9 sep, 2022
Security should not be so scary!
When the word "security" comes to mind, it's usually in the context of bad news. You
often encounter headlines like "A
big social network leaked login passwords" or "an attacker stole credit card information
from a shopping site".
But security is something to be taken as a positive and necessary part of web
development just like "user experience" or
"accessibility".
What is a security vulnerability?
In software development, when an application does not work the way it is intended to
work, it's called "a bug".
Sometimes a bug displays wrong information or crashes on a certain action. A
vulnerability (sometimes called a security
bug) is a type of bug that could be used for abuse.
Bugs are common in the day to day activities of a developer. Which means,
vulnerabilities are also frequently introduced
into applications. What's important is that you are aware of common vulnerabilities in
order to mitigate them as much as
you can. It is just like minimizing other bugs by following common patterns and
techniques.
Generate a public/private key pair
Let's start by generating a 2,048-bit RSA key pair. A smaller key, such as 1,024 bits, is
insufficiently resistant to
brute-force guessing attacks. A larger key, such as 4,096 bits, is overkill. Over time,
key sizes increase as computer
processing gets cheaper. 2,048 is currently the sweet spot.
The idea of a "sandbox"
Modern web browsers are built on the idea of a "sandbox". A sandbox is a security
mechanism used to run an application
in a restricted environment. Just like the physical sandbox at a playground where kids
can create anything they want
within the boundary without making a mess elsewhere, application code has the freedom to
execute within a restricted
environment. For example, JavaScript can add and modify elements on the page but might
be restricted from accessing an
external JSON file. This is because of a sandbox feature called same-origin
Leave a Reply