Tanya Janca | SheHacksPurple :verified: :verified:<p>I'm giving a paid workshop on the <a href="https://infosec.exchange/tags/OWASP" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>OWASP</span></a> <a href="https://infosec.exchange/tags/APISecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>APISecurity</span></a> Top Ten with AntiSyphon training on September 19th, with a ranging pay scale. Check it out here: </p><p><a href="https://twp.ai/4inqEs" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="">twp.ai/4inqEs</span><span class="invisible"></span></a></p>
eupolicy.social is one of the many independent Mastodon servers you can use to participate in the fediverse.
This Mastodon server is a friendly and respectful discussion space for people working in areas related to EU policy. When you request to create an account, please tell us something about you.
Administered by:
Server stats:
214active users
eupolicy.social: About · Profiles directory · Privacy policy
Mastodon: About · Get the app · Keyboard shortcuts · View source code · v4.4.1
#apisecurity
0 posts · 0 participants · 0 posts today
Tanya Janca | SheHacksPurple :verified: :verified:<p>🎥 Missed one of my past conference talks? Let’s fix that.</p><p>I’m sharing my favorites—packed with real-world advice, lessons, and a few laughs.</p><p>“Top Ten Security Tips for APIs”<br>📽️ <a href="https://twp.ai/4ioX6N" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="">twp.ai/4ioX6N</span><span class="invisible"></span></a></p><p><a href="https://infosec.exchange/tags/CyberSecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>CyberSecurity</span></a> <a href="https://infosec.exchange/tags/SecurityAwareness" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>SecurityAwareness</span></a> <a href="https://infosec.exchange/tags/appsec" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>appsec</span></a> <a href="https://infosec.exchange/tags/APISecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>APISecurity</span></a></p>
Nicola :official_verified:<p>What would you do if you discovered a <a href="https://infosec.exchange/tags/bug" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>bug</span></a> or <a href="https://infosec.exchange/tags/loophole" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>loophole</span></a> that provided free lifetime service instead of the usual annual or monthly fees? I've been trying to reach out to the company for a year, sending emails and requesting contact with their <a href="https://infosec.exchange/tags/development" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>development</span></a> or <a href="https://infosec.exchange/tags/security" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>security</span></a> team, but I haven't received a response.</p><p>The <a href="https://infosec.exchange/tags/CEO" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>CEO</span></a> is active on <a href="https://infosec.exchange/tags/X" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>X</span></a> and <a href="https://infosec.exchange/tags/Meta" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Meta</span></a>, but I don't have accounts on those platforms but I can't contact him directly anyway since DMs are disabled. Any suggestions?</p><p>The service still works after a year of using it.</p><p><a href="https://infosec.exchange/tags/hacking" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>hacking</span></a> <a href="https://infosec.exchange/tags/api" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>api</span></a> <a href="https://infosec.exchange/tags/apisecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>apisecurity</span></a></p>
OWASP Foundation<p>Join Tanya Janca on November 5 for a 1-day, hands-on training session at OWASP Global AppSec USA 2025 and learn how to design and harden APIs the right way.</p><p>Secure your training spot now: <a href="https://owasp.glueup.com/event/131624/register/" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">owasp.glueup.com/event/131624/</span><span class="invisible">register/</span></a></p><p><a href="https://infosec.exchange/tags/GlobalAppSecUS" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>GlobalAppSecUS</span></a> <a href="https://infosec.exchange/tags/Cybersecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Cybersecurity</span></a> <a href="https://infosec.exchange/tags/CyberSec" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>CyberSec</span></a> <a href="https://infosec.exchange/tags/ThreatModeling" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>ThreatModeling</span></a> <a href="https://infosec.exchange/tags/DevSecOps" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>DevSecOps</span></a> <a href="https://infosec.exchange/tags/AI" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>AI</span></a> <a href="https://infosec.exchange/tags/Hacking" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Hacking</span></a> <a href="https://infosec.exchange/tags/WashingtonDC" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>WashingtonDC</span></a> <a href="https://infosec.exchange/tags/AppSec" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>AppSec</span></a> <a href="https://infosec.exchange/tags/APISecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>APISecurity</span></a> <a href="https://infosec.exchange/tags/SecureCode" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>SecureCode</span></a> <a href="https://infosec.exchange/tags/API" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>API</span></a></p>
Sam Stepanyan :verified: 🐘<p><a href="https://infosec.exchange/tags/JWT" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>JWT</span></a>: 'Attacking JWT using X509 Certificates': how an attacker could sign the JWT token with their own private key and modify the header value to specify their public key for signature verification:<br><a href="https://infosec.exchange/tags/AppSec" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>AppSec</span></a><br><a href="https://infosec.exchange/tags/APIsecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>APIsecurity</span></a></p><p><a href="https://trustedsec.com/blog/attacking-jwt-using-x509-certificates" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">trustedsec.com/blog/attacking-</span><span class="invisible">jwt-using-x509-certificates</span></a></p>
Miguel Afonso Caetano<p>"API keys are foundational elements for authentication, but relying solely on them is inherently a risky proposal.</p><p>Firstly, there’s the reality that API keys are not securely designed — they were never meant to be used as the sole form of authentication, and as such, they aren’t really built for the task. These keys can often be easily stolen, leaked, or, in some cases (especially if generated incrementally), outright guessed. An API key is suitable for tracking usage but is poor for security.</p><p>There is also the additional reality that keys in their default state lack some critical functionality. There’s not a lot of verification built-in for identity management, and what does exist offers very little in the way of granular access control.</p><p>Ultimately, solely relying on API keys is a mistake common with novice developers but frighteningly common even in advanced products.</p><p>Best Practices<br>Instead of relying heavily on API keys as a sole mechanism, combine those keys with additional approaches such as OAuth 2.0 or mTLS. Implement rigorous expiration and rotation policies to ensure that keys which are made public are only useful for a short amount of time. Consider more advanced approaches, such as IP whitelisting or device fingerprinting, to add another layer of security atop the API key process."</p><p><a href="https://nordicapis.com/9-signs-youre-doing-api-security-wrong/" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">nordicapis.com/9-signs-youre-d</span><span class="invisible">oing-api-security-wrong/</span></a></p><p><a href="https://tldr.nettime.org/tags/API" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>API</span></a> <a href="https://tldr.nettime.org/tags/APIs" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>APIs</span></a> <a href="https://tldr.nettime.org/tags/APISecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>APISecurity</span></a> <a href="https://tldr.nettime.org/tags/APIDesign" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>APIDesign</span></a> <a href="https://tldr.nettime.org/tags/WebSecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>WebSecurity</span></a> <a href="https://tldr.nettime.org/tags/CyberSecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>CyberSecurity</span></a></p>
Sam Stepanyan :verified: 🐘<p><a href="https://infosec.exchange/tags/Docker" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Docker</span></a> Fixes Critical 5-year Old Authentication Bypass <a href="https://infosec.exchange/tags/Vulnerability" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Vulnerability</span></a> CVE-2024-41110 (CVSS:10.0) allows attacker to login by sending an API request with a Content-Length of 0!<br><a href="https://infosec.exchange/tags/APISecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>APISecurity</span></a><br>👇 <br><a href="https://www.bleepingcomputer.com/news/security/docker-fixes-critical-5-year-old-authentication-bypass-flaw/" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://www.</span><span class="ellipsis">bleepingcomputer.com/news/secu</span><span class="invisible">rity/docker-fixes-critical-5-year-old-authentication-bypass-flaw/</span></a></p>
Sam Stepanyan :verified: 🐘<p><a href="https://infosec.exchange/tags/Twilio" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Twilio</span></a> has confirmed that an unsecured API endpoint allowed <a href="https://infosec.exchange/tags/ShinyHunters" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>ShinyHunters</span></a> threat actors to verify and leak the phone numbers of 33 million of Authy MFA users:<br><a href="https://infosec.exchange/tags/APISecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>APISecurity</span></a><br>👇<br><a href="https://www.bleepingcomputer.com/news/security/hackers-abused-api-to-verify-millions-of-authy-mfa-phone-numbers/" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://www.</span><span class="ellipsis">bleepingcomputer.com/news/secu</span><span class="invisible">rity/hackers-abused-api-to-verify-millions-of-authy-mfa-phone-numbers/</span></a></p>
Neil Madden<p>Slides from my talk on Macaroons from <a href="https://infosec.exchange/tags/SecAppDev" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>SecAppDev</span></a> are now available (click Download Handouts). It wasn’t recorded, so I’ll maybe do it on twitch or something. <a href="https://secappdev.org/2024/sessions/introduction-to-macaroons/" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">secappdev.org/2024/sessions/in</span><span class="invisible">troduction-to-macaroons/</span></a> </p><p><a href="https://infosec.exchange/tags/cryptography" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>cryptography</span></a> <a href="https://infosec.exchange/tags/apisecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>apisecurity</span></a></p>
TrendingLive feeds
Mastodon is the best way to keep up with what's happening.
Follow anyone across the fediverse and see it all in chronological order. No algorithms, ads, or clickbait in sight.
Create accountLoginDrag & drop to upload