security

How to store ansible_become_pass in a vault and how to use it?

by

You need to create some vaulted variable files and then either include them in your playbooks or on the command line. If you change your inventory file to use a variable for the become pass this variable can be vaulted: [my-servers] san-francisco ansible_host=san-francisco ansible_ssh_user=user ansible_become_pass=”{{ sanfrancisco_become_pass }}” san-diego ansible_host=san-diego ansible_ssh_user=user ansible_become_pass=”{{ sandiego_become_pass }}” Then use … Read more

Does HTML5 allow you to interact with local client files from within a browser

by

No, not directly at least. However, you have a number of choices here. Currently your best choices are: Drag and drop files from desktop, see a tutorial. (Link disabled for malware/phishing) Use input type file. Read the contents with the File API or submit the form. Read more on Mozilla Developer Center about reading the … Read more

How is it possible to access memory of other processes?

by

In all likelyhood, the tool uses ReadProcessMemory or some variant, which requires PROCESS_VM_READ access. With respect to your “malicious” comment, remember that you (or the process invoking this API, which likely needs Administrator-level permissions) already has total control over the machine. The security game is already lost at this point.

Do OAuth2 access tokens for a mobile app have to expire?

by

The difference between a refresh token and a non-expiring access token in means of security is one additional call to the authorization server. If an attacker gains access to your non-expiring access token, he can directly call your resource server and get confidential data as response. Now if he steals your refresh token, he first … Read more

Using HMAC-SHA1 for API authentication – how to store the client password securely?

by

This is the downside of symmetric-key challenge-response style authentication – you don’t put the secret on the wire, but you have to store the secret at both ends. (HMACs are symmetric key systems). Note though that it’s not a password – it’s a shared secret. There’s a fundamental difference here – a password is generally … Read more

What is the appropriate way to manage API secrets within a Google Apps script?

by

There is no right or wrong answer. There are numerous factors to consider: If this is for/in G-Suite, then your G-Suite admins’ll have (or can get) access to anything. This may or may not be an issue. If you put the data in a sheet, anyone that has read access to the sheet can see … Read more

Hata!: SQLSTATE[HY000] [1045] Access denied for user 'divattrend_liink'@'localhost' (using password: YES)