Security

This content is now available in the Pluralsight course "OWASP Top 10 Web Application Security Risks for ASP.NET" [http://www.pluralsight.com/courses/owasp-top10-aspdotnet-application-security-risks] Cryptography is a fascinating component of computer systems. It’s one of those things which appears frequently (or at least should appear frequently), yet is often poorly understood and as a result, implemented badly. Take a couple of recent high profile examples in the form of Gawker and rootkit.c...

So the Sony saga continues. As if the whole thing about 77 million breached PlayStation Network accounts [http://www.theage.com.au/digital-life/games/playstation-privacy-breach-77-million-customer-accounts-exposed-20110427-1dvhf.html] wasn’t bad enough, numerous other security breaches [http://attrition.org/security/rants/sony_aka_sownage.html] in other Sony services have followed in the ensuing weeks, most recently with SonyPictures.com [http://www.sonypictures.com/]. As bad guys often like t...

A couple of different friends sent me over a link to an article about The Usability of Passwords [http://www.baekdal.com/tips/password-security-usability] this weekend, clearly thinking it would strike a chord. Well, let’s just say I was enthralled before I even finished the second line: > Security companies and IT people constantly tells us that we should use complex and difficult passwords. This is bad advice The crux of the article (and subsequent FAQ), is that so long as a password is s...

An unexpected email was waiting for me when I got off the plane from a recent work trip to Thailand on Saturday: > Congratulations! We are pleased to present you with the 2011 Microsoft® MVP Award! This award is given to exceptional technical community leaders who actively share their high quality, real world expertise with others. We appreciate your outstanding contributions in Developer Security technical communities during the past year. Given this was sent out on April 1st, one could be...

Edit (6 Oct 2020): It looks like the WCSA website has disappeared since originally writing this article and the domain is now parked on a porn site. The Google Code archive still exists so the blog post is still relevant, just be conscious that this project has obviously gone unloved for some time now and make take you to unexpected places. Ah, automation. Any time I find myself doing the same thing more than once, I get the inclination to bundle it all up into something that can begin happenin...

Banks don’t get it. Telcos struggle with it. Airlines haven’t got a clue. That’s right folks, its password time again. Earlier in the year I wrote a little post about the who’s who of bad password practices [https://www.troyhunt.com/2011/01/whos-who-of-bad-password-practices.html]. I named, I shamed and I got a resounding chorus of support. The point was made. But it still bugged me. Why were our banks and airlines so consistently forcing us to choose poor passwords? Why do they constrain our...

Let’s assume you log onto a bunch of different websites; Facebook, Gmail, eBay, PayPal probably some banking, maybe a few discussion forums and probably much, much more. Do you always create unique passwords such that you never use the same one twice? Ever? Do your passwords always use different character types such as uppercase and lowercase letters, numbers and punctuation? Are they “strong”? If you can’t answer “yes” to both these questions, you’ve got yourself a problem. But the thing is,...

It’s about assurance. It’s about establishing a degree of trust in a site’s legitimacy that’s sufficient for you to confidently transmit and receive data with the knowledge that it’s reaching its intended destination without being intercepted or manipulated in the process. Last week I wrote a (slightly) tongue-in-cheek post about the Who’s who of bad password practices [https://www.troyhunt.com/2011/01/whos-who-of-bad-password-practices.html]. I was critical of a number of sites not implementin...

Ah, passwords. Love ‘em or hate ‘em, they’re a necessary evil of the digital age. The reality is we all end up with an alphabet soup of passwords spread over dozens of various sites and services across the internet. Whilst we might not always practice it, we all know the theory of creating a good password; uniqueness, randomness and length. The more of each, the better. Of course we frequently don’t do this because of all sorts of human factors such as convenience, memory or simple unawareness...

Here’s the thing about securing credentials in web apps; you’re not just responsible for securing your application, you’re also responsible for securing your customer’s identities. Let me demonstrate: 123456, password, 12345678, qwerty, abc123, 12345, monkey, 111111, consumer, letmein, 1234, dragon, trustno1, baseball, gizmodo, whatever, superman, 1234567, sunshine, iloveyou, fuckyou, starwars, shadow, princess, cheese These 25 passwords were used a total of 13,411 times by people with Gawker...