9 ms·

Democratizing Security

49 points by cloudwalking 14y ago

bandhunt 14y ago
congrats guys!
greenwalls 14y ago
Great service! I got stuck at the point where you need to upload an HTML file or do one of the other two options but I understand why it's necessary. I'll get it done when I have some time so I can see the full report.
- varikin 14y ago
  Requiring adding the page or modifying DNS or the home page (adding custom meta tag) is awesome. That way, I can't set them to scan a site I don't control. Security scans can be very invasive and I don't imagine admins want this done unknown to them on their live sites.
cloudwalking 14y ago
Just scanned one of my websites. Pretty quick results, once I got through the signup, email confirmation (why!), and site ownership confirmation. My favorite part? They point out security problems AND give actionable advice on how to fix them. That's useful.
- ZoFreX 14y ago
  Can you give examples of the sort of problems it found?
  - cloudwalking 14y ago
    - Private IP address disclosure (1) - Allowed HTTP methods (1) - Non HTTP-Only Cookies (2) - Insecure Cookies (4) Note: This is a 2-page website. Looks like the cookie problems are a result of the default Heroku 404 page.
    - tptacek 14y ago
      It's good to have a fast check for these things, but you realize how simple that stuff is to spot, right? Insecure cookies and HTTPOnly (which: HTTPOnly is a bit of a band-aid; it's not a vulnerability not to have it) are trivial regexes on set-cookie headers; methods is something you can do with curl and a shell script. If you're spotting these kinds of things only after using a 3rd-party tool, consider whether this is the kind of stuff you want to build into your integration testing.
      - borski 14y ago
        In that vein, we search for a lot more than just these. We're actually working on some tools to help integrate Tinfoil into your integrating testing scheme - more to come on that in the future. :)
        tptacek 14y ago
        Sorry! I know you do (for the benefit of the thread: I've been talking to 'borski for awhile about Tinfoil). I'm not commenting about Tinfoil so much as developers who are surprised to not be using secure cookies. :)
peterwwillis 14y ago
Nit picking: I know the copy isn't written for security geeks, but boasting of "MIT engineers" (mechanical engineers?) and "heavy security experience" doesn't ring of a strong correlation to me. Could you expand on the bios in your "About Tinfoil" page? I don't know if an executive looking at that page would be convinced you're all security experts (and I know this isn't "cool" but slightly more professional profile pictures might help) Other than those points and the name ('tinfoil' doesn't inspire tons of confidence in me, but whatever, it's a name) I like the idea and presentation. Good luck!
- tptacek 14y ago
  It actually reads worse for security geeks, but optimizing your copy for security geeks is usually a very bad plan.
  - varikin 14y ago
    I think having the home page marketed towards is a good plan because most small to medium businesses probably don't have security experts. In addition, having a not to hidden "Nitty Gritty Details" page for the security experts would be a great compromise.
- borski 14y ago
  Great points. We'll definitely put up new photos and bios soon. Thanks for the feedback!
- peterwwillis 14y ago
  (more notes... i signed up for the free account, added my website, it brought me to a page that did nothing. i tried to sign in and it said i needed to confirm my account. okay, a notice would have been nice... i confirm the account and log in, and my website i added initially is not there? ok, i add it... now it's asking for my software stack? that seems slightly unnecessary, but okay, i try to remember what i'm using. now i'm done setting up and verifying and finally scanning.... the picture slideshow is cute, but unnecessary. the manual scan i started is still sitting there... not sure what's going on but it doesn't look like it's doing anything... my e-mail now says a report is ready, though the page never changed. i go check it out. looks nice, fairly easy to browse around. i click on 'All Stats' and a column in the lower middle of the page has vertical text. i don't know about you, but my head doesn't like to tilt 90 degrees to read text... i look at the 'Modules Run' section and i don't see SSL modules, though i added an https:// https:// url. considering the recently popularized SSL exploits i would probably add a module for this. for security geeks like me, having a Knowledge Base of documentation of what your scans look for would be nice for reference)
tptacek 14y ago
There's definitely a gap to fill in the web application security market, especially for startups who want to budget ~1k-5k to security and are simply outbid by established companies (simple, short web projects by good appsec teams start at around $10k). That said: I'm not in love with the messaging here. The push/pull isn't between ineffective, inexpensive tools and ineffective, expensive consultants. Appsec teams are very effective. They just cost too much for startups. My recommendation: stop positioning against security products and services. Nobody in the startup market really uses them and they don't care about their track records. Meanwhile, people in enterprise and large software markets are automatically wary of automated tools (like Appscan and WebInspect on the low end, or Veracode and Fortify on the high end). You have a compelling story just by pitching the value of automated on-demand security testing at that price point. The direct comparison to competing tools just begs questions you don't want to answer. (I've recommended Tinfoil to lots of people and continue to do so. Definitely glad they're finally launching!)
- jenandre 14y ago
  "The direct comparison to competing tools just begs questions you don't want to answer." I agree. Additionally, I'm not sure who would actually subscribe to the paid version of this. Startups generally don't have a plethora of websites for testing. Someone with 250 urls to scan per month is likely going to be asking: what about my other (non-website) assets? Furthermore, if I were the IT person on site for a 250+ website installation I would be asking: what do I get out of this I don't get out of running another free tool such as Nessus (the answer, I'm afraid is going to be "less")? Sure, having to to go through the Nessus install process is kind of a pain (although this realistically represents < 5 minutes of my time); but as soon I saw that I had to add some kind of website verification I stopped there as well.
  - borski 14y ago
    To clarify: it's not 250 unique sites, it's 250 pages per unique site. That is, news.ycombinator.com could have thousands of URLs. With the basic plan, we'd scan the first 250. We offer a lot more than Nessus, in terms of doing a deep-dive on web application security. With that said, Nessus does a better job at network security, for example; this is something we're working on.
munin 14y ago
congrats to Michael and Ainsley! I've known them for a while and they're really smart. should do great!
trotsky 14y ago
git.kernel.org -> 4 security problems -> "borderline unsafe" Hmm.
- borski 14y ago
  Feel free to verify you own git.kernel.org, and you can find out what those vulnerabilities were. :)
deleted 14y ago
[deleted]

49 points by cloudwalking 14y ago

congrats guys!

Great service! I got stuck at the point where you need to upload an HTML file or do one of the other two options but I understand why it's necessary. I'll get it done when I have some time so I can see the full report.

varikin 14y ago
Requiring adding the page or modifying DNS or the home page (adding custom meta tag) is awesome. That way, I can't set them to scan a site I don't control. Security scans can be very invasive and I don't imagine admins want this done unknown to them on their live sites.

cloudwalking 14y ago

Just scanned one of my websites. Pretty quick results, once I got through the signup, email confirmation (why!), and site ownership confirmation. My favorite part? They point out security problems AND give actionable advice on how to fix them. That's useful.

ZoFreX 14y ago
Can you give examples of the sort of problems it found?
- cloudwalking 14y ago
  - Private IP address disclosure (1) - Allowed HTTP methods (1) - Non HTTP-Only Cookies (2) - Insecure Cookies (4) Note: This is a 2-page website. Looks like the cookie problems are a result of the default Heroku 404 page.
  - tptacek 14y ago
    It's good to have a fast check for these things, but you realize how simple that stuff is to spot, right? Insecure cookies and HTTPOnly (which: HTTPOnly is a bit of a band-aid; it's not a vulnerability not to have it) are trivial regexes on set-cookie headers; methods is something you can do with curl and a shell script. If you're spotting these kinds of things only after using a 3rd-party tool, consider whether this is the kind of stuff you want to build into your integration testing.
    - borski 14y ago
      In that vein, we search for a lot more than just these. We're actually working on some tools to help integrate Tinfoil into your integrating testing scheme - more to come on that in the future. :)
      - tptacek 14y ago
        Sorry! I know you do (for the benefit of the thread: I've been talking to 'borski for awhile about Tinfoil). I'm not commenting about Tinfoil so much as developers who are surprised to not be using secure cookies. :)

peterwwillis 14y ago

Nit picking: I know the copy isn't written for security geeks, but boasting of "MIT engineers" (mechanical engineers?) and "heavy security experience" doesn't ring of a strong correlation to me. Could you expand on the bios in your "About Tinfoil" page? I don't know if an executive looking at that page would be convinced you're all security experts (and I know this isn't "cool" but slightly more professional profile pictures might help) Other than those points and the name ('tinfoil' doesn't inspire tons of confidence in me, but whatever, it's a name) I like the idea and presentation. Good luck!

tptacek 14y ago
It actually reads worse for security geeks, but optimizing your copy for security geeks is usually a very bad plan.
- varikin 14y ago
  I think having the home page marketed towards is a good plan because most small to medium businesses probably don't have security experts. In addition, having a not to hidden "Nitty Gritty Details" page for the security experts would be a great compromise.
borski 14y ago
Great points. We'll definitely put up new photos and bios soon. Thanks for the feedback!
peterwwillis 14y ago
(more notes... i signed up for the free account, added my website, it brought me to a page that did nothing. i tried to sign in and it said i needed to confirm my account. okay, a notice would have been nice... i confirm the account and log in, and my website i added initially is not there? ok, i add it... now it's asking for my software stack? that seems slightly unnecessary, but okay, i try to remember what i'm using. now i'm done setting up and verifying and finally scanning.... the picture slideshow is cute, but unnecessary. the manual scan i started is still sitting there... not sure what's going on but it doesn't look like it's doing anything... my e-mail now says a report is ready, though the page never changed. i go check it out. looks nice, fairly easy to browse around. i click on 'All Stats' and a column in the lower middle of the page has vertical text. i don't know about you, but my head doesn't like to tilt 90 degrees to read text... i look at the 'Modules Run' section and i don't see SSL modules, though i added an https:// https:// url. considering the recently popularized SSL exploits i would probably add a module for this. for security geeks like me, having a Knowledge Base of documentation of what your scans look for would be nice for reference)

tptacek 14y ago

There's definitely a gap to fill in the web application security market, especially for startups who want to budget ~1k-5k to security and are simply outbid by established companies (simple, short web projects by good appsec teams start at around $10k). That said: I'm not in love with the messaging here. The push/pull isn't between ineffective, inexpensive tools and ineffective, expensive consultants. Appsec teams are very effective. They just cost too much for startups. My recommendation: stop positioning against security products and services. Nobody in the startup market really uses them and they don't care about their track records. Meanwhile, people in enterprise and large software markets are automatically wary of automated tools (like Appscan and WebInspect on the low end, or Veracode and Fortify on the high end). You have a compelling story just by pitching the value of automated on-demand security testing at that price point. The direct comparison to competing tools just begs questions you don't want to answer. (I've recommended Tinfoil to lots of people and continue to do so. Definitely glad they're finally launching!)

jenandre 14y ago
"The direct comparison to competing tools just begs questions you don't want to answer." I agree. Additionally, I'm not sure who would actually subscribe to the paid version of this. Startups generally don't have a plethora of websites for testing. Someone with 250 urls to scan per month is likely going to be asking: what about my other (non-website) assets? Furthermore, if I were the IT person on site for a 250+ website installation I would be asking: what do I get out of this I don't get out of running another free tool such as Nessus (the answer, I'm afraid is going to be "less")? Sure, having to to go through the Nessus install process is kind of a pain (although this realistically represents < 5 minutes of my time); but as soon I saw that I had to add some kind of website verification I stopped there as well.
- borski 14y ago
  To clarify: it's not 250 unique sites, it's 250 pages per unique site. That is, news.ycombinator.com could have thousands of URLs. With the basic plan, we'd scan the first 250. We offer a lot more than Nessus, in terms of doing a deep-dive on web application security. With that said, Nessus does a better job at network security, for example; this is something we're working on.

munin 14y ago

congrats to Michael and Ainsley! I've known them for a while and they're really smart. should do great!

trotsky 14y ago

git.kernel.org -> 4 security problems -> "borderline unsafe" Hmm.

borski 14y ago
Feel free to verify you own git.kernel.org, and you can find out what those vulnerabilities were. :)

deleted 14y ago

[deleted]