Links tagged “security”

github.com

A catalogue of technical and non-technical measures that make automated scraping harder — rate limiting, honeypots, shifting markup, JavaScript-loaded content — and what each costs real users.

python-oauth2.readthedocs.io

Documentation for python-oauth2, a framework for providing OAuth 2.0 authentication in Python applications.

developers.google.com

Google's reference on using OAuth 2.0 to authorise access to its APIs, with the flows for web, installed, server-side and limited-input applications.

jwt.io

Debugger and reference site for JSON Web Tokens: decode, verify and generate tokens in the browser, with a directory of JWT libraries per language.

pyjwt.readthedocs.org

Documentation for PyJWT, the Python library that encodes and decodes JSON Web Tokens, covering signing algorithms, claim validation and JWKS endpoints.

python-jose.readthedocs.org

Documentation for python-jose, a Python implementation of the JOSE suite: JSON Web Signature, Encryption, Key and Algorithms.

tools.ietf.org

IETF standard defining JSON Web Token, a compact URL-safe format for representing signed or encrypted claims exchanged between two parties.

letsencrypt.org

Let's Encrypt, a nonprofit certificate authority issuing free, automated TLS certificates for HTTPS.

mitmproxy.org

Home page of mitmproxy, a free interactive HTTPS proxy for intercepting, inspecting, modifying and replaying web traffic.

blog.codinghorror.com

A rundown of what an ideal login dialog does — email-based login, clear feedback, password-manager support, caps-lock detection and rate limiting.

seclists.org

Tavis Ormandy's Full Disclosure post on CVE-2010-3847: glibc's dynamic linker expands $ORIGIN in LD_AUDIT for setuid binaries, which a hardlink trick turns into local root.

code.google.com

Reference documenting several hundred security-relevant behaviours of Internet Explorer, Firefox, Safari, Opera, Chrome and the Android browser, with open test cases.

googleonlinesecurity.blogspot.com

2007 study of roughly 70,000 domains correlating web server software with malware hosting, finding IIS over-represented relative to its share against Apache.