Tinfoil Security Blog
tinfoilsecurity.com · Company blog · on HN since 2011
The blog of Tinfoil Security, a hosted web application vulnerability scanning company, with guides on VPNs, Rails exploits and web security.
What HN saysHN links its guide to setting up your own OpenVPN for public WiFi. One commenter says the scanner is good but the company seems inactive.
19HN people shared it
14linked it in comments
69stories submitted
793story points
4 years agolast shared
2011people per year2026
Most-shared posts
- 1Show HN: Tinfoil Security -- Security For Startups. Launching soon7 people · 37 points · first shared 2011 · 8 comments on HN
- 2Show HN: Automatic VPN Generator – Protect Yourself at Sochi and Starbucks6 people · 126 points · first shared 2014 · 70 comments on HN
- 3Don't Get Pwned on Public WiFi: Use Your Own VPN4 people · 168 points · first shared 2013 · 123 comments on HN
- 4Show HN: Check if you're vulnerable to POODLE3 people · 8 points · first shared 2014 · discussion on HN
- 5Use Rails? Check yourself for the YAML exploit2 people · 122 points · first shared 2013 · 56 comments on HN
- 6Storing Your Data Securely: A Primer2 people · 55 points · first shared 2014 · 41 comments on HN
- 7Embedded Content and Iframe Security2 people · 19 points · first shared 2013 · 2 comments on HN
- 8Securing Yourself at DEF CON2 people · 17 points · first shared 2014 · discussion on HN
- 9Multi-Stack Integration Tests with CircleCI2 people · 12 points · first shared 2014 · discussion on HN
- 10One Shellcode To Rule Them All: Cross-Platform Exploitation2 people · 6 points · first shared 2014 · 1 comments on HN
- 11How to Choose a Web Application Scanner: DAST, SAST, RASP, IAST, HASTHoly SaaS2 people · 4 points · first shared 2018 · discussion on HN
- 12Building A Browser Extension? Careful Not To Accidentally XSS the Whole Internet2 people · 4 points · first shared 2013 · 1 comments on HN
- 13Just Behave Already: Property Testing2 people · 3 points · first shared 2018 · discussion on HN
- 14A Quick Guide to the Complex: Ecto.Multi2 people · 2 points · first shared 2018 · discussion on HN
- 15XML External Entity Injection2 people · 2 points · first shared 2015 · discussion on HN
What HN people wrote when they linked it
borski · 2015-07-11
This is something we help with a lot at Tinfoil (https://www.tinfoilsecurity.com). You can read our blog for useful tips and info, but we always recommend actually running our web application scans against your app in order to actually look for vulnerabilities. Is it as good as having 'tptacek or someone else from Matasano looking at it as a human? Not quite, since humans have more ingenuity. Is it better than reading a blog post and trying to follow 'best practices'? Infinitely.
Don't try to do it yourself.
dannysu · 2017-01-08
I follow this guide for setting up OpenVPN: https://www.tinfoilsecurity.com/blog/dont-get-pwned-on-public-wifi-use…
luminousbit · 2016-05-26
Such a product exists: https://www.tinfoilsecurity.com/ . It's pretty good and we pay $199/month. But they have not been active recently and the company may be dying without enough business to support them.
blackdogie · 2013-08-28
There was a post on here yesterday about setting up your own ad hoc system https://www.tinfoilsecurity.com/blog/dont-get-pwned-on-public-wifi-use…
I've also put together a listing of over 90 providers http://www.proxy.ie/blog/ultimate-vpn-list/ you should find one there ! Personally I've used Overplay, HideMyAss & IPVanish all to great success. HideMyAss have an offer until Sunday for $60 for a year's access which is quite good.
bensedat · 2013-06-10
https://www.tinfoilsecurity.com is a hosted automated security tool (Disclaimer: I work for Tinfoil)
diziet · 2013-02-22
Tinfoil Security (https://www.tinfoilsecurity.com/) has automated scanners and seems to keep up to date with all the vulnerabilities quickly, like in case of the rails vulnerability recently.
ainsleyb · 2012-09-26
We've done some tests, and many of our customers would much rather have a basic scan and see the full results of the scan, than only be shown a piece of the scan. It gives off the impression that we're holding their vulnerabilities hostage, and that's definitely not what we hope to do!
The best test to see how we differ from Nessus/Burp is to try it yourself! A lot of the vulnerability classes we scan for are very similar, but the ways in which we scan for them are different. We do offer our Standard Plan for a free 30 day trial. Would love to hear what you think :)
If you have any issues, ping us at http://tinfoilsecurity.com/supportchat
dguido · 2012-09-22
How many times do people need to talk about SQL injection before people writing web apps get it? This isn't news and this isn't hard to completely avoid. Just do it and stop being amazed every time someone puts a tick mark in an URL parameter (or any parameter for that matter).
EDIT: I looked around this detectify website and found this gem: http://blog.detectify.com/post/22258359654/zerg-rush-how-to-influence-…
"326 exploits found"
I have so much faith that this company will do well. If you're interested in others like it that might fair better, you can try WhiteHat Security or Tinfoil Security, both of which do web security scanning as a service.
https://www.whitehatsec.com/
https://www.tinfoilsecurity.com/
henzk · 2012-02-22
i think you meant https://www.tinfoilsecurity.com/
savethefuture · 2018-09-26
The link is broken but this looks like the right one: https://www.tinfoilsecurity.com/blog/How_to_Choose_a_Web_Application_S…
ljoshua · 2017-03-27
I've used https://www.tinfoilsecurity.com/vpn/new several times to quickly set up a new VPN on a DigitalOcean droplet. Takes ~5 minutes.
Lately I had it set one up for me and have just let it run constantly since then. I effectively have my own personal VPN for $5 month.
ShaneWilton · 2015-01-24
At Tinfoil Security we wrote a service for generating disposable VPNs on the fly. It's open source, and I personally made use of it while in China a few weeks ago.
https://www.tinfoilsecurity.com/vpn/new
mattrad · 2014-04-23
Would also be very nice if someone set up an auto-deploy such as the one Tinfoil did for VPNs: https://www.tinfoilsecurity.com/vpn/new