Nit picking: I know the copy isn't written for security geeks, but boasting of "MIT engineers" (mechanical engineers?) and "heavy security experience" doesn't ring of a strong correlation to me. Could you expand on the bios in your "About Tinfoil" page? I don't know if an executive looking at that page would be convinced you're all security experts (and I know this isn't "cool" but slightly more professional profile…
It actually reads worse for security geeks, but optimizing your copy for security geeks is usually a very bad plan.
Nit picking: I know the copy isn't written for security geeks, but boasting of "MIT engineers" (mechanical engineers?) and "heavy security experience" doesn't ring of a strong correlation to me. Could you expand on the bios in your "About Tinfoil" page? I don't know if an executive looking at that page would be convinced you're all security experts (and I know this isn't "cool" but slightly more professional profile…
Great points. We'll definitely put up new photos and bios soon. Thanks for the feedback!
Nit picking: I know the copy isn't written for security geeks, but boasting of "MIT engineers" (mechanical engineers?) and "heavy security experience" doesn't ring of a strong correlation to me. Could you expand on the bios in your "About Tinfoil" page? I don't know if an executive looking at that page would be convinced you're all security experts (and I know this isn't "cool" but slightly more professional profile…
It actually reads worse for security geeks, but optimizing your copy for security geeks is usually a very bad plan.
I think having the home page marketed towards is a good plan because most small to medium businesses probably don't have security experts. In addition, having a not to hidden "Nitty Gritty Details" page for the security experts would be a great compromise.
- Private IP address disclosure (1) - Allowed HTTP methods (1) - Non HTTP-Only Cookies (2) - Insecure Cookies (4) Note: This is a 2-page website. Looks like the cookie problems are a result of the default Heroku 404 page.
It's good to have a fast check for these things, but you realize how simple that stuff is to spot, right? Insecure cookies and HTTPOnly (which: HTTPOnly is a bit of a band-aid; it's not a vulnerability not to have it) are trivial regexes on set-cookie headers; methods is something you can do with curl and a shell script. If you're spotting these kinds of things only after using a 3rd-party tool, consider whether this…
In that vein, we search for a lot more than just these.
We're actually working on some tools to help integrate Tinfoil into your integrating testing scheme - more to come on that in the future. :)
It's good to have a fast check for these things, but you realize how simple that stuff is to spot, right? Insecure cookies and HTTPOnly (which: HTTPOnly is a bit of a band-aid; it's not a vulnerability not to have it) are trivial regexes on set-cookie headers; methods is something you can do with curl and a shell script. If you're spotting these kinds of things only after using a 3rd-party tool, consider whether this…
In that vein, we search for a lot more than just these. We're actually working on some tools to help integrate Tinfoil into your integrating testing scheme - more to come on that in the future. :)
Sorry! I know you do (for the benefit of the thread: I've been talking to 'borski for awhile about Tinfoil). I'm not commenting about Tinfoil so much as developers who are surprised to not be using secure cookies. :)
Nit picking: I know the copy isn't written for security geeks, but boasting of "MIT engineers" (mechanical engineers?) and "heavy security experience" doesn't ring of a strong correlation to me. Could you expand on the bios in your "About Tinfoil" page? I don't know if an executive looking at that page would be convinced you're all security experts (and I know this isn't "cool" but slightly more professional profile…
(more notes... i signed up for the free account, added my website, it brought me to a page that did nothing. i tried to sign in and it said i needed to confirm my account. okay, a notice would have been nice... i confirm the account and log in, and my website i added initially is not there? ok, i add it... now it's asking for my software stack? that seems slightly unnecessary, but okay, i try to remember what i'm using. now i'm done setting up and verifying and finally scanning.... the picture slideshow is cute, but unnecessary. the manual scan i started is still sitting there... not sure what's going on but it doesn't look like it's doing anything... my e-mail now says a report is ready, though the page never changed. i go check it out. looks nice, fairly easy to browse around. i click on 'All Stats' and a column in the lower middle of the page has vertical text. i don't know about you, but my head doesn't like to tilt 90 degrees to read text... i look at the 'Modules Run' section and i don't see SSL modules, though i added an https:// url. considering the recently popularized SSL exploits i would probably add a module for this. for security geeks like me, having a Knowledge Base of documentation of what your scans look for would be nice for reference)
Nit picking: I know the copy isn't written for security geeks, but boasting of "MIT engineers" (mechanical engineers?) and "heavy security experience" doesn't ring of a strong correlation to me. Could you expand on the bios in your "About Tinfoil" page? I don't know if an executive looking at that page would be convinced you're all security experts (and I know this isn't "cool" but slightly more professional profile…
(more notes... i signed up for the free account, added my website, it brought me to a page that did nothing. i tried to sign in and it said i needed to confirm my account. okay, a notice would have been nice... i confirm the account and log in, and my website i added initially is not there? ok, i add it... now it's asking for my software stack? that seems slightly unnecessary, but okay, i try to remember what i'm usi…
Hey Peter - please feel free to email support@tinfoilsecurity.com or join us in our support chat at http://tinfoilsecurity.com/chat
We'd definitely like to take a look into your issues and see what went wrong.
Nit picking: I know the copy isn't written for security geeks, but boasting of "MIT engineers" (mechanical engineers?) and "heavy security experience" doesn't ring of a strong correlation to me. Could you expand on the bios in your "About Tinfoil" page? I don't know if an executive looking at that page would be convinced you're all security experts (and I know this isn't "cool" but slightly more professional profile…
(more notes... i signed up for the free account, added my website, it brought me to a page that did nothing. i tried to sign in and it said i needed to confirm my account. okay, a notice would have been nice... i confirm the account and log in, and my website i added initially is not there? ok, i add it... now it's asking for my software stack? that seems slightly unnecessary, but okay, i try to remember what i'm usi…
Thanks for reporting the issues. We're pushing out fixes now. :)
(more notes... i signed up for the free account, added my website, it brought me to a page that did nothing. i tried to sign in and it said i needed to confirm my account. okay, a notice would have been nice... i confirm the account and log in, and my website i added initially is not there? ok, i add it... now it's asking for my software stack? that seems slightly unnecessary, but okay, i try to remember what i'm usi…
Hey Peter - please feel free to email support@tinfoilsecurity.com or join us in our support chat at http://tinfoilsecurity.com/chat We'd definitely like to take a look into your issues and see what went wrong.
I chatted with the Tinfoil team and they located the issue and pushed a fix. Nice hustle ya'll!