@reed Pentesting isn't about telling how secure a site is, quite the opposite. You want to show how insecure it is and how to fix it. A clean pentest report doesn't imply perfect security. You should never guarantee anything in the contract or you could be liable. So don't say that you'll find all bugs of some class.

@forest @reed counter argument: make a picture with a padlock which says "100% secure" in bold letters

@forest, it's not really pentesting. It's about services that are supposed to improve a client's security, like offering to do regular updates. I guess I should start by reading the TOS of firms like Sucuri, or the licenses provided by antivirus software

just checked Sucuri's TOS: if they can't clean your website after an infection, they will refund the annual fee. Except for that, the usual classic universal TOS applies: "the service is provided AS IS without warranty of any kind, etc.". LOL

@TomK. Krebs was upset at another security researcher, and doxxed them. All hell broke loose on twitter. Mitnick approved of the behaviour so he's also in the firing line of a large portion of the infosec industry :-)

@RoryAlsop yeah, that was kind of the gist that I got

eh krebs shoulda known better :/

He did have some fun stuff with a few folks who disliked him

@JourneymanGeek I have no idea why he thought that would be a good idea

isn't this what he does? unveiling people's identities in a story-like manner?

@TomK. The problem is in his reasoning - the person he doxxed is not a criminal, but another researcher

yeah, I heard about that.. but I was kinda surprised about the outrage

@J.J I'm a petty dabbler...

ah

uhm

and?

eh kinda

actually this is more under the security spook dogpark...

considered say, chroot jails?

another thing to consider is encrypted home directories

I'm just spitballing

So, as a petty dabbler...

what scares you? OS level funsies? folks getting access to your normal account info?

for everything but the full system compromise and keyloggers, encrypted home directories help

well data leaking and tracking could happen on your HTB instance I guess

(feel free to tell me I'm wrong ;p)

@J.J anything ;p

but there's reasonable steps and there's full paranoia

@J.J it would make it harder if someone hacked into one account to access the other

@J.J ah! You could run them in containers, or chroot I assume, in many cases.

if you gotta use it, you gotta use it. But you could set up that account to only be able to sudo the tools you use.

if nmap is compromised you have bigger problems

same idea though

You try to narrow the risk profile.

I mean, short of a burner laptop.... ;p

eh

lots of folks use netbooks for that

Oh well

once again, just spitballing ideas.

erm

I'm not really a security.se regular.

I don't really know :/

If its forensics related, and I remember (Its what my degree is, but I ended up elsewhere) I'd be glad to be slightly more authoritative ;p

ah. tbh - recovery from ram is insanely hard unless you're logged in as, well you

yes, there's the freezer trick but that's about as esoteric as it gets

and heh. yubikeys are sweet

I have the github special u2f one

waiting on a solo though

@J.J you're going to hate me.

I paid.. 8 dollars for my U2f key

mailman.stanford.edu/pipermail/liberationtech/2015-October/…

yeah

errr

I kinda want the fancy one fo I can do passwordless unlock

kickstarter.com/projects/conorpatrick/…

@J.J U2F is kinda the "minimum"/base level now

I'm getting a FIDO2 compatible one though

shop.solokeys.com

its open source, and a fair bit cheaper

annnd I got it on kickstarter so it was a bit cheaper than their list price

@J.J I use U2F for google's stuff

so basically you set it up through your browser or application that uses it

then you plug it in a push the button when it asks

so likewise for keepass

though, the yubikey5... do you need NFC?

@J.J yubikeys are the cheapest!

I have 6 now I think

Just to get one of each kind

They have all been registered and used... I haven't looked at the threat model for that...

Does anyone want a potentially fun challenge? More specifically, a CSS sandbox escape? The premise: I want to allow authors to use <style> tags on WordPress without being able to affect the site's main styles.

To do this, I will attempt to prepend all of their selectors with "#sandbox", which will restrict their CSS to only the #sandbox div. So the user gives "body {color:red}" and the page renders "#sandbox body {color:red}". It's a simple premise, but can potentially be hard to implement.

I uploaded my first go at this here: sandbox.onlinephpfunctions.com/code/…. If you want to take a look, I'd love to know if you can find any edge cases which will allow you to apply CSS outside of the #sandbox div, or if I've missed anything obvious.

I just realized that being able to use CSS at all allows the author to place their content outside of the sandbox without the code itself being outside of the sandbox. For example, this approach would prevent them from editing the page header, but not from spoofing the page header. Or worse, making their content 100% 100% and looking like a tech support scam. You can disregard the previous post as far as security goes.

This would still prevent users from accidentally breaking the page though, so if you do see something I missed, I'd love to know.