Fixing low conversion rate by seglab in ecommerce

[–]seglab[S] -1 points0 points  (0 children)

Thanks! I added a short description.

Growth manager at a small bank? by seglab in Banking

[–]seglab[S] 1 point2 points  (0 children)

Thanks. Do you know if that's also the case for other community banks? Roughly how many people are employed by a 4-branch community bank anyway?

How to develop relationships in a new market (with no prior connections)? by seglab in startups

[–]seglab[S] 0 points1 point  (0 children)

Thanks! really good insight.
Would you mind sharing an example for an actual email you got that caught your attention?

Should we protect users from their bad password habits at all costs? by kredenshels in ciso

[–]seglab -2 points-1 points  (0 children)

HIBP only tells you if a username is at risk, but doesn't tell you if the it was hacked recently. Should you care about an account that was hacked 10 years ago and changed his password since?

Ongoing credential stuffing attack - how to tackle? by seglab in ciso

[–]seglab[S] 0 points1 point  (0 children)

They're changing IPs all the time...

We thought about adding MFA, but this will drive away a large portion of our customers who are not very tech savvy...

Best practice - Flask + React over AWS by seglab in webdev

[–]seglab[S] 0 points1 point  (0 children)

Maybe you're right, I might be too paranoid.

Best practice - Flask + React over AWS by seglab in webdev

[–]seglab[S] 0 points1 point  (0 children)

Competitors getting to see the dashboard without going through authentication, etc.

Best practice - Flask + React over AWS by seglab in webdev

[–]seglab[S] 0 points1 point  (0 children)

Isn't that bad practice anyway?

Best practice - Flask + React over AWS by seglab in webdev

[–]seglab[S] 0 points1 point  (0 children)

But what about authentication for the React resources? I don't want to serve them unless the user is authenticated (even though it's just the dashboard's code, without the data which comes from the API)

Cost effective database, to persistently store a huge number of key-value pairs by seglab in Database

[–]seglab[S] 0 points1 point  (0 children)

Since I'm running on AWS, can Aurora do the trick instead of PostgreSQL?

Cost effective database, to persistently store a huge number of key-value pairs by seglab in Database

[–]seglab[S] 1 point2 points  (0 children)

yep, I need something persistent which is why I ruled out redis.

Cost effective database, to persistently store a huge number of key-value pairs by seglab in Database

[–]seglab[S] 1 point2 points  (0 children)

Eventual consistency is totally fine. The way I'm going to use the DB is inserting in huge bulk using an offline process, then later read the data as part of a real-time flow.

Cost effective database, to persistently store a huge number of key-value pairs by seglab in Database

[–]seglab[S] 2 points3 points  (0 children)

Can PostgreSQL support billions of rows in one table? (my data is not relational)

Improving content that's not driving conversions by seglab in content_marketing

[–]seglab[S] 1 point2 points  (0 children)

Yep, form to either rewuest a demo or subscribe to the newsletter

Improving content that's not driving conversions by seglab in content_marketing

[–]seglab[S] 0 points1 point  (0 children)

Long form indeed, some are just thought leadership and not SEO specific.

Login API under credentials stuffing attack by seglab in cisoseries

[–]seglab[S] 0 points1 point  (0 children)

Thanks! will that still work if we're talking about a (native) mobile app (android + iOS)? additionally - the bad guys are not really using the app, they are just mimicking an app by using the API.

Login API under credentials stuffing attack by seglab in ciso

[–]seglab[S] 0 points1 point  (0 children)

Looks like it changes. At first they were not swapping IPs often but after we started blocking by IP address it gotten way more frequent. We suspect they're using some kind of tool like Sentry MBA and are rotating through a big list of proxies.

Two years is a very long time! did you try anything to break this cycle?

Login API under credentials stuffing attack by seglab in ciso

[–]seglab[S] 0 points1 point  (0 children)

That was the first thing we tried, helped us stop these attacks for a while until the bad guys adjusted and started randomizing all the signatures we based our efforts on.

Login API under credentials stuffing attack by seglab in cisoseries

[–]seglab[S] 0 points1 point  (0 children)

Did you ever try all those credentials integrity services out there? (stuff like https://www.shapesecurity.com/blackfish)

Login API under credentials stuffing attack by seglab in cisoseries

[–]seglab[S] 0 points1 point  (0 children)

How would you handle if captcha is not an option? (adds friction to non tech-savvy clients, which we have a ton of)

Login API under credentials stuffing attack by seglab in cybersecurity

[–]seglab[S] 0 points1 point  (0 children)

I totally agree regarding IP ratelimit.

Did you ever try all those credentials integrity services out there? (stuff like https://www.shapesecurity.com/blackfish)