There is one error I cannot find. Otherwise it is fine.wise it seems fine. #1402

thornshadow99 · 2024-05-11T21:12:36Z

Thank you for submitting a Pull Request (PR) to the Cheat Sheet Series.

🚩 If your PR is related to grammar/typo mistakes, please double-check the file for other mistakes in order to fix all the issues in the current cheat sheet.

Please make sure that for your contribution:

In case of a new Cheat Sheet, you have used the Cheat Sheet template.
All the markdown files do not raise any validation policy violation, see the policy.
All the markdown files follow these format rules.
All your assets are stored in the assets folder.
All the images used are in the PNG format.
Any references to websites have been formatted as [TEXT](URL)
You verified/tested the effectiveness of your contribution (e.g., the defensive code proposed is really an effective remediation? Please verify it works!).
The CI build of your PR pass, see the build status here.

If your PR is related to an issue, please finish your PR text with the following line:

This PR covers issue #.

Thank you again for your contribution 😃

jmanico · 2024-05-11T22:45:38Z

cheatsheets/Transaction_Authorization_Cheat_Sheet.md

+Generally, mobile and online applications will require users a second factor to check whether they are authorized to perform a sensitive operation (such as wire transfer authorization). In this document, we say that this action is called *transaction authorization*.



This sentence is missing something. "Will require users to use.." perhaps?

jmanico · 2024-05-11T22:46:30Z

cheatsheets/Transaction_Authorization_Cheat_Sheet.md


-For the purpose of this document we will call that process: *transaction authorization*.
+Transaction authorization is typically used in financial systems, but the need for secure transactions has driven its adoption across the internet.  For example, an email that allows users to unlock a user account by providing them with a secret code or a link that has a token contains a transaction authorization. A transaction authorization can be implemented with methods such as:


The "for example" sentence looks run-on. Can you review?

jmanico · 2024-05-11T22:47:16Z

cheatsheets/Transaction_Authorization_Cheat_Sheet.md

+- A OTP sent by SMS or provided by phone
+- A digital signature provided by a smart card or a smartphone,
+- A challenge-response token, including unconnected card readers or solutions which scan transaction data from the user's computer screen.


Some of these end with a comma, some do not

jmanico · 2024-05-11T22:47:43Z

cheatsheets/Transaction_Authorization_Cheat_Sheet.md

-Some of these can be implemented on a physical device or in a mobile application.
-
-Transaction authorization is implemented in order to protect for unauthorized wire transfers as a result of attacks using malware, phishing, password or session hijacking, CSRF, XSS, etc.. Unfortunately, as with any piece of code, this protection can be improperly implemented and as a result it might be possible to bypass this safeguard.
+Most often, transaction authorizations are used to prevent for unauthorized wire transfers, but unfortunately, this protection can be improperly implemented and at might be possible to bypass this safeguard.


"For unauthorized wire" looks off.

jmanico · 2024-05-11T22:48:39Z

cheatsheets/Transaction_Authorization_Cheat_Sheet.md

-For example when an SMS message is used to send significant transaction data, it is possible to send the target account, amount and type of transfer. However, for an unconnected [CAP reader](https://en.wikipedia.org/wiki/Chip_Authentication_Program) it is perceived to be inconvenient for a user to enter these data. In such cases, entering only the most significant transaction data (e.g. partial target account number and amount) can be considered sufficient.
-
-In general, significant transaction data should always be presented as an inherent part of the transaction authorization process. Whereas the user experience should be designed to encourage users to verify the transaction data.
+For example, if an SMS message is used to confirm significant transaction data, the developer could respond by returning the target account, amount and type of transfer to the user. However, for an unconnected [CAP reader](https://en.wikipedia.org/wiki/Chip_Authentication_Program) it is inconvenient for a user to enter these data. In such cases, the developer should probably returm the minimium amount of significant transaction data (e.g. partial target account number and amount) for confirmation.


jmanico · 2024-05-11T22:49:56Z

I see a lot of small errors, can you give you edits a review one more time?

thornshadow99 · 2024-05-11T22:51:09Z

Sure. I’ll go back and take a look.

…

On Sat, May 11, 2024 at 6:50 PM Jim Manico ***@***.***> wrote: I see a lot of small errors, can you give you edits a review one more time? — Reply to this email directly, view it on GitHub <#1402 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/BDMXOUKMOJOMRHB2NRNPD2LZB2OCVAVCNFSM6AAAAABHSG2PQSVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDCMBWGA2TAMBXGA> . You are receiving this because you authored the thread.Message ID: ***@***.***>

thornshadow99 · 2024-05-11T22:54:40Z

I’ll be more careful in the future. On Sat, May 11, 2024 at 6:50 PM Robert Thornton ***@***.***> wrote:

…

Sure. I’ll go back and take a look. On Sat, May 11, 2024 at 6:50 PM Jim Manico ***@***.***> wrote: > I see a lot of small errors, can you give you edits a review one more > time? > > — > Reply to this email directly, view it on GitHub > <#1402 (comment)>, > or unsubscribe > <https://github.com/notifications/unsubscribe-auth/BDMXOUKMOJOMRHB2NRNPD2LZB2OCVAVCNFSM6AAAAABHSG2PQSVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDCMBWGA2TAMBXGA> > . > You are receiving this because you authored the thread.Message ID: > ***@***.***> >

szh · 2024-05-13T13:14:03Z

cheatsheets/Transaction_Authorization_Cheat_Sheet.md

@@ -2,111 +2,107 @@

 ## Purpose and audience

-The Purpose of this cheat sheet is to provide guidelines on how to securely implement transaction authorization to protect it from being bypassed. These guidelines can be used by:
+This cheat sheet discusses how developers can secure transaction authorizations and prevent them from being bypassed  These guidelines are for:


Missing period:

Suggested change

This cheat sheet discusses how developers can secure transaction authorizations and prevent them from being bypassed These guidelines are for:

This cheat sheet discusses how developers can secure transaction authorizations and prevent them from being bypassed. These guidelines are for:

jmanico · 2024-05-13T18:18:41Z

Can I assume we can delete this branch I assume the other change we committed is the live one and this is legacy?

Mistake

thornshadow99 · 2024-05-13T18:20:46Z

Yes, it is. Thanks. My git journey is still alive. :)

…

On Mon, May 13, 2024 at 2:19 PM Jim Manico ***@***.***> wrote: Can I assume we can delete this branch I assume the other change we committed is the live one and this is legacy? — Reply to this email directly, view it on GitHub <#1402 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/BDMXOUI5A4QQV26RYNBYXGDZCD7ZPAVCNFSM6AAAAABHSG2PQSVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDCMBYGUYTIMRYHA> . You are receiving this because you authored the thread.Message ID: ***@***.***>

jmanico · 2024-05-13T18:22:35Z

So it is ok to delete it? :) Just double checking before I do.

thornshadow99 · 2024-05-13T19:46:01Z

Yes.Sent from my iPhoneOn May 13, 2024, at 2:22 PM, Jim Manico ***@***.***> wrote: So it is ok to delete it? :) Just double checking before I do. —Reply to this email directly, view it on GitHub, or unsubscribe.You are receiving this because you authored the thread.Message ID: ***@***.***>

kwwall · 2024-05-19T15:38:09Z

@jmanico - Usually after you do a merge, GitHub itself will tell you / ask you, if you want to delete the branch. It only does that when it thinks it's safe to do so.

…

On Mon, May 13, 2024 at 2:23 PM Jim Manico ***@***.***> wrote: So it is ok to delete it? :) Just double checking before I do. — Reply to this email directly, view it on GitHub <#1402 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAO6PGZNX6BYCC6KC3L2RGDZCEAIVAVCNFSM6AAAAABHSG2PQSVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDCMBYGUZDCNRQHA> . You are receiving this because you are subscribed to this thread.Message ID: ***@***.***>

-- Blog: https://off-the-wall-security.blogspot.com/ | GitHub: @kwwall | OWASP ESAPI Project co-lead NSA: All your crypto bit are belong to us.

There is one error I cannot find.

f23124c

thornshadow99 requested review from mackowski, jmanico and szh as code owners May 11, 2024 21:12

I fixed the one error. It should be fine now.

30ef5c3

jmanico reviewed May 11, 2024

View reviewed changes

thornshadow99 marked this pull request as draft May 12, 2024 00:21

szh reviewed May 13, 2024

View reviewed changes

jmanico previously approved these changes May 13, 2024

View reviewed changes

jmanico closed this May 13, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

There is one error I cannot find. Otherwise it is fine.wise it seems fine. #1402

There is one error I cannot find. Otherwise it is fine.wise it seems fine. #1402

thornshadow99 commented May 11, 2024

jmanico May 11, 2024

jmanico May 11, 2024

jmanico May 11, 2024

jmanico May 11, 2024

jmanico May 11, 2024

jmanico commented May 11, 2024

thornshadow99 commented May 11, 2024 via email

thornshadow99 commented May 11, 2024 via email

szh May 13, 2024

jmanico commented May 13, 2024

thornshadow99 commented May 13, 2024 via email

jmanico commented May 13, 2024

thornshadow99 commented May 13, 2024 via email

kwwall commented May 19, 2024 via email

		Generally, mobile and online applications will require users a second factor to check whether they are authorized to perform a sensitive operation (such as wire transfer authorization). In this document, we say that this action is called transaction authorization.


		For the purpose of this document we will call that process: transaction authorization.
		Transaction authorization is typically used in financial systems, but the need for secure transactions has driven its adoption across the internet. For example, an email that allows users to unlock a user account by providing them with a secret code or a link that has a token contains a transaction authorization. A transaction authorization can be implemented with methods such as:

	This cheat sheet discusses how developers can secure transaction authorizations and prevent them from being bypassed These guidelines are for:
	This cheat sheet discusses how developers can secure transaction authorizations and prevent them from being bypassed. These guidelines are for:

There is one error I cannot find. Otherwise it is fine.wise it seems fine. #1402

There is one error I cannot find. Otherwise it is fine.wise it seems fine. #1402

Conversation

thornshadow99 commented May 11, 2024

jmanico May 11, 2024

Choose a reason for hiding this comment

jmanico May 11, 2024

Choose a reason for hiding this comment

jmanico May 11, 2024

Choose a reason for hiding this comment

jmanico May 11, 2024

Choose a reason for hiding this comment

jmanico May 11, 2024

Choose a reason for hiding this comment

jmanico commented May 11, 2024

thornshadow99 commented May 11, 2024 via email

thornshadow99 commented May 11, 2024 via email

szh May 13, 2024

Choose a reason for hiding this comment

jmanico commented May 13, 2024

thornshadow99 commented May 13, 2024 via email

jmanico commented May 13, 2024

thornshadow99 commented May 13, 2024 via email

kwwall commented May 19, 2024 via email