Tux Machines

Security Leftovers

Posted by Roy Schestowitz on Sep 24, 2022

Passkeys

> This is an opinionated, “quick-start” guide to using passkeys as a web developer. It’s hopefully broadly applicable, but one size will never fit all authentication needs and this guide ignores everything that’s optional. So take it as a worked example, but not as gospel.

> It doesn't use any WebAuthn libraries, it just assumes that you have access to functions for verifying signatures. That mightn't be optimal—maybe finding a good library is better idea—but passkeys aren't so complex that it's unreasonable for people to know what's going on.

Jit and ZAP: Improving programming security | ZDNET [Ed: SJVN now does promotional puff pieces for proprietary software that might be of no practical use]

↺ Jit and ZAP: Improving programming security | ZDNET

> Jit, a startup programming security company, dreams of being a top security power. To help make those dreams a reality, Jit recently hired Simon Bennetts, the founder of the world's most popular web app security scanner, Open Web Application Security Project (OWASP) Zed Attack Proxy (ZAP).

CISA Has Added One Known Exploited Vulnerability to Catalog | CISA [Ed: Sophos Firewall (proprietary) actively exploited. Instead of enhancing security it adds security holes.]

↺ CISA Has Added One Known Exploited Vulnerability to Catalog | CISA

> CISA has added one new vulnerability to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise. Note: To view the newly added vulnerabilities in the catalog, click on the arrow in the "Date Added to Catalog" column, which will sort by descending dates.

Second lot of Optus data advertised for sale on Web forum

↺ Second lot of Optus data advertised for sale on Web forum

> A second lot of data claimed to be from Optus has been advertised for sale on a Web forum, with 100 sample records being linked to as proof that it is genuine.

> Emsisoft security researcher Brett Callow pointed out in a tweet that the account stated, "No sale will be made for 1 week until Optus reply".

> He said this implied it could be a case of attempted extortion. iTWire has sought a reaction from Optus about this. The Optus breach was made public on Thursday.

gemini.tuxmachines.org