Top all-time · #7151
Devdatta Akhawe
Personal blog · devd.me/logsecuritystartups
Devdatta Akhawe's personal blog at devd.me covers security and startups. Since 2014, 11 different Hacker News readers have linked it 12 times, most often “Early Security for Startups”. No feed was found, so read it on the site itself.
Most-linked posts?
- Early Security for Startups4 people · 4 mentions · first linked 2022-03-28
- Security Analysis of Web-based Password Managers [pdf]3 people · 3 mentions · first linked 2014-07-11
What Hacker News says?
About the plugins, you are right, it's weak anyway, my bad. To better answer your question this is a paper explaining some critical vulnerabilities in the concept of password managers (let alone the implementation) http://devd.me/papers/pwdmgr-usenix14.pdf
Comment linking /papers/pwdmgr-usenix14.pdf
on “The anatomy of a credit card form”Submitted Security Analysis of Web-based Password Managers [pdf] as a story · 10 points
HN discussionI think this is the research they're referring to: http://devd.me/papers/pwdmgr-usenix14.pdf (Note that this is a USENIX paper, which makes the "we let them publish it" comment sort of weird). The bookmarklet attack isn't subtle; page 8 explains how they were able to set up a malicious site that could obtain Lastpass (say) Dropbox credentials.
Comment linking /papers/pwdmgr-usenix14.pdf
on “A Note from LastPass”Submitted Early Security for Startups as a story · 3 points
HN discussionIt's an irritating name, like PlanetScale. It both makes it sound more official (it's not official at all) and more high-tech than it is. What WebContainers doesn't do is provide container tech. WebAssembly is similar to a Docker container, so much so that Docker now supports WebAssembly. WebContainers also uses a subdomain and the browser's security model. In fact the browser is the main thing that limits what stuf…
Comment linking /papers/LeastPrivileges.pdf
on “WebContainer API”Submitted Early Security for Startups as a story · 3 points
HN discussionThere is a lot of advice in this thread that doesn't actually address your circumstances, or is just bad. I recommend reading: 1. https://devd.me/log/posts/startup-security/ - relatively short and prescriptive 2. http://scrty.io/ - start with http://scrty.io/foundations + https://medium.com/starting-up-security/you-dont-need-a-chie... + https://medium.com/starting-up-security/starting-up-security...
Comment linking /log/posts/startup-security/
on “Ask HN: I'm now responsible of the security of a scaleup, how do I handle this?”Submitted Kerckhoff’s Law for Security Engineers as a story · 3 points
HN discussionSubmitted Early Security for Startups as a story · 2 points
HN discussionSubmitted Early Security for Startups as a story · 2 points
HN discussionSubmitted Kerckhoff’s Law for Security Engineers as a story · 2 points
HN discussionSubmitted Kerckhoffs's Law for Security Engineers as a story · 1 points
HN discussion
