11–20 of 58 posts
Broken without JavaScript.
EDIT: seems like the form submission is doing a POST to https://inspect.new, which returns a 500 error.
google.com scores 50/100. This is one of those scanners crappy pentesters use for multi page reports of false positives?
Last week we got a pentest done on our apps. This week we got some high-prio tickets on our board because they found major security violations!!! Our app, which uses an API, used a dangerous permission! "android.permission.INTERNET"
How they can report this with a straight face, I don't know. Makes me want to go in the security business though, if that is the level of competence I'm absolutely positive that I could do that job and earn a lot more than a generic app developer.
https://developer.mozilla.org/en-US/observatory (formerly https://observatory.mozilla.org/)
Or Security Headers?
Or VENOM?
https://github.com/oshp/oshp-validator
Applaud the effort, these are things that more devs should be aware of when building websites...
Hey some specific feedback on this tool... On mobile, it has a lot of "view port wobble" and the input fields aren't keyed right, it's just using a straight text input field so you don't get any ".com" buttons as you type.
The forms use light gray text on a dark gray background -- that isn't at all aligned with WCAG standards. https://i.imgur.com/BNCC5Dx.png
And it really needs to work on what it thinks is a valid URL. https://i.imgur.com/N1ctafd.png
Small UX stuff like that annoy me more than if a page has a privacy policy setup correctly. (=
Lastly, Permissions Policy... good concept, but still in "DRAFT" so not quite something you can ding users for not adopting just yet.
https://www.w3.org/TR/permissions-policy/
https://caniuse.com/permissions-policy
If you want to play around with it, here's a good tool to generate examples. https://www.permissionspolicy.com/
Oh lastly lastly, there are some really easy tools out there for helping to create a Content Security Policy, these really speed up the process. (Just make sure you disable your ad-blockers before running.)
google.com scores 50/100. This is one of those scanners crappy pentesters use for multi page reports of false positives?
Hah this triggers me. Last week we got a pentest done on our apps. This week we got some high-prio tickets on our board because they found major security violations!!! Our app, which uses an API, used a dangerous permission! "android.permission.INTERNET" How they can report this with a straight face, I don't know. Makes me want to go in the security business though, if that is the level of competence I'm absolutely p…
The app in question: a wrapper of a PWA ticket purchase webapp which saves no payment info.
Being able to run on rooted device was determined as severe category.
Earlier quoted context omitted.
Hah this triggers me. Last week we got a pentest done on our apps. This week we got some high-prio tickets on our board because they found major security violations!!! Our app, which uses an API, used a dangerous permission! "android.permission.INTERNET" How they can report this with a straight face, I don't know. Makes me want to go in the security business though, if that is the level of competence I'm absolutely p…
> Why isn't the app obfuscated, why can it be run on rooted device and why doesn't the app use https with pinning? The app in question: a wrapper of a PWA ticket purchase webapp which saves no payment info. Being able to run on rooted device was determined as severe category.
Additionally it seems to have issues with random sites given as parameter, only working with the displayed examples.
Quite lousy experience on the input field, keeps complaining to enter a valid url. Additionally it seems to have issues with random sites given as parameter, only working with the displayed examples.
Additionally, I get "Connection error, please refresh the page." for a website that clearly is accessible.
