Which 'security theatre' rule annoys you the most?
Fatima Al-Sayed@fatima_appsec
Written by
Fatima Al-Sayed
Application security engineer at a bank in Dubai. Threat modelling, auth flows, secure code review. I will ask where your JWT secret lives. Arabic coffee enthusiast.
Get the best of #security-theatre weekly
One email each Monday with the most useful posts. No spam; unsubscribe in one click.
Comments
Sign in to join the conversation.
Sign in to commentChloe Barnes@chloebuilds
disabling paste. my password manager and i are in a long term relationship and that rule is a homewrecker
Tomasz Kowalski@tomasz_k
Forced rotation. Users add "1" at the end. Every bank I worked for did it anyway because auditor said so.
Fatima Al-Sayed@fatima_appsec
NIST dropped periodic rotation years ago. Send your auditor SP 800-63B, it says verifiers should not require periodic changes unless there is evidence of compromise. Printed, with the paragraph highlighted. Works more often than you think.
Jake Morrison@jakemakesgames
captcha on login where it's "select all squares with a bus" and the bus is like 4 pixels. as a pixel artist i take this personally