11–20 of 37 posts
Wow did I miss arguably the most important box to check, KISS? Seriously, keep it EFFING SIMPLE. The more complex and involved it is the more things can and will break. Does no one follow that anymore?
Sorry to burst that bubble, but KISS doesn't produce neither secure nor reliable software. Security and reliability is something you have to design for.
I have seen plenty of web apps that fell short on this...
Whenever I'm on a web app that has a button shown but disabled, you can be pretty sure that I will enable that button and click it...
If the client is limiting the maximum length of the contents of a textbox, I'm probably going to change that and see if the server is performing the same validation...
My favorite so far, though, was client-side calculation and validation of order amounts for some products. Intercepting the JavaScript file and tweaking it before the browser started using it allowed me to place an older for a bunch of products for only $0.01 (going negative was also attempted, too, but this particular system did a pre-approval with a payment gateway and it didn't like that... so I settled on a penny).
These were all things I've done with permission, of course... but it's amazing what you can do when people assume the browser will always follow the rules...
Wow did I miss arguably the most important box to check, KISS? Seriously, keep it EFFING SIMPLE. The more complex and involved it is the more things can and will break. Does no one follow that anymore?
Easier said than done in the real world.
>Ensure use of Anti-CSRF tokens, CORS, and crossdomain.xml policies to prevent an attacker from forcing a user to submit authenticated requests. isn't crossdomain.xml an adobe flash thing?
Just for curiosity, you can check twitter's [2]
[1]: http://www.adobe.com/devnet/adobe-media-server/articles/cros... [2]: https://twitter.com/crossdomain.xml
These types of guides always overlook the most important principle of software security: Always avoid reading, storing, or interacting with secure, personal, or otherwise "interesting" data. As much as possible, strip this information from your application, so that when it gets pwned the blast radius is absolutely miniscule. Create software not liabilities.
i know you just stored all of that somewhere, CVV included.
Just don't assume, please. Golden rule.
Not trusting user input is a good start, but the client shouldn't be trusted, either. I have seen plenty of web apps that fell short on this... Whenever I'm on a web app that has a button shown but disabled, you can be pretty sure that I will enable that button and click it... If the client is limiting the maximum length of the contents of a textbox, I'm probably going to change that and see if the server is performi…
Turned out the backend happily took that value and it skewed our average a lot and the next week I was laughing my ass off while HR was trying to figure out why everyone was suddenly so unhappy.
These types of guides always overlook the most important principle of software security: Always avoid reading, storing, or interacting with secure, personal, or otherwise "interesting" data. As much as possible, strip this information from your application, so that when it gets pwned the blast radius is absolutely miniscule. Create software not liabilities.
While this is great advice in principle, in practice it substantially complicates development. We need far better and more accessible end-to-end encryption tools if we want developers to start doing this by default in non-security critical use cases.
Having a database is a code smell.
If you absolutely have to have a database, then having a `users` table (or equivalent) is a code smell.
If you absolutely have to have a `users` table, having any columns in it other than `id`, `username`, and `password_hash` is a code smell.
...and so on.
Admittedly this isn't necessarily easy in a company setting. It's in direct conflict with what the sales & marketing people want, and unfortunately that means your job is sometimes to fight with the sales & marketing team. But it's not complicated.