But using google, slack, skype, gitlab, bitbucket... is fine to send sensitive data?
It is not.
In a project I'm working on we encrypt our secrets with git secret before sending them to GitHub.
When we want to quickly share unencrypted secrets between us we drop them as files into a server we access over ssh. That should be OK.
The gist of it is that if a secret is in clear on a server outside our organization it's not secret anymore. And yet my customer trust their cloud provider (Google) with their data.
Webapps like jwt.io run locally in your browser and you can monitor traffic, prevent further requests or even run them yourself to make sure of this. This post is misinformed at best.
I don't agree. I think online tools are great for quick-and-easy testing, and doesn't require any privacy issues. Mostly the benefit is ergonomics: I don't need to set up a bunch of stuff to do the thing I want, someone has done it because they had the exact same need. The kind of thing I typically do with them: - Diff two files - Check brackets. JSON, jwt, that kind of thing - Run code snippets in a fiddle site - Re…
I was boggling at how this could be tolerably efficient for someone, but I think I see it. My development workflow is terminal-centric, so copying out of the terminal to paste into a browser is extremely painful, whereas running 'diff', 'json_verify', etc. on local files or typing snippets into python/node/etc. from the shell is almost free. I suppose though if I were spending my day in VS Code or any kind of GUI IDE or similar, and if my workflow isn't optimized to pop open a unix shell with a keystroke for quick throwaway commands, it would be a lot easier just to C-a C-c alt-tab C-v from my GUI editor into a browser.
But using google, slack, skype, gitlab, bitbucket... is fine to send sensitive data?
i hate how when I'm copying + pasting a url to a test or internal environment, to the browser address bar - I may have a typo in there, or an extra space. Bam! The URL just became a google search
On Firefox you can disable this via an about:config setting (set keyword.enabled to false).
Funny, I was just thinking about this the other day when I wanted to convert a bunch of JSON into YAML.
There were a number of online tools that did the conversion. The first thing I did was test them with dummy data to make sure it was fully client side and worked offline.
Can't be too safe if you're planning to run these tools on data that is protected by contract or NDA. Even if it's not, I still wouldn't want a third party site saving and potentially doing something with the data.
For those criticizing the author for 'fantasy' security problems, it seems relevant to emphasize that they work at a bank---their threat model is probably rather more vigorous than most.
worked at a courtroom, most pastebin clones were banned
But using google, slack, skype, gitlab, bitbucket... is fine to send sensitive data?
But atleast you have an SLA with most of these services if you are using them on an enterprise level. You don't have any such SLA with Auth0 when using jwt.io.
i hate how when I'm copying + pasting a url to a test or internal environment, to the browser address bar - I may have a typo in there, or an extra space. Bam! The URL just became a google search
On Firefox you can disable this via an about:config setting (set keyword.enabled to false).
ahh cool.. but a binary toggle is a bit to coarse.
it would be nice if the input string contains a whitespace, it will perform the search engine query for you automatically, or allow some custom regex expression to determine whether to query search engine.
Witnessing developers copy-paste code from their editor into textareas on webpages to do formatting/linting/etc induces the same kind of internal cringe-factor as when witnessing general computer users use the mouse for absolutely everything and knowing zero keyboard shortcuts.