xoph

[xoph @xophham]

@Francis_Mull_ @PrangerInfo https://t.co/Cx257jvlx1 😉

[xoph @xophham]

@PrangerInfo Ohne weitere Tools: https://t.co/Cx257juNHt

[xoph @xophham]

@albinowax @LiveOverflow @albinowax I tend to agree with that differences are subtle, but will still argue that modern browser security features make meaningful CSRF harder to pull off than XSS, but that's certainly more of an interesting discussion over a few beers than an absolute truth

[xoph @xophham]

@LiveOverflow Besides its elegancy, using "double submit" you can even make that idea stateless (server side)

https://t.co/BRHTGN7wcN

[xoph @xophham]

@LiveOverflow As mentioned in my original post, the idea is somewhat contained in certain CSRF Token concepts. You can even do a js-accessible-cookie-to-non-cookie-header move and keep both in cookie storage, as the required intermittent js requires some "local" action

https://t.co/PCEzsk8mR5

[xoph @xophham]

@LiveOverflow Note: choose between session or local storage wisely 🧙‍♂️

[xoph @xophham]

@LiveOverflow Ultimatley, you have to choose the lesser of two evils 🤷‍♂️

For strong protection: 🍪+💾
Using secure cookies in combination with locally stored tokens, the former protects against XSS exfiltration of tokens while the latter protects against CSRF. Sort of the CSRF token pattern.

[xoph @xophham]

@roter_pander 👋

[xoph @xophham]

Searching for a hardware/IoT product to perform security assessment ⌚️🛰🎮🎰🦼🛵⛽️🛸
You will get a free security assessment in return 🆓️

For more details: https://t.co/TQynCGkrO8

[xoph @xophham]

@LilithWittmann Cool, irresponsible disclosure is the new gold standard in IT security

[xoph @xophham]

@WebSecAcademy Let me know if I can help with more details and where to share

[xoph @xophham]

@WebSecAcademy you have a vulnerability in your labs 😜

But for real, there is an XSS in many of the labs at `GET /post/comment/confirmation?postId=">😈`. Don't consider it an issue for purposely vulnerable labs (hence the irresponsible disclosure), but it allows for cheating 🤷‍♂️

[xoph @xophham]

Examples for accidentally vulnerable labs are:
https://t.co/SEqVjBWDeI
https://t.co/es1rFcAvnP

[xoph @xophham]

@WebSecAcademy Awesome writeup 🚀 in fact just the moment when we were thinking about SSO potentially requiring SameSite lax and the implications of that for the security of the product. Perfect timing 😁

[xoph @xophham]

@PuDiJoglekar @developerguyba @rpkatz @PuDiJoglekar thanks for the great event! Was a lot of fun to explore Connaisseur together 😊

[xoph @xophham]

Great spirit for life in general

[Arsh Sharma @RinkiyaKeDad]

Hello tech twitter 👋 here's a reminder to please be kind to folks when communicating, especially in open source projects. You never know what a person in the opposite end of the world is going through and being kind doesn't hurt regardless :)

[xoph @xophham]

Super excited to be on TGIK by @VMwareTanzu and see @PuDiJoglekar play around with Connaisseur 👨‍💻
Hope many of you join and share their thoughts and ideas on Connaisseur and container signing in general!

[Klima-Allianz Deutschland @klima_allianz]

#Solarenergie ist inzwischen sehr günstig. Was es jetzt braucht, um beim Solarausbau in Deutschland durchzustarten, weiß Handwerksmeister Stefan Kutscher.
👇👇👇
#fuerunsalle

[xoph @xophham]

Connaisseur v2.2 is out 🚀

It contains improvements to usability and compatibility. For more details checkout the article 👇 (demo and gif included 😜)

https://t.co/4pHPUrJ9R5

[Clint Gibler @clintgibler]

🐳 Verify Container Signatures in #Kubernetes using Notary or Cosign

Connaisseur: an admission controller to integrate container image signature verification and trust pinning into a k8s cluster

v2 adds support for multiple keys and signature solutions

https://t.co/yhCrDSrZgJ