Passbolt Keynote
summary
Passbolt is an open-source team password manager running on CakePHP and deployable to AWS/DigitalOcean; the talk lists concrete failures and fixes: DNS typo brought down services after an N→M mistake on a Friday, used non-crypto RNG like Math.random/Rand causing weak entropy in crypto, and JWT alg/config merge allowed HMAC bypass (caught by a researcher before public exploit). Other specifics: unescaped regex dot let the browser extension inject on attacker domains, nginx webroot misconfig and a charset/index change caused a minutes-long SQL slowdown, Selenium tests prove brittle.
AI-written summary · about
chapters (11)
- 0:00Start
- 5:12URL confusion
- 9:41JWT key confusion
- 15:41SQL Optimization
- 18:47Default php-fpm config
- 19:58Multi records operations
- 21:50Fat bottomed controllers
- 26:00Remapping exceptions
- 29:34Testing everything with selenium
- 36:30Security remains largely unexplained
- 37:54Learned helplessness
related talks
01h 06mPassbolt Keynote
36mPassbolt's Bread and Butter
53mOpening Keynote – Dr. Katie Paxton-Fear
47mEsoteric Web Application Vulnerabilities
24mThe Emperor’s New Password Manager
59mDon't Get Burned! Secure Coding Essentials to Protect Your Application
40m"It Me": Under the Hood of Web Authentication
01h 05mClosing Keynote