NodeJS URL Shortener

Recently I wrote an article on Ghost blog integration with a URL shortener (the dirty way). This is in sequence to it but with custom URL shortener running on my own machine. While most of this code is shared from codebyte article, I have enhanced it to serve two purposes, Authenticate using API Key Validate URL(s) or ID(s) for duplicate Response support in JSON or TXT format At present the setup is running...

Ghost Blog and custom URL Shortening

It's been 2 years and Ghost Blogging Platform is doing well and the downloads are going up. Kudos to the team. While the platform is doing good, we are miles from reaching the point where we have apps, plugins and smooth migrations/ customisation etc. And in this blog I would mention one such thing which I personally like - URL Shortener(s); specially when we share the links over social media. I have had discussions...

Lessons from LinkedIn DB Breach

We are aware that social networking site LinkedIn was breached in June, 2012 and nearly 6 million user credentials were stolen. In May 2016 it's confirmed that nearly 115+ million credentials were stolen, and are now available for sale. So, it's time we revisit what went wrong, and what can we learn from it. First and foremost, there were vulnerabilities (or at-least one) in the web-application and the way it queries the DB was not...

You aid spammers! LION vs. Sheep

It’s 21st century, the year 2014 and we are still on ground zero talking about spam emails and attacks like spear phishing. No matter how stringent your controls are, how much you have invest in your "defense in depth" approach, a single human being of your firm clicking a link on an unsolicited email can crumble your empire. This is not at all melodramatic as it sounds. It is for real, is scary and...

Employer’s Social Media Policy

While the topic may sound too dramatic, but this may soon shape into a legal IP rights (ref: Intellectual Property) issue in coming times. Over the last few years, there has been a constant change in the firm’s outlook about our personal cyber life. Some firms I know have been very aggressive in putting a strict policy upfront, at the time of joining. We are pushing our social IQ, and increasingly becoming more vocal...

Old Cookies Die Hard

HTTP Cookies have always been an important part of authentication, and session management. But, ever since the session management grew complex, its correlation with security has gone for a toss. Developers pay a lot of attention on keeping the session(s) valid, and more so valid even after a successful logout. Now, this accounts to a session management vulnerability. I understand that the delivery of the cookies, or the session variables have been locked with...

LinkedIn Vulnerability

LinkedIn is a business-oriented social networking site. Founded in December 2002 and launched in May 2003, it is mainly used for professional networking. As of 22 March 2011, LinkedIn reports more than 100 million registered users, spanning more than 200 countries and territories worldwide. There exists multiple vulnerabilities in LinkedIn in which it handles the cookies and transmits them over SSL. This vulnerability if exploited, can result in hijacking of user accounts, and/or modifying...