51–60 of 170 posts
Earlier quoted context omitted.
Some attacks exploit vulnerabilities in dev infrastructure. Exposed dev JWT token may enable such an attack.
This is precisely why my comment makes it clear that dev shouldn't be available to the outside world.
Earlier quoted context omitted.
i hate how when I'm copying + pasting a url to a test or internal environment, to the browser address bar - I may have a typo in there, or an extra space. Bam! The URL just became a google search
Doesn’t browser hit suggestions API on every type stroke anyway?
Earlier quoted context omitted.
Type myintranetsite/ instead, this is faster than http:// in front.
As you type, the name is still being sent to Google for search suggestions with every keystroke until the final "/". If you prefix with " http://" , no requests are made to Google (except "h", "ht", "htt", "http", and "http:")
This seems surprising to me. Can you back up this claim?
Earlier quoted context omitted.
No, you'd just have to validate it when you're inputting something particularly sensitive (and I really do usually look in the network console when I'm doing something like that)
Presumably you enter dummy data to validate first. What if it doesn’t send that, but does send the real data?
But using google, slack, skype, gitlab, bitbucket... is fine to send sensitive data?
i hate how when I'm copying + pasting a url to a test or internal environment, to the browser address bar - I may have a typo in there, or an extra space. Bam! The URL just became a google search
If you never use production data for anything other than production this stops being a problem. You can put all the dev and staging JWTs you want in to jwt.io at no risk if those things aren't available to the outside world.
Agreed. This pretty much applies with any data & tool. If the data is extra sensitive, make extra sure the tool you are using is secure. If your data is for dev purposes only, the tool doesn't have to be validated as thoroughly.
For those criticizing the author for 'fantasy' security problems, it seems relevant to emphasize that they work at a bank---their threat model is probably rather more vigorous than most.
Earlier quoted context omitted.
This is precisely why my comment makes it clear that dev shouldn't be available to the outside world.
Security in layers. You should keep your dev environment private but also not paste credentials into a networked textbox.
Webapps like jwt.io run locally in your browser and you can monitor traffic, prevent further requests or even run them yourself to make sure of this. This post is misinformed at best.
did you validate that those sites do not batch data input over time and send them out, much later than your direct user input interactions?
It sounded like the OP had some solid proof but eventually it boils down to "I'm suspicious". It's a valid opinion just not an objective one