Compass Security Blog

Offensive Defense

SuisseID-basierte Authentisierung mit Apple OS X

Apple veröffentliche 2006 ein Setup-Guide für die Benutzung von OS X mit Smartcards. Die Anleitung basiert auf der Version 10.4 ist somit nicht mehr aktuell. Die Prinzipien sind allerdings nach wie vor anwendbar und benötigen nur ein paar wenige Anpassungen, wie das folgende Proof-of-Concept zeigt. Es existieren drei Möglichkeiten unter OS X die Smartcard mit […]

Continue reading

OpenSSH authentication with SuisseID

SuisseID is the first legally accepted, standardized, electronic identification hardware in Switzerland. Available since 2010 for any person living in Switzerland, it contains two X.509 certificates, one for authentication and one for qualified signatures. ‘Qualified’ in this regard means that is legally treated equally to a manual signature. This is especially interesting for signing contracts, […]

Continue reading

OpenSSH enables true Multi Factor Authentication

Over the past years system administrators had to learn that password authentication has its shortcomings. The protection level of password based authentication methods depends heavily on the password quality as well as the password handling of the users, where the latter is difficult to manage strictly. Public Key based authentication methods came to the rescue, […]

Continue reading

XSS – The never ending story

Cross-Site Scripting (XSS) has lost one rank in the newly released OWASP Top Ten 2013 candidate. Compared to the 2010 version, it’s now on rank three, overtaken by “Broken Authentication and Session Management”. Has XSS become less common then? No, I don’t think so. Compass Security has always been strong in web application security testing […]

Continue reading

Why does Compass Security recommend HSTS?

Secure web communications using HTTPS isn’t anything fancy anymore these days. It ensures traffic from a user to your web application cannot be eavesdropped or tampered with, given it has been set up securely using SSL/TLS. But, do you trust your web application’s code to entirely disregard unencrypted requests? Are you sure your Apache/IIS is […]

Continue reading

Ein Nachmittag beim TVO

Nicht selten werden wir bei Compass von den Medien angefragt, zu dem einen oder anderen, aktuellen Sicherheitsthema Stellung zu nehmen. Meistens springen da unsere Profis, Ivan Bütler und Walter Sprenger, ein, die schon auf eine beachtliche TV-Erfahrung zurückblicken können. Die Fügung wollte es, das es nun mich traf: Der Ostschweizer Sender “TVO” lud mich als […]

Continue reading