwords in Practice: Real World Examples of Blocking the Worst Passwords 2018-05-31T15:26:27+00:00 https://www.troyhunt.com/pwned-passwords-in-practice-real-world-examples-of-blocking-the-worst-passwords/ earth2marsh passwords security caching apis https://pinboard.in/ https://pinboard.in/u:earth2marsh/b:2d53b4e152cd/ Security and the API Journey | Okta 2018-05-29T19:50:39+00:00 https://www.okta.com/security-blog/2018/05/security-and-the-api-journey/ earth2marsh apis design security https://pinboard.in/ https://pinboard.in/u:earth2marsh/b:1312787f0a5a/ Everything Is Broken – The Message – Medium 2018-05-09T20:32:26+00:00 https://medium.com/message/everything-is-broken-81e5f33a24e1 earth2marsh internet privacy security software https://pinboard.in/ https://pinboard.in/u:earth2marsh/b:ddfea8896626/ High-Grade API Security For Banks | Nordic APIs | 2018-02-27T17:25:33+00:00 https://nordicapis.com/high-grade-api-security-for-banks/ earth2marsh banks oauth security financial apis design https://pinboard.in/ https://pinboard.in/u:earth2marsh/b:5e29b42a006d/ pinterest/snappass: It's like SnapChat... for passwords. 2018-01-17T18:27:22+00:00 https://github.com/pinterest/snappass earth2marshpasswords opensource security https://pinboard.in/ https://pinboard.in/u:earth2marsh/b:3fcf5f7af5f7/ Get your bookmarks, passwords & more on all your devices - Computer - Google Chrome Help 2017-12-19T06:31:12+00:00 https://support.google.com/chrome/answer/165139#passphrase earth2marsh security google chrome android passwords passphrase https://pinboard.in/ https://pinboard.in/u:earth2marsh/b:ef10178c5ab9/ Redefining perimeter network security: The future is a hybrid | CSO Online 2017-12-04T18:26:42+00:00 https://www.csoonline.com/article/3239303/access-control/redefining-perimeter-network-security-the-future-is-a-hybrid.html earth2marsh apis security enterprise trends https://pinboard.in/ https://pinboard.in/u:earth2marsh/b:24dd0a3557a9/ How I hacked hundreds of companies through their helpdesk 2017-10-30T21:40:54+00:00 https://medium.freecodecamp.org/how-i-hacked-hundreds-of-companies-through-their-helpdesk-b7680ddc2d4c earth2marsh email hacking security noreply antipatterns https://pinboard.in/ https://pinboard.in/u:earth2marsh/b:f25464df2b31/ Linksys Official Support - Linksys Security Advisories | Linksys Site USA 2017-10-23T21:44:59+00:00 https://www.linksys.com/us/support-article?articleNum=246427#Krack earth2marsh security belkin wemo wifi https://pinboard.in/ https://pinboard.in/u:earth2marsh/b:b7fd3590006c/ Static WebPage - ASUS Product Security Advisory 2017-10-23T21:42:33+00:00 https://www.asus.com/Static_WebPage/ASUS-Product-Security-Advisory/ earth2marsh asus security wifi https://pinboard.in/ https://pinboard.in/u:earth2marsh/b:7af77fd00c43/ Morfina - Keep your APIs safe 2017-10-03T16:46:26+00:00 http://morfina.io/ earth2marsh apis encryption security startup gateway https://pinboard.in/ https://pinboard.in/u:earth2marsh/b:cd648fa60153/