Boss: Trust and safety

Play this quiz

Quick check

An attacker signs in as a player using that player's stolen password. Which STRIDE threat is that?

  1. Spoofing
  2. Tampering
  3. Denial of service
Show the answer

Spoofing

Spoofing is using "another user's authentication information".

Read the cookie

response
Set-Cookie: sid=41be07;  HttpOnly; SameSite=Strict

Which protection is missing?

  1. Secure: it could be sent without HTTPS
  2. HttpOnly
  3. SameSite
Show the answer

Secure: it could be sent without HTTPS

Secure makes the browser send the cookie only over an encrypted HTTPS connection.

Quick check

A payment key was pushed to a public repo. What comes first?

  1. Revoke the key and replace it
  2. Delete the commit
  3. Wait for an alert
Show the answer

Revoke the key and replace it

Copies may exist already. Revoking makes every copy useless.

Read the range

package.json
"garden-physics": "^2.3.0"

Which version can npm install?

  1. 2.9.1
  2. 3.0.0
  3. 2.2.9
Show the answer

2.9.1

The caret keeps the 2 and allows anything from 2.3.0 up to, but not including, 3.0.0.

Quick check

Credential stuffing uses username and password pairs leaked from other sites.

Show the answer

True

OWASP: "Testing username/password pairs obtained from the breach of another site."

Quick check

In CISA's template, how soon is a researcher's report acknowledged?

  1. Within 3 business days
  2. Within 90 days
  3. Only if a bounty is paid
Show the answer

Within 3 business days

"Within 3 business days, we will acknowledge that your report has been received."

Quick check

What do both the App Store and Google Play require of apps where players share content?

  1. A way to report content and block users
  2. Chat in every game
  3. A bug bounty
Show the answer

A way to report content and block users

Both stores require reporting and blocking for user-generated content.

Do the math

fine
qualifying worldwiderevenue: £100 million

What is the maximum fine under the UK's Online Safety Act?

  1. £18 million
  2. £10 million
  3. £100 million
Show the answer

£18 million

10% is £10 million, but the Act allows up to £18 million or 10%, whichever is greater.