stefanorri

5 ms·

1.
by stefanorri 3y ago
Author here - I should maybe have made the disclaimer at the end more prominent - "All the bugs were discovered, verified, and reported. Any issued tickets were canceled and not used."
2.
Planes, Ferries and Automobiles – How I Hacked Free Travel Across Iceland(debug.is)
5 points by stefanorri 3y ago|2 comments
3.
Don't let Content Security Policy fool you into a false sense of security(debug.is)
3 points by stefanorri 10y ago|0 comments
4.
by stefanorri 11y ago
Thanks, glad to hear it!
5.
by stefanorri 11y ago
testssl.sh is also great for testing internal servers which aren't internet accessible.
6.
by stefanorri 11y ago
HTTPSecurityReport - https://httpsecurityreport.com - Disclaimer: I'm the creator. Site Scan from MS - https://dev.windows.com/en-us/microsoft-edge/tools/staticsca... Subresource Integrity sc
7.
Show HN: HTTP Security Report – Test Your HTTP and HTML5 Security(httpsecurityreport.com)
2 points by stefanorri 11y ago|0 comments
8.
Unblocking Netflix Could Put You at Risk(debug.is)
2 points by stefanorri 11y ago|0 comments
9.
Show HN: HTTP Security Report - Analyzer for HTTP best practices(httpsecurityreport.com)
4 points by stefanorri 11y ago|0 comments
10.
HTTP Public Key Pinning Usage Is Essentially Zero(debug.is)
2 points by stefanorri 11y ago|0 comments
11.
by stefanorri 11y ago
Good point. But the sandbox attribute is around 90% [1] of browsers. The number of browsers which don't support it and don't run javascript may be too low to make supporting them practical, but YMMV. [1] http://caniuse.
12.
by stefanorri 11y ago
If you apply the sandbox attribute to the iframes it should be ok. It allows fine grained control of what the iframe is allowed to do. Scripts, navigation, popups, etc. are forbidden except explicitly allowed.
13.
You've Been Framed. A survey of iframes and the sandbox attribute(debug.is)
33 points by stefanorri 11y ago|14 comments