1
CircleCI trusts 8 analytics companies with your source code and API tokens
When you navigate to your project in CircleCI's UI, Javascript from eight different analytics companies gets loaded and executed in your browser.
Kevin Burke
- Popular posts
- 11
- Total points
- 3,395
- HN comments
- 1,466
- Rank
- #407 personal
Visit kev.inburke.com → RSS feedOn Hacker News Oct 2011 – Feb 2019
Security & Privacy 4Software Engineering 4Tech Industry & Business 4Career & Management 3Web & Frontend 2Society, Policy & Culture 1
2
“Invalid username or password” is a useless security measure
Login attempts fail because computer users can't remember their email or didn't input the right password. Most websites on the Internet won't tell you which one is actually incorrect.
3
Things to Use Instead of JSON Web Tokens
You might have heard that you shouldn't be using JWT. That advice is correct - you really shouldn't use it. In general, specifications that allow the attacker to choose the algorithm for negotiation have more problems than ones that don't (see TLS). N libraries need to implement M different encryption and decryption…
4
Virgin Mobile leaves six million subscriber accounts wide open
Update: Virgin fixed the issue Tuesday night after taking their login page down for four hours. Please see my update at the bottom of this post.