med-mastodon.com is one of the many independent Mastodon servers you can use to participate in the fediverse.
Medical community on Mastodon

Administered by:

Server stats:

338
active users

#websecurity

2 posts2 participants0 posts today

"Regulators around the world are working to address competition issues in digital markets, particularly on mobile devices. Several new laws have already been passed, including the UK’s Digital Markets, Competition and Consumers Act (DMCC), Japan’s Smartphone Act, and the EU’s Digital Markets Act (DMA). Australia and the United States are also considering similar legislation with the U.S. Department of Justice pursuing an antitrust case against Apple. Across all of these efforts, common questions arise: How should competition, user choice, and utility be balanced against security concerns? What is proportionate and necessary in relation to security? And how effective is app store review in practice?

The DMA is a helpful act to look at as it has been in force the longest and many of these other acts are loosely based on it. The DMA aims to restore contestability, interoperability, choice and fairness back to digital markets in the EU. These fundamental properties of an effectively functioning digital market have been eroded by the extreme power gatekeepers wield via their control of “core platform services”.

Under the DMA gatekeepers are only allowed to have strictly necessary, proportionate and justified security measures to protect the integrity of the operating system."

open-web-advocacy.org/blog/bal

Page image for Open Web Advocacy
Open Web AdvocacyBalancing Security and Fair Competition - Open Web Advocacy
#EU#DMA#Monopolies

In other words, some bad bots have been slamming a website at work with an additional 100k requests/day from random IPs, mostly from Vietnam, Brazil, and India. But some from the US, too

We suspect an AI training bot.

Many of these seem to be residential IPs.

They all seem to have common patterns to them. HTTP 1.1, no cookies, only 1-2 requests per day per IP, random UA, no CSS, js or images. Often pages blocked by robots.txt.

We're wondering if this is due to malware, or some kind of free VPN that rents out users' connections. Or is it Brave browser's Web Discovery project?

Has anyone else run into this?

Durch eine absurde Erfahrung mit der #Sparkasse suche ich nach #BullshitBingo Karten zum Thema #Security (#WebSecurity)

Bisher:
- Einmalcodes per #SMS
- Proprietäre #TOTP App statt offener Standards
- Support nur per Telefon
- Username und Passwort laut durchsagen
- Apps nach 5 Minuten von selber sperren
- Apps nach 3 Monaten ohne Login sperren, ohne Errorcode oder auffindbare Onlinehilfe ("90 Tage")
- App neu installieren, um Problem zu lösen (#TOFU)

Fällt euch noch was ein?

New on WebPerformance Report: HTTP Observatory 🎉
Check your site's HTTP security headers and get clear, actionable results in your inbox.
Thanks to the @MDN team for their technical guidance. 🙌
Because great UX should also be secure.
👉 webperformancereport.com/httpo
#WebPerf #WebSecurity #CyberSecurity

webperformancereport.comHTTP Observatory Report | WebPerformance ReportHTTP Header Security report every week in your inbox. Reports, Decisions, Results...

SQL Injection (SQLi) 💉 – Everything You Need to Know

What is SQL Injection?
SQL Injection is a code injection technique that allows attackers to interfere with the queries an application makes to its database.

Types of SQLi:

1. In-band SQLi – Most common and easy to exploit.

2. Blind SQLi – Data isn’t visibly returned but can still be extracted through inference.

3. Out-of-band SQLi – Uses external servers to get results (less common but powerful).

4. Time-Based Blind SQLi – Server delay used to infer info from the database.

Attack Scenarios:
▫️Bypassing logins
▫️Dumping database contents
▫️Modifying or deleting data
▫️Escalating privileges
▫️Accessing admin panels

Common SQLi Targets:
🔹Login forms
🔹Search boxes
🔹URL parameters
🔹Cookies
🔹Contact or feedback forms

How to Prevent SQLi:
▪️Use parameterized queries
▪️Employ ORM frameworks
▪️Sanitize all user inputs
▪️Set least privilege for DB users
▪️Use Web Application Firewalls (WAF)

♦️Red Team Tip
Test all user input points, especially where data touches the database. Think beyond login forms—SQLi hides in unexpected places.

🔖Hashtags:
#SQLInjection #CyberSecurity #EthicalHacking #InfoSec #WebSecurity #RedTeam #BugBounty #Pentesting

⚠️Disclaimer:
This content is for educational purposes only. Always perform security testing with explicit permission. Unauthorized testing is illegal and unethical.

Everything About SQL Injection 💉

What is SQL Injection?
SQL Injection is a web vulnerability that lets attackers manipulate database queries. This can lead to unauthorized access, data leaks, or even full control of the system.

🔬Types of SQL Injection

1️⃣ Classic SQLi – Injecting raw SQL commands.
2️⃣ Blind SQLi – No errors, but the response changes.
3️⃣ Time-Based SQLi – Uses response delays to extract data.
4️⃣ Union-Based SQLi – Merges malicious queries with valid ones.
5️⃣ Out-of-Band SQLi – Exfiltrates data through DNS, HTTP, etc.

♦️Potential Impact
▫️Access & dump sensitive data
▫️Bypass login systems
▫️Alter or delete database entries
▫️Full system compromise

🔰Common Entry Points
▫️Login forms
▫️Search inputs
▫️Contact forms
▫️URL query parameters

Defense Strategies 🛡
✅ Use parameterized queries
✅ Validate & sanitize inputs
✅ Apply least privilege to DB accounts
✅ Monitor logs for anomalies
✅ Perform regular security audits

📀Image Description (for visual):
🔹A sleek cyber-themed layout with:
🔹A hacker icon injecting code
🔹A login form being exploited
🔹Database icons showing exposed data
🔹A shield labeled “Prepared Statements” blocking the attack

🔖Tags
#SQLInjection #CyberSecurity #EthicalHacking #WebSecurity #BugBounty #InfoSec #Pentesting #OWASP #DatabaseSecurity #HackerTips

⚠️Disclaimer
This content is for educational and ethical purposes only. Do not attempt to exploit vulnerabilities without proper authorization. Always follow legal and ethical guidelines when testing or learning about cybersecurity.

"When Let’s Encrypt, a free certificate authority, started issuing 90 day TLS certificates for websites, it was considered a bold move that helped push the ecosystem towards shorter certificate life times. Beforehand, certificate authorities normally issued certificate lifetimes lasting a year or more. With 4.0, Certbot is now supporting Let’s Encrypt’s new capability for six day certificates through ACME profiles and dynamic renewal at:

- 1/3rd of lifetime left
- 1/2 of lifetime left, if the lifetime is shorter than 10 days"

eff.org/deeplinks/2025/04/cert

Electronic Frontier Foundation · Certbot 4.0: Long Live Short-Lived Certs!When Let’s Encrypt, a free certificate authority, started issuing 90 day TLS certificates for websites, it was considered a bold move that helped push the ecosystem towards shorter certificate life times. Beforehand, certificate authorities normally issued certificate lifetimes lasting a year or...

"API keys are foundational elements for authentication, but relying solely on them is inherently a risky proposal.

Firstly, there’s the reality that API keys are not securely designed — they were never meant to be used as the sole form of authentication, and as such, they aren’t really built for the task. These keys can often be easily stolen, leaked, or, in some cases (especially if generated incrementally), outright guessed. An API key is suitable for tracking usage but is poor for security.

There is also the additional reality that keys in their default state lack some critical functionality. There’s not a lot of verification built-in for identity management, and what does exist offers very little in the way of granular access control.

Ultimately, solely relying on API keys is a mistake common with novice developers but frighteningly common even in advanced products.

Best Practices
Instead of relying heavily on API keys as a sole mechanism, combine those keys with additional approaches such as OAuth 2.0 or mTLS. Implement rigorous expiration and rotation policies to ensure that keys which are made public are only useful for a short amount of time. Consider more advanced approaches, such as IP whitelisting or device fingerprinting, to add another layer of security atop the API key process."

nordicapis.com/9-signs-youre-d

Nordic APIs · 9 Signs You're Doing API Security Wrong | Nordic APIs |API security anti-patterns are common. From overreliance on API keys to a lack of rate limiting to no encryption, we explore the top ones.

"It is now time to fix it for good. A new solution has been proposed: partitioning visited link history. This approach fundamentally changes how browsers store and expose visited link data. Instead of maintaining a global list, web browsers will store visited links with a triple-key partition:

- Link URL. The destination of the visited link.
- Top-Level Site. The domain of the main browsing context.
- Frame Origin. The origin of the frame rendering the link.

A link is only styled as :visited if it was visited from the same top-level site and frame origin (...) This approach guarantees isolation and works well with the web's same-origin policy. The system records only navigations initiated by link clicks or scripts—excluding direct address bar entries or bookmark navigations.

Key benefits of this model include: strong protection against cross-site history leaks, solving for good of many known side-channel attacks, support for meaningful styling within trusted, same-context domains, conforming to established web privacy principles and data protection regulations.

This feature is already implemented in Chrome (v132, behind a #partition-visited-link-database-with-self-links flag). I am confident that in 2025 we are going to have this privacy headache solved once and for all."

blog.lukaszolejnik.com/fixing-

Security, Privacy & Tech Inquiries · Fixing web browser history leaksWeb browsing history powers helpful features like styling visited links differently, allowing users to see where they've been before. While this usability feature provides navigational benefits, it also introduces a privacy risk. The handling of visited links happened to be a silent backdoor of a kind, allowing malicious sites to

Although frequently misunderstood, the HTTP Cache-Control header is crucial because it specifies caching mechanisms within requests and responses.  In its typical format, it reveals details as to how resources are stored, the location of the resource and the maximum age before expiring…

In our latest blog post, Kieran Larking highlights that the No-cache directive does not prevent caching and looks at typical caching behaviour directives and how to correctly use these directives to balance performance and security: pentestpartners.com/security-b