#security is hard

I was going to have a fun, wistful, thoughtful post about having this job a whole year already today, but my security badge stopped working and the security team has a full stock of IDGAF so that's where things are right now. For context, every floor requires a badge to enter & exit. And the bathrooms are outside the secure areas. Good luck everyone else.

Somebody at Yahoo forgot about certificate management.

Sheiße.

Security Is Hard - Part the Millionth aka: "You got #OAuth2 right, but screwed up your trust vectors" “The root cause of this vulnerability is a common, but misplaced trust in the authenticating information received by the 3rd party app’s backend server from its own client-side mobile app, which in turn, relies on potentially tampered information obtained from the client-side mobile app"