Web Application Topics on Rietta Cybersecurity

Bad Password Practices are Responsible For Most Data Breaches. You Can do Better.

Tue, 10 May 2016 11:07:58 -0400

The 2016 Verizon DBIR report is out and is available for download. Among the findings is the prevalence of data breaches that are attributable to stolen authorization credentials.

According to the report “63% of confirmed data breaches involved weak, default or stolen passwords” (page 20). This is an increase from 2015, when the stat was that 51% of web application breaches were attributable to stolen credentials. If anything is clear, it’s that the lowly credential theft is a clear and present danger in information security. It is responsible for more incidents than all the other exotic, technically interesting attacks combined.

What is the difference between bcrypt and SHA256?

Fri, 05 Feb 2016 10:23:27 -0500

TL;DR; SHA1, SHA256, and SHA512 are all fast hashes and are bad for passwords. SCRYPT and BCRYPT are both a slow hash and are good for passwords. Always use slow hashes, never fast hashes.

SANS’ Securing Web Application Technologies [SWAT] Checklist is offering a bit of bad security advice for the everyday web application developer, under the heading “Store User Passwords Using A Strong, Iterative, Salted Hash”:

User passwords must be stored using secure hashing techniques with a strong algorithm like SHA-256. Simply hashing the password a single time does not sufficiently protect the password. Use iterative hashing with a random salt to make the hash strong.

What is an Abuser Story (Software)

Sun, 11 Oct 2015 22:35:36 -0400

I publicly speaking about how development teams and those who employ them should go about using user stories with security constraints and abuser stories as a security documentation tool. At this time there is not an entry on Wikipedia about it, so I am going to take a stab at writing it up for you here.

What is an Abuser Story in Software Development?

In software development and product management, an abuser story is a user story from the point of view of a malicious adversary. Abuser stories are used with agile software development methodologies as the basis for defining the activities that should be actively blocked or mitigated by the software and proven by automated regression testing.

Adding a Rake Task for SQL Views to a Rails Project

Mon, 30 Mar 2015 12:00:00 -0400

I have previously written about Using Rails and SQL Views for a Report. A practical consideration when employing SQL views, which create wonderfully fast read-only tables that can be used by ActiveRecord models seamlessly, in a Ruby on Rails project is where to maintain them in a project.

One approach is to use migrations, since that’s where database stuff normally goes. But a big downside is that this approach is not DRY because changing the SQL view requires a new migration that drops the old view and replaces it with the updated version. Simply changing a field in the SQL view requires copying and pasting the entire definition over again. That’s just annoying!

The second, and in my opinion better approach, is to treat SQL views more like models.

Issue #6: February, 2014, Web Application Topics Newsletter

Tue, 18 Feb 2014 07:31:00 -0500

In this issue

Get and compare the current Git branch in BASH
New book of the month
- Don’t Make Me Think, 3rd Edition
In the news
- PaperClip (Ruby on Rails) Insecure Defaults
- Yahoo user accounts compromised through third party database breach
- Buffer database compromised through compromise of MongoHQ support credentials

Why & How We Remote Pair Program (2013)

Tue, 07 Jan 2014 16:38:00 +0000

Brandon Dees and I gave a this talk about how and why we do remote pair programming when he lives in Nashville, TN, and I live in Johns Creek, GA (a 416 mile round trip) on Wednesday, October 9, 2013 at the Atlanta Ruby Users’ Group (ATLRUG). The Video The excellent Q&A starts at 31 minutes into the talk! The Slides The slides are available directly Why & How We Remote Pair Program at Speakerdeck and here is the link to video directly on YouTube.

Joppar's 'Tips on Securing Your Mobile App' Infographic Quoted Me!

Mon, 06 Jan 2014 11:26:00 +0000

Good morning! I write this on the very cold Monday morning that is January 6, 2014. Today, our friends over at Joppar, a mobile apps startup in Silicon Valley, have released a very good cheat sheet for app developers who want to care about the security of their application. In other words, anyone who does not want their own ‘Snapchat Breach Exposes Weak Security’ article from the New York Times.

OpenSSL: Encrypt Data with an RSA Key with PHP

Thu, 13 Jun 2013 00:00:00 +0000

Web application security is built upon a series of interconnected building blocks. This post is part of Rietta’s ongoing coverage of encryption. Browse the Encryption tag for the rest of the series. Last year, I wrote about how Generating an RSA Key from the Command Line in OpenSSL could support encrypting or validating data in an unattended manner (where the password is not required to encrypt). A few weeks before that, I posted about how to Encrypt a File with a Password from the Command Line using OpenSSL.

mod_deflate: Dramatic website speed increase with Apache compression on Ubuntu Linux

Wed, 18 Apr 2012 00:00:00 +0000

It’s easy to dramatically improve the loading speed of your website by enabling compression support in your Apache web server. This works without needing to make any changes to your backend or database code no matter what programming platform your development team uses. I recently added this change to a Ruby on Rails-based web application running on a Ubuntu Linux dedicated virtual server. That particular page observed a 72% decrease in bandwidth required to deliver the homepage.

Rails: TypeError: nil can't be coerced into Float

Sat, 14 Jan 2012 00:00:00 +0000

When working on Ruby on Rails website some of the common errors that you need to check for is nil objects when something else was expected. For instance, suppose one of your ActiveRecord models has a price field. Further suppose that the user left this field blank instead of entering 0.0 as the price. This computation will fail: quantity = 3 # ... amount_to_charge = price_field * quantityIt fails with a “TypeError: nil can’t be coerced into Float” exception.