New answers tagged

2

Thunderbird doesn't support two factor authentication, so Google has a means of generating a special credential set that can be used with Thunderbird. When configured in this way it works fine with Gmail, but I guess it is less secure than proper TFA.


0

Large websites deal with this by volume. They have such as large SMS packages, basically "unlimited SMS", so even a thousand of malicious SMS's won't "bite" on them. For smaller sites, it's usually better to have a request-response system instead. There's 2 things you can do: Either, you have a premium SMS number, and charge the equivalent fee that is cost ...


0

You may want to take a look at the "Making CSP Great Again" presentation from AppSec Europe, which discusses some nuances of deploying effective CSPs. The comment by user grc mentioning Sub Resource Integrity is another way to help ensure that only scripts you have explicitly whitelisted (based on the hash contents) can be loaded. This means that you can ...


0

If you really want to secure the javascript used on your site, just copy on your own server the jQuery part that you use and serve it directly from there. CDN are extremely useful for large contents like video file. But javascript is not that heavy and can normally be cached by client browsers, so they load it only once for a whole session.


0

my understanding is its not possible to specify individual JS files. instead the principle is you trust the CDN provider in this case you trust google. I think it would be a nice extension to the CSP if you are allowed whitelist the domain and JS resource.


2

While Google Safebrowsing is today mostly an offline check against some local database they still require that the browser queries google directly before presenting the phishing warning to the user. This is done to reduce the chance of false positives because the online check has the most up-to-date information. But it still might be considered a privacy ...


3

No, this adds no real security value. Depending on the approach of your attacker, the first thing he might do is fingerprint the server and libs and do a crawl of the whole site himself (that's what I would do if the point is to find a vulnerability in the code). Crawling a site like this is extremely trivial (and easily automated), so the gain is ...


3

Based on what you provided we can see that the Thunderbird icon is active. If it was configured to synchronise with Gmail account, and the authorisation was never performed or revoked, the connection is refused by Gmail service and Thunderbird requests an OAuth authorisation. If the above is true, there's no indication this authorisation request is ...



Top 50 recent answers are included