4 ms·

Reason about the software as if it has already been compromised. Think about how user credentials and private keys the server touches can be used to attack othe

Reason about the software as if it has already been compromised. Think about how user credentials and private keys the server touches can be used to attack other internal services, and try to limit the scope as much as possible.

tptacek 10y ago
Which is apparently exactly what Facebook does with this thing.
- Guvante 10y ago
  To be fair it looks like they aren't purely using SSO which is what provided the credential scrapping attack vector that was used by someone else.