3 ms·

MDN tool that tells you of security gaps in your website

56 points by lilouartz 2y ago

lilouartz 2y ago
Seems like this tool is a bit under the radar, but it was extremely useful in identifying obvious security gaps.
ziggyzecat 2y ago
I was about to look for tools like this one. Please share if you know of others. Thank you.
- 0x073 2y ago
  https://www.ssllabs.com/ssltest/ https://www.ssllabs.com/ssltest/ Not the same, but also very helpful for https/tls
- theandrewbailey 2y ago
  https://securityheaders.com/ https://securityheaders.com/
cqqxo4zV46cp 2y ago
This tool was posted on HN within the last few days.
- snorlaxmorlax 2y ago
  ye, it's been posted several times by different people -— a pattern of discovery.
account42 2y ago
This gives my website a C (50 / 100) because: Content Security Policy (CSP) −25 X-Content-Type-Options −5 X-Frame-Options −20 Yet it's just a simple static website without scripts, cookies or any other dynamic content. If you need to specficy whatever random heades WHATWG comes up with each year for a static site to be secure then the problem is the browser not the website. X-Content-Type-Options is in particular is 100% about browsers ignoring the spec and then making you set another header asking them to please reconsider. Referer is another thing that should be 100% fixed on the browser side instead of each website asking the browser to please not leak information to other websites. Then when you look at the scoring criteria [0] you see it even avards bonus points for setting cookies and using scripts as long as you do it in the currently fashionable way comapared to not using cookies/scripts at all. This is absolutely the wrong way around. [0] https://developer.mozilla.org/en-US/observatory/docs/tests_and_scoring https://developer.mozilla.org/en-US/observatory/docs/tests_a...
rascul 2y ago
They removed features and made the URL worse. Edit: Figured I should point out that the old one had TLS and SSH stuff also, and the URL was https://observatory.mozilla.org https://observatory.mozilla.org.
mediumsmart 2y ago
I got an F for a static site and upgraded it to A+ considering 120 but ultimately settling for a comfortable 110/100 as good as it gets score. Thank you for this. I had no idea
hulitu 2y ago
Seeing Microsoft and security in the same sentence makes me suspicious. /s
cowboylowrez 2y ago
so my website pretty much is "hi" in index.html (two characters) and I got a "D". so to help me understand how to hack this installation, how can I use the websites evaluation to hack into it so I can understand the exploitation of the security holes I have obviously left open? Is there any guidance here?

56 points by lilouartz 2y ago

lilouartz 2y ago

Seems like this tool is a bit under the radar, but it was extremely useful in identifying obvious security gaps.

ziggyzecat 2y ago

I was about to look for tools like this one. Please share if you know of others. Thank you.

0x073 2y ago
https://www.ssllabs.com/ssltest/ https://www.ssllabs.com/ssltest/ Not the same, but also very helpful for https/tls
theandrewbailey 2y ago
https://securityheaders.com/ https://securityheaders.com/

cqqxo4zV46cp 2y ago

This tool was posted on HN within the last few days.

snorlaxmorlax 2y ago
ye, it's been posted several times by different people -— a pattern of discovery.

account42 2y ago

This gives my website a C (50 / 100) because: Content Security Policy (CSP) −25 X-Content-Type-Options −5 X-Frame-Options −20 Yet it's just a simple static website without scripts, cookies or any other dynamic content. If you need to specficy whatever random heades WHATWG comes up with each year for a static site to be secure then the problem is the browser not the website. X-Content-Type-Options is in particular is 100% about browsers ignoring the spec and then making you set another header asking them to please reconsider. Referer is another thing that should be 100% fixed on the browser side instead of each website asking the browser to please not leak information to other websites. Then when you look at the scoring criteria [0] you see it even avards bonus points for setting cookies and using scripts as long as you do it in the currently fashionable way comapared to not using cookies/scripts at all. This is absolutely the wrong way around. [0] https://developer.mozilla.org/en-US/observatory/docs/tests_and_scoring https://developer.mozilla.org/en-US/observatory/docs/tests_a...

rascul 2y ago

They removed features and made the URL worse. Edit: Figured I should point out that the old one had TLS and SSH stuff also, and the URL was https://observatory.mozilla.org https://observatory.mozilla.org.

mediumsmart 2y ago

I got an F for a static site and upgraded it to A+ considering 120 but ultimately settling for a comfortable 110/100 as good as it gets score. Thank you for this. I had no idea

hulitu 2y ago

Seeing Microsoft and security in the same sentence makes me suspicious. /s

cowboylowrez 2y ago

so my website pretty much is "hi" in index.html (two characters) and I got a "D". so to help me understand how to hack this installation, how can I use the websites evaluation to hack into it so I can understand the exploitation of the security holes I have obviously left open? Is there any guidance here?