@albinowax@LiveOverflow@albinowax I tend to agree with that differences are subtle, but will still argue that modern browser security features make meaningful CSRF harder to pull off than XSS, but that's certainly more of an interesting discussion over a few beers than an absolute truth
@LiveOverflow As mentioned in my original post, the idea is somewhat contained in certain CSRF Token concepts. You can even do a js-accessible-cookie-to-non-cookie-header move and keep both in cookie storage, as the required intermittent js requires some "local" action
https://t.co/PCEzsk8mR5
@LiveOverflow Ultimatley, you have to choose the lesser of two evils 🤷♂️
For strong protection: 🍪+💾
Using secure cookies in combination with locally stored tokens, the former protects against XSS exfiltration of tokens while the latter protects against CSRF. Sort of the CSRF token pattern.
Searching for a hardware/IoT product to perform security assessment ⌚️🛰🎮🎰🦼🛵⛽️🛸
You will get a free security assessment in return 🆓️
For more details: https://t.co/TQynCGkrO8
@WebSecAcademy you have a vulnerability in your labs 😜
But for real, there is an XSS in many of the labs at `GET /post/comment/confirmation?postId=">😈`. Don't consider it an issue for purposely vulnerable labs (hence the irresponsible disclosure), but it allows for cheating 🤷♂️
@WebSecAcademy Awesome writeup 🚀 in fact just the moment when we were thinking about SSO potentially requiring SameSite lax and the implications of that for the security of the product. Perfect timing 😁
Hello tech twitter 👋 here's a reminder to please be kind to folks when communicating, especially in open source projects. You never know what a person in the opposite end of the world is going through and being kind doesn't hurt regardless :)
Super excited to be on TGIK by @VMwareTanzu and see @PuDiJoglekar play around with Connaisseur 👨💻
Hope many of you join and share their thoughts and ideas on Connaisseur and container signing in general!
#Solarenergie ist inzwischen sehr günstig. Was es jetzt braucht, um beim Solarausbau in Deutschland durchzustarten, weiß Handwerksmeister Stefan Kutscher.
👇👇👇
#fuerunsalle
Connaisseur v2.2 is out 🚀
It contains improvements to usability and compatibility. For more details checkout the article 👇 (demo and gif included 😜)
https://t.co/4pHPUrJ9R5
🐳 Verify Container Signatures in #Kubernetes using Notary or Cosign
Connaisseur: an admission controller to integrate container image signature verification and trust pinning into a k8s cluster
v2 adds support for multiple keys and signature solutions
https://t.co/yhCrDSrZgJ