Tag Archives: cookies

Why NASA Should Bake Cookies in Space

Posted on by

Those hotel chocolate-chip cookies will be the closest astronauts have come to truly baking something in their high-flying kitchens. NASA says astronauts won’t actually eat the cookies, because they are, technically, a science experiment. The treats will be returned home for examination.

Source: Why NASA Should Bake Cookies in Space – The Atlantic

NanoRacks created a cylinder-shaped oven lined with heating components that can bring the interior temperature to 350 degrees Fahrenheit. It bakes one slab of cookie dough, which is held in place inside a sealed tray, at a time. The oven will plug into an apparatus about the size of carry-on luggage that supports scientific experiments with electricity, cooling, and other needs.

CSRF Still Armed And Dangerous

Posted on by

Designed to exploit the domain cookie trust model, CSRF attacks essentially take advantage of the trust the Web application has in its authenticated users, says Subu Ramanathan, principal consultant with Security Compass.

“In order to execute this attack, a user would have to navigate to a malicious website while logged into the victim Web application,” says Ramanathan. “The malicious website, being designed to attack users of the victim application, would make [requests] to complete sensitive transactions on the victim application on behalf of the user behind the scenes.”

via CSRF Still Armed And Dangerous — Dark Reading.

Content hosting for the modern web

Posted on by

In our applications, we take a risk-based approach. Generally speaking, we tend to use three strategies:

  • In higher risk situations (e.g. documents with elevated risk of URL disclosure), we may couple the URL token scheme with short-lived, document-specific cookies issued for specific subdomains of googleusercontent.com. This mechanism, known within Google as FileComp, relies on a range of attack mitigation strategies that are too disruptive for Google applications at large, but work well in this highly constrained use case.
  • In cases where the risk of leaks is limited but responsive access controls are preferable (e.g., embedded images), we may issue URLs bound to a specific user, or ones that expire quickly.
  • In low-risk scenarios, where usability requirements necessitate a more balanced approach, we may opt for globally valid, longer-lived URLs.

via Google Online Security Blog: Content hosting for the modern web.