Evolving beyond password complexity as an identity strategy

The security community is continuously changing, growing, and learning from each other to better position the world against cyber threats. In the latest Voice of the Community blog series post, Microsoft Product Marketing Manager Natalia Godyla talks with Troy Hunt, founder of Have I Been Pwned,...

Evolving beyond password complexity as an identity strategy

The security community is continuously changing, growing, and learning from each other to better position the world against cyber threats. In the latest Voice of the Community blog series post, Microsoft Product Marketing Manager Natalia Godyla talks with Troy Hunt, founder of Have I Been Pwned,...

Training apps. Have their privacy settings improved in 5 years?

TL;DR Run and bike tracking apps still have a pretty poor approach to password security & default privacy settings From being one of the more secure apps 5 years ago, Strava has now been pushed to the back of this pack as others improved Amazingly, none of these apps support multi factor...

Security vs User Journey

Something I often think about is how my recommendations for clients to fix small security issues can spoil / complicate their users journey. UX matters I understand that UX is hugely important, even subtle changes can influence whether a journey is completed or abandoned. The difference between...

Information Disclosure

flask-security-too is vulnerable to information disclosure. The /tf-qrcode endpoint returns the authenticated user's two-factor authentication codes when GET request is submitted. This allows a remote attacker to perform CSRF attacks on a victim to obtain the two-factor authentication codes. The...

CSRF Vuln can expose user's QRcode

Impact When a user is setting up two-factor authentication using an authenticator app, a QRcode is generated and made available via a GET request to /tf-qrcode. Since GETs do not have any CSRF protection, it is possible a malicious 3rd party could access the QRcode and therefore gain access to...

GHSA-FXQ4-R6MR-9X64 CSRF Vuln can expose user's QRcode

Impact When a user is setting up two-factor authentication using an authenticator app, a QRcode is generated and made available via a GET request to /tf-qrcode. Since GETs do not have any CSRF protection, it is possible a malicious 3rd party could access the QRcode and therefore gain access to...

CVE-2021-3153

HashiCorp Terraform Enterprise up to v202102-2 failed to enforce an organization-level setting that required users within an organization to have two-factor authentication enabled. Fixed in v202103-1...

Authentication flaw

HashiCorp Terraform Enterprise up to v202102-2 failed to enforce an organization-level setting that required users within an organization to have two-factor authentication enabled. Fixed in v202103-1...

CVE-2021-3153

HashiCorp Terraform Enterprise up to v202102-2 failed to enforce an organization-level setting that required users within an organization to have two-factor authentication enabled. Fixed in v202103-1...

CVE-2021-3153

HashiCorp Terraform Enterprise up to v202102-2 did not enforce an organization-level setting requiring MFA for users within an organization. Root cause: MFA enforcement was not applied at the org level. Impact: potential weaker access controls; remediation: upgrade to v202103-1 where the MFA requ...

CVE-2021-3153

HashiCorp Terraform Enterprise up to v202102-2 failed to enforce an organization-level setting that required users within an organization to have two-factor authentication enabled. Fixed in v202103-1...

Hashicorp Terraform 授权问题漏洞

Hashicorp Terraform is an open source tool for provisioning and managing cloud infrastructure from HashiCorp Hashicorp, USA. A security vulnerability exists in HashiCorp Terraform that stems from a failure to enforce an organization-level setting that requires users within an organization to enab...

Terraform Enterprise Organization-Level MFA Requirement Was Not Enforced

Summary Terraform Enterprise did not enforce the organization-level setting to require all users within an organization to enable two-factor authentication. This vulnerability, CVE-2021-3153, was fixed in Terraform Enterprise v202103-1. Background Terraform Enterprise organizations are a shared...

How to enable Facebook’s hardware key authentication for iOS and Android

Since 2017 desktop users have had the opportunity to use physical security keys to log in to their Facebook accounts. Now iOS and Android users have the same option too. Physical security keys are a more secure option for two-factor authentication 2FA than SMS which is vulnerable to SIM swap...

OPENSUSE-SU-2021:0450-1 Security update for froxlor

This update for froxlor fixes the following issues: - Upstream upgrade to version 0.10.23 boo846355 - Upstream upgrade to version 0.10.22 boo846355 - BuildRequire cron as this contains now the cron directories - Use %license for COPYING file instead of %doc boo1082318 Upstream upgrade to version...

OPENSUSE-SU-2021:0415-1 Security update for froxlor

This update for froxlor fixes the following issues: - Upstream upgrade to version 0.10.23 boo846355 - Upstream upgrade to version 0.10.22 boo846355 - BuildRequire cron as this contains now the cron directories - Use %license for COPYING file instead of %doc boo1082318 Upstream upgrade to version...

Netflix's Password-Sharing Crackdown Has a Silver Lining

The streaming service is making account owners enter two-factor codes in a limited test. That's … actually not so bad...

Joomla Encryption Problem Vulnerability

Joomla is the U.S. Open Source Matters team of a set of PHP and MySQL development using open source, cross-platform content management system CMS. Joomla suffers from a cryptographic issue vulnerability that stems from not using the secure rand function during the generation of 2FA keys. No...

There is an unspecified vulnerability in Joomla

Joomla is the U.S. Open Source Matters team of a set of PHP and MySQL development using open source, cross-platform content management system CMS. Joomla suffers from a security vulnerability that stems from insufficient length for the use of 2FA secret sharing. No details of the vulnerability ar...