Securing your App and the History of Guerilla Warfare
summary
A financial‑services perspective argues for concrete defenses: treat identity and bank details as essential patterns to block (no payout without verified SSN/bank), log everything and build metadata fingerprints of bots, detect account takeover by sudden password/email/IP shifts and abnormal transaction sizes, train classifiers on those signals, and use bug‑bounty platforms like HackerOne and Bugcrowd to outsource vulnerability discovery. Practical claim: heavy logging plus pattern blocking and classifiers materially reduces mass credential‑stuffing losses.
AI-written summary · about
chapters (30)
- 0:00Introduction
- 0:33About Scott
- 1:00Membership
- 1:25Conference Call
- 1:53Agenda
- 2:39First Guerilla Fighters
- 3:30chungmu
- 3:55shunyou
- 4:10mountain barbarians
- 4:50He Quin
- 6:50Why
- 7:10Raiders
- 8:25What are they doing to you
- 9:30How do you know
- 9:44How to start
- 10:17Essential patterns
- 11:38Nonessential patterns
- 12:05Im attacks
- 12:48Im attack example
- 13:10Why is this such a hard problem
- 13:36Passwords
- 14:32Recording
- 15:43Example Twitter
- 15:54Likely Strategy
- 16:29Weak Method
- 17:16Advanced Patterns
- 17:41What do we learn
- 18:04Hacker One and Bugcrowd
- 18:46Rails Security Guide
- 19:20You are Sherlock Holmes
related talks
15mProtect your apps from digital attacks w/ a modern defense strategy
26mIntegrating Identity and Fraud
40mWeb Attacks and Fraud: Lessons Learned from the Deep End of the Pool
41m📙 The Great Credential Caper: How to Perform and then Defend Against the (Nearly Impossible) to Defend 🏗️
31mLog In Through the Front Door: Automating Defense Against...
52mPhilosophizing Security In A "Mobile-First" World
12mSpeed, scale & stealth: Securing against ATO events
52mKnock Knock: Understanding Who is Using Your Web Applications