Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Proofreading fixes 0x05d part 3 #2413

Merged
merged 3 commits into from
Jul 29, 2023
Merged

Proofreading fixes 0x05d part 3 #2413

merged 3 commits into from
Jul 29, 2023

Conversation

Laancelot
Copy link
Contributor

Typos, poor English, links

Thank you for submitting a Pull Request to the OWASP MASTG. Please make sure that:

  • Your contribution is written in the 2nd person (e.g. you)
  • Your contribution is written in an active present form for as much as possible.
  • You have made sure that the reference section is up to date (e.g. please add sources you have used, make sure that the references to MITRE/MASVS/etc. are up to date)
  • Your contribution has proper formatted markdown and/or code
  • Any references to website have been formatted as [TEXT](URL “NAME”)
  • You verified/tested the effectiveness of your contribution (e.g.: is the code really an effective remediation? Please verify it works!)

If your PR is related to an issue. Please end your PR test with the following line:
This PR closes #< insert number here >.

Typos, poor English

- Check if the key attestation is totally implemented at the client-side. In such scenario, the same can be easily bypassed by tampering the application, method hooking, etc.
- Check if the key attestation is totally implemented on the client-side. In such scenario, the same can be easily bypassed by tampering the application, method hooking, etc.
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What do you want to say here??
"In such scenario, the same can be easily bypassed by tampering the application, method hooking, etc."

Copy link
Collaborator

@cpholguera cpholguera May 11, 2023

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I agree that this is not clear at all. I would assume that whoever wow this was trying to say something like "it's important to check whether the key attestation is implemented entirely on the client side (i.e., within the application itself), because if it is, then it can be more easily bypassed by attackers". The recommendation would be to implement the server side counterpart as well.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks @cpholguera. Let's have a go at it then.

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Feel free to change it more. Maybe use some text from my comment. I feel the current version is still missing something :/

Laancelot and others added 2 commits May 12, 2023 15:36
As per suggestion, to solve linting issue

Co-authored-by: Carlos Holguera <perezholguera@gmail.com>
For understandability
Copy link
Collaborator

@cpholguera cpholguera left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks @Laancelot and sorry for the delay!

@cpholguera cpholguera merged commit 469baea into OWASP:master Jul 29, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants