{"componentChunkName":"component---src-templates-blog-list-template-js","path":"/110","result":{"data":{"allMarkdownRemark":{"edges":[{"node":{"excerpt":"Application Security is one of the primary concerns for a software developer. People trust your application and share sensitive or personal…","fields":{"slug":"/engineering/password-security-best-practices-compliance/"},"html":"

Application Security is one of the primary concerns for a software developer. People trust your application and share sensitive or personal information. As a software developer, you need to take care of your application user information security. Authentication and authorization both play critical roles in application security. They confirm the identity of the user and grant access to your website or application.

\n

The process in which confirm the user's identity and provides access to sensitive information is called authentication. Generally, authentication is done through the email/username/password. Authentication using the password is the older and common way, so passwords are a critical component of user's identity security. Password policy is the front line of defense to protect user identity. However, weak passwords may violate compliance standards. A simple or common password could be reversed engineered back to plaintext and sold on the dark web, or result in a costly data breach if compromised.

\n

Why We needed Password Policy & Compliance

\n

Password policies and compliance are rules and methods that enforce the user for using a secure and robust password. A billion credentials were stolen last year from multiple data breaches. According to Verizon's Data Breach Report, 81% of data breaches are caused by compromised, weak, and reused passwords. According to National Cyber Security Centre (NCSC) recent analysis, millions of peoples are using easy to guess passwords like 123456. Recently a security researcher claimed he hacked President Trump's tweeter account by guessing his password maga2020! so now we can understand the need for Password Policy & Compliance. You can check the top worst passwords list here.

\n

1. Minimum Password Age policy

\n

The Minimum password age policy is to decide how many days minimum users must keep a password before changing it. This password policy.

\n

2. Enforce Password History policy

\n

The \"Enforce password history\" policy is used to make sure the number of unique passwords a user must set before reusing an old password. This is an important policy because password reuse is a common issue – the user feels more comfortable with the old passwords. Using the same password for a long duration for a particular account, it will create a strong chance for the password compromised in some way, such as in a brute force attack. Password age policy shouldn't be efficient until the password history policy. Users must change their password, but they can reuse an old password; the effectiveness of a password age policy is greatly reduced.

\n

3. Minimum Password Length policy

\n

The Minimum Password Length policy decides the minimum number of characters needed to create a password. Minimum Password Length should be at least eight characters or more. Longer passwords are generally more secure and harder to crack than short ones. For even greater security, you could set the minimum password length to 14 characters.

\n

4. Passwords Must Meet Complexity Requirements policy

\n

The Passwords Complexity Requirements policy make sure user shouldn't use basic passwords. Passwords should be a combination of uppercase, lowercase, and numbers also include some special characters. We can set the following policies in the password Complexity Requirements.

\n\n

5. Common Password Protection

\n

The users shouldn't use the common passwords, so Restrict the use of common passwords. You can refer to this document for a common password list maintained by LoginRadius and this list is dynamic, and it gets updated from time to time.

\n

6. Dictionary Password Prevention

\n

A Password dictionary is a file that contains a list of potential passwords. This feature prevents your user's from setting a password available in the dynamic password dictionary. We are using this dynamic Password Dictionary in the LoginRadius to prevent the use of dictionary passwords.

\n

7. Password Audit policy

\n

Enabling the Password Audit policy allows you to track all password changes. By monitoring the modifications that are made, it is easier to track potential security problems. This helps to ensure user accountability and provides evidence in the event of a security breach.

\n

Password Compliance

\n

Password compliance is a set of rules to enhance user's data security by encouraging users to use strong passwords and use them properly.

\n

1. FDA (U.S. Food and Drug Administration)

\n

The FDA regulates the set of rules for the food, drugs, biologics, medical devices, electronic products, cosmetics, veterinary products, and tobacco products Industries.

\n

Passwords for FDA Industry Systems accounts must meet ALL of the following requirements:

\n\n

2. HIPAA (Health Insurance Portability and Accountability Act)

\n

The Health Insurance Portability and Accountability Act (HIPAA) enforce a set of rules for sensitive patient data protection. Companies that deal with protected health information (PHI) must ensure HIPAA compliance.

\n\n

3. PCI DSS (Payment Card Industry Data Security Standard)

\n

PCI is the set of rules or guidelines for the businesses that are dealing with payment card data.

\n\n

4. NIST (National Institute for Standards and Technology)

\n

NIST creates a set of rules or guidelines for the businesses that are providing services to the federal government. These guidelines to help federal agencies meet the requirements of the FISMA; however, other organizations reference NIST for strong security standards.

\n\n

Summary

\n

I have explained why we needed a strong password policy & compliance. It doesn't matter how strong a password you are using, but bad guys are using new methods or technologies for exposing the user data.\nMost of the data breaches are happing because of Common or weak passwords. MFA, passwordless, or one-time password are providing additional security for a user account.

\n

Source

\n

https://www.fda.gov/food/online-registration-food-facilities/random-password-generator-fda-industry-systems

\n

https://uwm.edu/hipaa/security-guidelines/#password

\n

https://pcipolicyportal.com/blog/pci-compliance-password-requirements-best-practices-know/

\n

https://spycloud.com/new-nist-guidelines/

\n","frontmatter":{"date":"November 12, 2020","updated_date":null,"description":null,"title":"Password Security Best Practices & Compliance","tags":["Security","Password","Compliance","Passowrd Policy"],"pinned":null,"coverImage":{"childImageSharp":{"fluid":{"aspectRatio":1.5037593984962405,"src":"/static/f1b48d682872b6c2f7aee16ea458d6ad/14b42/password-security.jpg","srcSet":"/static/f1b48d682872b6c2f7aee16ea458d6ad/f836f/password-security.jpg 200w,\n/static/f1b48d682872b6c2f7aee16ea458d6ad/2244e/password-security.jpg 400w,\n/static/f1b48d682872b6c2f7aee16ea458d6ad/14b42/password-security.jpg 800w,\n/static/f1b48d682872b6c2f7aee16ea458d6ad/47498/password-security.jpg 1200w,\n/static/f1b48d682872b6c2f7aee16ea458d6ad/ec6c5/password-security.jpg 1280w","sizes":"(max-width: 800px) 100vw, 800px"}}},"author":{"id":"Vijay Singh Shekhawat","github":"code-vj","avatar":null}}}},{"node":{"excerpt":"Planning to work out some identity management best practices for 2021?  2020 has not been a good year in the history of cybersecurity and…","fields":{"slug":"/identity/identity-access-management-best-practices/"},"html":"

Planning to work out some identity management best practices for 2021? 

\n

2020 has not been a good year in the history of cybersecurity and identity management. With the pandemic forcing many organizations to shift their workforce to remote environments abruptly, security and business continuity concerns hit real hard for the majority of IT stakeholders. 

\n

Not surprisingly though, external threat actors sought COVID-19 as the perfect opportunity to facilitate large-scale cyber attacks. Speaking of figures, cyber insurance and security company, Coalition observed a 47% increase in the severity of ransomware attacks and a whopping 100% increase in the count from 2019 to Q1 2020.

\n

The dust is still settling. With compromised credentials remaining a key component in most cyberattacks, it is time for business leaders to reevaluate their identity and access management best practices for 2021 and start executing. 

\n

Some Current Global Cybersecurity Challenges That Corporates Face

\n\n

\n \n

\n

The former could be a key or a security pass. While the later means biometrics, for example, retina scans, fingerprints, or voice recognition that your consumers have inherited. 

\n

MFA ensures that even if one layer is compromised, the hacker still has to break in another layer of security to access your system. 

\n

\n \n \n

\n

3. Avoid privileged accounts

\n

The Principle of Least Privilege (also known as The Principle of Least Authority) applies to the practice of assigning minimum levels of access – or permissions to a consumer that is essential to accomplish their roles and corresponding duties. 

\n

Though privileged accounts are necessary for some tasks, it should not be followed as an everyday practice. Because if a data breach happens to such accounts, the result may be catastrophic. 

\n

An efficient way to reduce the possibility of internal and external data breaches is through role-based access control (RBAC) or the restriction of non-essential access to sensitive information. 

\n

You can apply this identity and access management best practice by offering access to a consumer for a specific timeframe (for example, 30 minutes) and then automatically revoking access. Micromanaging access in this way can improve the overall cybersecurity quotient. 

\n

4. Enforce a strong password policy

\n

Strong passwords have always been one of the pillars of an impactful IAM strategy. The best ones should be easy to remember and hard to guess. Here are a few best practices for password creation recommended by NIST.

\n\n

5. Self-serve onboarding procedures

\n

Self-serve onboarding is enabling your consumers to onboard themselves. The onboarding journey often starts with a registration page. Your job is to drive your consumers past the registration page and then onto activation. It also, ultimately, helps you retain them.

\n

The more you can adapt your approach to their needs, the easier it will be to win loyal consumers. A few other areas you can successfully deliver include passwordless login, password reset, profile management, consent management, and preference management. 

\n

6. Adhere to regulatory compliances

\n

Another identity and access management best practice are to roll out data security policies and procedures wherever possible and practically. Ensure that you adhere to global regulatory compliances like the General Data Protection Regulation (GDPR), California Consumer Privacy Act (CCPA), and other security standards like Health Insurance Portability and Accountability Act (HIPAA).

\n

Consumers worry about the safety of their data the most. Adherence to regulatory enforcement reaffirms that their data is safe and in trustworthy hands. 

\n

7. Go passwordless

\n

As the name suggests, passwordless login is the method of authenticating consumers without the need to enter a password. The benefits of going passwordless are many— it improves overall consumer experience as consumers no longer need to memorize any credential, saves time and productivity, more robust security against attacks like phishing, credential stuffing, and brute force, and greater ease of access.

\n

Passwordless login can be implemented through different approaches. A few of the common ones include:

\n\n

8. Conduct routine audits

\n

There may be times when you provide access to someone; it stays in the same condition even if the access isn't required anymore. Anyone with malicious intent can access this data and conduct a breach.

\n

Therefore, it is always safe to opt for routine access audits. You can review the given accesses and check if those accesses are still required. When a consumer needs additional access or wants to revoke access, you can take care of such requests accordingly in a timely fashion. 

\n

9. Choose LoginRadius as an ideal IAM provider

\n

Data is powerful, so it must be available to only the right people. One of the key tools you can use to ensure corporate cybersecurity is identity and access management. There are several IAM providers in the market, but how do you know which is your organization's best solution? 

\n

LoginRadius offers just the right framework (including the ones mentioned above) to go beyond consumer expectations—which is all that matters. 

\n

As an ideal CIAM solution, LoginRadius is scalable and easy to deploy. It offers advanced MFA solutions, third-party vendor management using federated SSO protocols, zero-trust security architecture, and robust access management so that consumer workflow is duly specified and streamlined. 

\n

Conclusion 

\n

Enforcing identity and access management best practices require that you understand who can access your sensitive data and under what circumstances they can access it. 

\n

You also need a comprehensive overview of your organization’s IT infrastructure so you can monitor all your elements for potential and existing threats. Staying updated on the latest industry trends will help you improve your current IAM environment.

\n

\n \n \n

\n","frontmatter":{"date":"November 11, 2020","updated_date":null,"description":"Enforcing best practices for identity and access management allows you to know who can access the confidential data and under what conditions they can access it. You will need a detailed overview of the IT infrastructure of your company so that you can track all of your components for future and current threats.","title":"9 Identity and Access Management Best Practices for 2021","tags":["identity management","ciam solution","cx"],"pinned":null,"coverImage":{"childImageSharp":{"fluid":{"aspectRatio":1.408450704225352,"src":"/static/8465ff75a5db0b4e2ef8b5423fe2d6e7/9a31d/Identity-and-Access-Management-Best-Practices.jpg","srcSet":"/static/8465ff75a5db0b4e2ef8b5423fe2d6e7/f836f/Identity-and-Access-Management-Best-Practices.jpg 200w,\n/static/8465ff75a5db0b4e2ef8b5423fe2d6e7/2244e/Identity-and-Access-Management-Best-Practices.jpg 400w,\n/static/8465ff75a5db0b4e2ef8b5423fe2d6e7/9a31d/Identity-and-Access-Management-Best-Practices.jpg 767w","sizes":"(max-width: 767px) 100vw, 767px"}}},"author":{"id":"Rakesh Soni","github":"oyesoni","avatar":"rakesh-soni.jpg"}}}},{"node":{"excerpt":"What is PGP? PGP (Pretty Good Privacy) is a cryptographic process used to encrypt and decrypt information. It combines concepts from…","fields":{"slug":"/engineering/using-pgp-encryption-with-nodejs/"},"html":"

What is PGP?

\n

PGP (Pretty Good Privacy) is a cryptographic process used to encrypt and decrypt information. It combines concepts from symmetric and asymmetric key encryption, maintaining some of the best security and usability aspects of both.

\n

One way PGP can be used is to protect the confidentiality of information. Once the information is encrypted, nobody will be able to decrypt it unless they have the right key. In practice, PGP is commonly used in sending and receiving emails, sharing information on the Dark Web, and others. This is because both on and off the Internet, there are ways to intercept information being sent, making encryption using PGP or similar critical.

\n

On a high-level the process between a sender and receiver looks like this:

\n
    \n
  1. The recipient generates public and private keys.
    2. \n
  2. The recipient sends its public key to the sender.
    3. \n
  3. The sender encrypts the message using the given public key.
    4. \n
  4. The sender sends the encrypted message to the recipient.
    5. \n
  5. The recipient decrypts the message using its private key.
    6. \n
\n

PGP Examples in Node.js

\n

Now, let's go over some examples in Node.js using the openpgp library.

\n\n

We'll go over some basic examples and show how to encrypt & decrypt large files using Node.js streams.

\n

First, set up your Node.js project and install openpgp.js:

\n
mkdir pgp-tutorial && cd pgp-tutorial && npm init\nnpm i openpgp --save
\n

Note: examples use openpgp v4.10.8

\n

Generating keys

\n

When generating private and public PGP keys with OpenPGP, you can define which curve to use in Elliptic-curve cryptography. In this example, we use Ed25519 for its performance and small key size. For the full list of curves, you can choose from, refer to OpenPGP.js docs.

\n

You also need to define a passphrase used to decrypt files and the private key. In practice, this should be a strong, randomized secret generated for a single-use.

\n
// generate-keys.js\nconst openpgp = require("openpgp");\n\ngenerate();\nasync function generate() {\n  const { privateKeyArmored, publicKeyArmored } = await openpgp.generateKey({\n    userIds: [{ name: "person", email: "person@somebody.com" }],\n    curve: "ed25519",\n    passphrase: "qwerty",\n  });\n  console.log(privateKeyArmored);\n  console.log(publicKeyArmored);\n}
\n

Running the above gives us our private key:

\n
-----BEGIN PGP PRIVATE KEY BLOCK-----\nVersion: OpenPGP.js v4.10.8\nComment: https://openpgpjs.org\n\nxYYEX6iKVxYJKwYBBAHaRw8BAQdANJ6JIXuMMZV3NIlwq0POS7xsF2N7+kAE\n7KQjAtfIuqj+CQMI4CUgW9jPsGPgJvQnnCWFf1s7lO/5+D5ZQ9JK25fUtmQo\nWyHX0Ja1ryOoFnvq7u+7fUC0+RAzt8S1xv3eDzazfgNuLtEmufwMyR6wMi78\nKc0ccGVyc29uIDxwZXJzb25Ac29tZWJvZHkuY29tPsKPBBAWCgAgBQJfqIpX\nBgsJBwgDAgQVCAoCBBYCAQACGQECGwMCHgEAIQkQVrbGpNEnCPUWIQQb8YRJ\nhw7DjekU68lWtsak0ScI9UM7AQDv4YRbIdU2ErPf8MobreeLiXXjYZ6fas8E\nzW0KoTZWEQD+NHDY2YYByMF1mWusPkdPDpyBzqMJrlMeihMzZ+PE8AfHiwRf\nqIpXEgorBgEEAZdVAQUBAQdARY37/Vys4Sj6DvwN6TRjxrIqiMIngxQgvOb6\nwi+tQzEDAQgH/gkDCJ2xNZ1OXxv94E8fTLQ3gYHFQuebn/PSijD8CqlvHNB/\n/Z9sIxSFt7rzorW+9v6Awfe+pQwXW5iEyJkdiGu3BM91GMwMvMmZ+rBNlBvq\niX7CeAQYFggACQUCX6iKVwIbDAAhCRBWtsak0ScI9RYhBBvxhEmHDsON6RTr\nyVa2xqTRJwj17W0BAI5MuCWHrqjSRcdjLTwxa++jYv+Yxq4tODj8oh27T86v\nAQCfb3lij9JGlIMNDQgceeougl+Lw4Gb0kQCnsNQRggTDw==\n=yzT4\n-----END PGP PRIVATE KEY BLOCK-----
\n

And the public key:

\n
-----BEGIN PGP PUBLIC KEY BLOCK-----\nVersion: OpenPGP.js v4.10.8\nComment: https://openpgpjs.org\n\nxjMEX6iKVxYJKwYBBAHaRw8BAQdANJ6JIXuMMZV3NIlwq0POS7xsF2N7+kAE\n7KQjAtfIuqjNHHBlcnNvbiA8cGVyc29uQHNvbWVib2R5LmNvbT7CjwQQFgoA\nIAUCX6iKVwYLCQcIAwIEFQgKAgQWAgEAAhkBAhsDAh4BACEJEFa2xqTRJwj1\nFiEEG/GESYcOw43pFOvJVrbGpNEnCPVDOwEA7+GEWyHVNhKz3/DKG63ni4l1\n42Gen2rPBM1tCqE2VhEA/jRw2NmGAcjBdZlrrD5HTw6cgc6jCa5THooTM2fj\nxPAHzjgEX6iKVxIKKwYBBAGXVQEFAQEHQEWN+/1crOEo+g78Dek0Y8ayKojC\nJ4MUILzm+sIvrUMxAwEIB8J4BBgWCAAJBQJfqIpXAhsMACEJEFa2xqTRJwj1\nFiEEG/GESYcOw43pFOvJVrbGpNEnCPXtbQEAjky4JYeuqNJFx2MtPDFr76Ni\n/5jGri04OPyiHbtPzq8BAJ9veWKP0kaUgw0NCBx56i6CX4vDgZvSRAKew1BG\nCBMP\n=C6S6\n-----END PGP PUBLIC KEY BLOCK-----
\n

File Encryption

\n

Now we can start encrypting information.

\n

Create a text file:

\n
echo 'This file contains secret information' > secrets.txt
\n

Here, we act as the sender who received a public key from the intended recipient. We use their public key to encrypt the confidential information:

\n
// encrypt-file.js\nconst openpgp = require("openpgp");\nconst fs = require("fs");\n\nconst publicKeyArmored = <PUBLIC KEY GIVEN BY RECIPIENT>\n\nencrypt();\nasync function encrypt() {\n  const plainData = fs.readFileSync("secrets.txt");\n  const encrypted = await openpgp.encrypt({\n    message: openpgp.message.fromText(plainData),\n    publicKeys: (await openpgp.key.readArmored(publicKeyArmored)).keys,\n  });\n\n  fs.writeFileSync("encrypted-secrets.txt", encrypted.data);\n}
\n

In the newly created encrypted-secrets.txt file, we have the contents encrypted like so:

\n
-----BEGIN PGP MESSAGE-----\nVersion: OpenPGP.js v4.10.8\nComment: https://openpgpjs.org\n\nwV4DUsPKVnc3UHMSAQdAey4TJiEOrZQIrx6q2zBLgmPkbnhPMt1WR+jCWX5x\nGn8wEim8W4OhDVMwfhtgVIClBCGPhvdeZ1zvVUAJGDdl8+S+DUynKhPNcN8m\nKb9TRGYs0sAlAaXcTChBHSS5kDHV/8Hgjcn0OIs6v2mbCkz/bHs/shwf8WMI\nov711iEkgcXnXIX+ZDGyDFnAKftoygzAf0aZy82g7ejAD9SX13wNmO6TK8Gw\nwr9Xj8F6XBV0yHvdsm2uzRY9W03tTSqAf0anEs+ZWyVR/ha9ddnZJPFKtUbC\nBEF4AMavsIN0CcqpA4q69I3E6GEtkAzgBWfJOOO8mQsNQ1vJWcJocinryBE6\nKbhznoe+R69qmUaJXPpe5scF6tfCYuQtPz4uhOljT+OUP6qss5Nz4zBs4JLq\nnUlyynLLSSgdVr4Hvg==\n=5tyF\n-----END PGP MESSAGE-----
\n

Now, as the sender, we can send the encrypted file to the recipient.

\n

File Decryption

\n

Here, we act as the reciever. To decrypt the encrypted-secrets.txt file, we use our private key and passphrase:

\n
// decrypt-file.js\nconst openpgp = require("openpgp");\nconst fs = require("fs");\n\nconst privateKeyArmored = <PRIVATE KEY>\nconst passphrase = <PASS PHRASE>;\n\ndecrypt();\nasync function decrypt() {\n  const privateKey = (await openpgp.key.readArmored([privateKeyArmored])).keys[0];\n  await privateKey.decrypt(passphrase);\n\n  const encryptedData = fs.readFileSync("encrypted-secrets.txt");\n  const decrypted = await openpgp.decrypt({\n    message: await openpgp.message.readArmored(encryptedData),\n    privateKeys: [privateKey],\n  });\n\n  console.log(decrypted.data);\n}
\n

Which logs the decrypted file contents:

\n
This file contains secret information.
\n

Using Streams for Large Files

\n

If you plan on encrypting or decrypting large files, you won't be able to fit the entire file contents in memory. In this case, you can use Node.js streams.

\n

Here, we encrypt a large file called dataset-1mill.json using streams:

\n
encrypt();\nasync function encrypt() {\n  const encrypted = await openpgp.encrypt({\n    message: openpgp.message.fromText(fs.createReadStream("dataset-1mill.json")),\n    publicKeys: (await openpgp.key.readArmored(publicKeyArmored)).keys,\n  });\n\n  let readStream = encrypted.data;\n  let writeStream = fs.createWriteStream("encrypted-dataset.txt", { flags: "a" });\n  readStream.pipe(writeStream);\n  readStream.on("end", () => console.log("done!"));\n}
\n

And then, we decrypt the newly created encrypted-dataset.txt using streams:

\n\n
openpgp.config.allow_unauthenticated_stream = true;\n\ndecrypt();\nasync function decrypt() {\n  const privateKey = (await openpgp.key.readArmored([privateKeyArmored])).keys[0];\n  await privateKey.decrypt(passphrase);\n\n  const decrypted = await openpgp.decrypt({\n    message: await openpgp.message.readArmored(fs.createReadStream("encrypted-dataset.txt")),\n    privateKeys: [privateKey],\n  });\n\n  let readStream = decrypted.data;\n  let writeStream = fs.createWriteStream("decrypted-dataset.json", { flags: "a" });\n  readStream.pipe(writeStream);\n  readStream.on("end", () => console.log("done!"));\n}
\n

Now, decrypted-dataset.json will have the same contents as our original dataset-1mill.json file.

\n","frontmatter":{"date":"November 10, 2020","updated_date":null,"description":"Starter guide on Pretty Good Privacy(PGP) with Nodejs. PGP, a cryptographic process used to encrypt and decrypt information.","title":"Using PGP Encryption with Nodejs","tags":["Security","NodeJs","Encryption"],"pinned":null,"coverImage":{"childImageSharp":{"fluid":{"aspectRatio":1.7699115044247788,"src":"/static/a427e4132564cc095bcc9015faa67da4/ee604/cover.png","srcSet":"/static/a427e4132564cc095bcc9015faa67da4/69585/cover.png 200w,\n/static/a427e4132564cc095bcc9015faa67da4/497c6/cover.png 400w,\n/static/a427e4132564cc095bcc9015faa67da4/ee604/cover.png 800w,\n/static/a427e4132564cc095bcc9015faa67da4/05d05/cover.png 1080w","sizes":"(max-width: 800px) 100vw, 800px"}}},"author":{"id":"Andy Yeung","github":null,"avatar":null}}}},{"node":{"excerpt":"Python is a general-purpose programming language and has overtaken Java in popularity according to a recent Stackoverflow survey. People…","fields":{"slug":"/engineering/python-basics-in-minutes/"},"html":"

Python is a general-purpose programming language and has overtaken Java in popularity according to a recent Stackoverflow survey.

\n

People who have never programmed before are tempted to try due to the simplicity to learn and use it. Well, let's get down to business.

\n

Before we get started

\n

Before we get started, there are a few things you should know about python:

\n\n

Print function

\n

We are assuming that you have already installed python. If you do not, please click here.

\n

To write your first Python code, open your text editor and type:

\n
print("Hello world, this is my first python code")
\n

Save the file as helloworld.py and put it into the python interpreter to be executed.\nYou also can run your code on the command line:

\n
C:\\Users\\Your Name>python helloworld.py
\n

If everything went well, you should see something like this:

\n
> Hello world, this is my first python code
\n

You can also use the print function to show integers, variables, lists, etc. Try it!

\n
#show the sum of two integers\nnumber1 = 5\nnumber2 = 7\nprint(number1+number2)
\n
#dividing two decimals\nnumber1 = float(12.1)\nnumber2 = float(4)
\n
#concatenating strings\nname = "Python"\nphrase = str("I hate ")\nprint("I love ", name)\nprint(phrase+name)
\n

Data Types

\n

Python has the following data types built-in by default, in these categories:

\n\n
\n

Note: Variables in Python are interpreted as integers by default. Is a good practice to declare them as another type explicitly (if they aren't integers). You can see the kind of a variable using the function type().

\n
\n

Python Operators

\n

Operators are used to performing operations on variables and values.\nThe main groups are:

\n\n

Arithmetic operators

\n

Arithmetic operators are used with numeric values to perform common mathematical operations.

\n\n

Comparison operators

\n

Comparison operators are used to compare two values.

\n\n

Logical operators

\n

Logical operators are used to combine conditional statements.

\n\n

If statement

\n

Look to the code below:

\n
age = 18\nif (age<21):\n    print("The student is underage!")\nelif (age==21):\n    print("The student is 21!")\nelse:\n    print("The student isn't underage!")
\n

In programming, we often have to choose what to do depending on the situation. It is essential to know how to use conditional arguments like ifand else.\nThe code above print a different message according to a condition.

\n

Try to write a code that asks for two test scores. If the average is less than 7, the user should see \"I'm sorry, you didn't do well on the tests\". If the average is exactly 7, the user should see \"You did it!\". And if it is greater than 7, the user should see \"Congratulations!! You're a great student.\".

\n
\n

Note: to request a response from the user, you need to use the input() function. For example:

\n
\n
name = str(input("What's your name?"))\nage = int(input("How old are you? "))\nprint("I'm %s and I'm %d"% (name, age))
\n

Loops

\n

Python has two primitive loop commands: while and for.

\n

While loop

\n

With the while loop, we can execute a set of statements as long as a condition is true.

\n
count = 0\nwhile count < 10:\n    print(count)\n    count += 1    #this line is the same as    count = count+1
\n

The code above will print count as long as count is less than 10.

\n

For loop

\n

A for loop is used for iterating over a sequence. Using it, we can execute a set of statements, once for each item in a list, tuple, set, string, etc. For example:

\n
#loop through a string\nfor x in "banana":\n    print(x)
\n
#loop through a list of fruits\nfruits = ["apple", "banana", "melon"]\nfor x in fruits:\n    print("I like", x)
\n

Conclusion

\n

Did you understand why python became so popular? In a few minutes, you were able to learn the main concepts of this fantastic language.

\n

Please comment and share this article!

\n","frontmatter":{"date":"November 06, 2020","updated_date":null,"description":"Learn the basics of Python programming lanuage (For Beginners)","title":"Python basics in minutes","tags":["Python"],"pinned":null,"coverImage":{"childImageSharp":{"fluid":{"aspectRatio":1.5037593984962405,"src":"/static/c09f9fd01e129e30049747717eaf81ec/ee604/python.png","srcSet":"/static/c09f9fd01e129e30049747717eaf81ec/69585/python.png 200w,\n/static/c09f9fd01e129e30049747717eaf81ec/497c6/python.png 400w,\n/static/c09f9fd01e129e30049747717eaf81ec/ee604/python.png 800w,\n/static/c09f9fd01e129e30049747717eaf81ec/f3583/python.png 1200w","sizes":"(max-width: 800px) 100vw, 800px"}}},"author":{"id":"Sara Lins","github":"saranicoly","avatar":null}}}},{"node":{"excerpt":"E-commerce security is a set of protocols that ensures safe transactions through the internet. In digital security, significant data…","fields":{"slug":"/identity/ecommerce-security/"},"html":"

E-commerce security is a set of protocols that ensures safe transactions through the internet. In digital security, significant data breaches have profoundly undermined trust. Consumers are comfortable making purchases through common networks. However, they require a little more convincing when it comes to sharing their credit card data with unfamiliar companies.

\n

By 2021, over 2.14 billion people worldwide are expected to buy goods and services online. Increased online buying means retail data breaches will also be on the rise as point-of-sale (POS) systems, e-commerce sites and other store servers are major targets for hackers.

\n

The biggest long-term consequence of a data breach is the loss of consumer trust which will have a direct effect on sales and destroy the retailers’ credibility.

\n

Current Statistics On Data breach 

\n

Data breach refers to a security incident in which personal information is publicly exposed or accessed without authorization. 

\n

Cybercrime Magazine predicts that retail will be one of the top 10 most attacked industries for 2019–2022. 

\n

A few recent data breaches include:

\n\n

The above statistics have serious implications for online retailers, mainly when trust and consumer confidence in your brand is the only way to ensure success. 

\n

Top 5 E-commerce Platforms for Online Businesses

\n

It is very difficult to find the right ecommerce platforms for online business. Factors like popularity, overall ranking, features, consumer service, pricing, and ease of use play an important role in selecting the best e-commerce platforms. 

\n

Based on these factors a few e-commerce platforms are mentioned below:

\n

Shopify 

\n

Shopify is one of the best e-commerce sites and caters to businesses of all sizes. One of the most crucial reasons for their success is its flexibility. There are more than 2,400 apps in the Shopify App Store. It includes a built-in CMS, multiple themes for your site, a third-party marketplace and capability for a blog for your online store. Apart from the standard Shopify, Shopify Lite is for those with an existing website that needs a platform to take payments. 

\n

Bigcommerce

\n

BigCommerce, as a leading open SaaS solution provides merchants sophisticated enterprise-grade functionality, customization, and performance with simplicity and ease-of-use. It has two offerings: BigCommerce Essentials (a DIY SaaS platform) and BigCommerce Enterprise (a customized experience for larger consumers). More than 800 apps in the BigCommerce app store allow you to add numerous additional capabilities to your store. Its multi-currency features allow merchants to set prices in multiple currencies and also settle in more than one currency.

\n

Magento

\n

Magento is best for small-to-medium businesses that have already established demand, as well as the time, manpower and skill to build their own site. The platform is very powerful and has a library of over 5,000 extensions. Being open source, it targets people with professional web development experience. Magneto exists in two versions: Magento Open Source and Magento Commerce.

\n

Wix

\n

Wix.com is a cloud-based website builder that allows users to create online stores through drag-and-drop tools. It has an extensive range of templates and designs that make it easy to build a compelling and functional website. Its website builder and ecommerce component is very user-friendly. It also provides a large selection of templates to fit various business needs. Wix.com’s ecommerce functionality has most of what a business would need, but doesn’t scale as well as dedicated platforms like Shopify or Magento.

\n

WooCommerce

\n

WooCommerce is a free, open-source WordPress shopping cart plugin owned and developed by WordPress. It is suitable for small businesses that operate on a tight budget but still want a robust online store. However, you will have to separately purchase hosting, a domain name, and an SSL certificate, all of which are catered for by many of the stand-alone e-commerce platforms. WooCommerce allows unlimited products and product variants, including digital products.

\n

Appy Pie's website builder

\n

Appy Pie's website builder tool is a versatile platform for creating websites and mobile apps without any coding skills. It offers a user-friendly interface with drag-and-drop functionality, making it easy for beginners to design professional-looking websites. The tool provides a wide range of customizable templates catering to different industries and purposes, from business websites to portfolios and online stores.

\n

Security Threats That E-Commerce Stores Face

\n

\n \n

    \n
  1. Customer journey hijacking
    2. \n
\n

Customer journey hijacking (CJH) is a customer-side phenomenon whereby unauthorized advertisements are injected into consumers’ browsers. The injected advertisements can include product ads, pop-ups, banners and in-text redirects. 

\n
    \n
  1. Credit card frauds
    2. \n
\n

Credit card fraud is the unauthorized use of a credit or debit card to make a purchase. The card numbers can be stolen from unsecured websites or can be obtained in an identity theft scheme.

\n
    \n
  1. Bad bots
    2. \n
\n

Bad bots are designed to perform a variety of malicious jobs. They are capable of stealing content from the website, such as product reviews, product pricing, catalogs and so on which they publish on some other site. This affects the search engine ranking of the retailers' website. Bad bots are able to make multiple page visits within a very short span of time thus straining Web servers, which makes the site slow for genuine users.

\n

\n \n \n

\n

5 Ways E-Commerce Can Keep Their Online Stores Safe Using Identity Management

\n
    \n
  1. Renew SSL certificates and ensure total PCI compliance.
    2. \n
\n

SSL is the de facto standard for securing online transactions and essential to establish secure connectivity between the end-user systems and your e-commerce website. With SSL certifications in place, one can move from HTTP to HTTPS, which serves as a trust signal and prerequisite for consumers to provide their personal details and credit card information. 

\n

Payment Card Industry Data Security Standard (PCI DSS or PCI) is an industry standard that ensures credit card information collected online is being transmitted and stored in a secure manner. E-commerce websites need to maintain PCI compliance. 

\n
    \n
  1. Encourage your consumers to go passwordless while accessing their accounts
    2. \n
\n

In the retail industry, registering or logging in without a password calls for consumer retention and loyalty. By enabling the one-touch login feature, consumers can log in with a magic link or OTP sent to their mobile number or email id.

\n
    \n
  1. Prominently display payment trust signals and logos on your payment pages.
    2. \n
\n

Prominently displaying payment trust signals and logos on payment pages shows the consumer the security measures taken by the e-commerce website. Consumer privacy is critical in e-commerce. E-commerce sites should only collect data that is useful for the purposes of fulfilling the transaction. 

\n
    \n
  1. Verify card and address details to reduce the risk of fraudulent transactions
    2. \n
\n

In order to risk fraudulent transactions, e-commerce websites need to verify card and address details of consumers. Usage of unique tracking numbers for every transaction helps to combat chargeback fraud. Geo-targeting can also help eliminate fraudulent transactions. 

\n
    \n
  1. A secure login form to prevent credential attacks
    2. \n
\n

By implementing multi-factor authentication (MFA), retailers would be able to ensure that digital consumers can be authenticated. This method requires the consumer to provide two or more verification factors to gain access to the online account. 

\n

How LoginRadius Enhances E-Commerce Security With Its Advance CIAM Solution 

\n

\n \n \n

\n","frontmatter":{"date":"November 06, 2020","updated_date":null,"description":"Security for e-commerce is a series of protocols that guarantee protected internet transactions. Major data violations have significantly eroded trust in digital security. Via common networks, consumers are comfortable making purchases. However, when it comes to sharing their credit card details with new businesses, they need a little more convincing.","title":"E-commerce Security: 5 Ways to Enhance Data Protection During the Shopping Season","tags":["ecommerce security","data security","cx"],"pinned":null,"coverImage":{"childImageSharp":{"fluid":{"aspectRatio":1.3986013986013985,"src":"/static/d8ef11032d121b3cdfc7fdc3e621ab2a/9a31d/ecommerce-security.jpg","srcSet":"/static/d8ef11032d121b3cdfc7fdc3e621ab2a/f836f/ecommerce-security.jpg 200w,\n/static/d8ef11032d121b3cdfc7fdc3e621ab2a/2244e/ecommerce-security.jpg 400w,\n/static/d8ef11032d121b3cdfc7fdc3e621ab2a/9a31d/ecommerce-security.jpg 767w","sizes":"(max-width: 767px) 100vw, 767px"}}},"author":{"id":"Karl Wittig","github":null,"avatar":null}}}},{"node":{"excerpt":"What is Rest? Representational State Transfer in short-form as REST defines a set of constraints for creating Web Services.\nRest API is the…","fields":{"slug":"/engineering/rest-api-cucumber-blog/"},"html":"

What is Rest?

\n

Representational State Transfer in short-form as REST defines a set of constraints for creating Web Services.\nRest API is the most-used web service technology nowadays, and it's an almost meaningless description. A REST API is a way to communicate for two computer systems over HTTP, which is similar to web browsers and servers.

\n

What is BDD?

\n

BDD stands for Behavior Driven Development (BDD). Nowadays, many Organizations, to get a better advantage of testing, are taking a step forward.

\n\n

What is Cucumber?

\n

A cucumber is an approach that supports BDD. It allows you to write tests that anyone can understand, irrespective of their technical knowledge. In BDD, users (business analysts, product owners, developers, etc..). We need to first write scenarios or acceptance tests that describe the system's behavior from the customer's point of view for review and sign-off by the product owners before developers start actual development.

\n

What are the Prerequisites to Test Rest API using Cucumber?

\n\n

Steps to Install Java

\n
http://www.oracle.com/technetwork/java/javase/downloads/index.html
\n

Download JDK from the above link and install it\nSet the Environment Variable on System Properties

\n
Right Click on My PC -> Properties -> Advanced System Settings -> Environment Variables -> Create New -> provide path of JDK
\n

Steps to Install Eclipse

\n\n

Steps to Install Maven

\n\n

Configuring Cucumber with Maven

\n\n

Now we need three Important files.

\n\n

Feature File: It's a entry point to the cucumber. We use Gherkins to write the feature file. This is the file where you will describe your descriptive language(Gherkin uses simple English). A feature file can contains a Scenario or List of Scenario. A sample Feature file is below

\n
Feature: Login Functionality\n@validLogin\nScenario: User Should Login With Valid Credentials \n   Given Post Login API\n   When Provide Valid Credential\n   Then Status_code equals 200    \n   And  response contains IsLogin equals "true"\n@invalidLogin    \nScenario Outline: Email and Password Validation in Login API \n   Given Post Login API\n   When Provide different combinations to "<email>""<password>"\n   Then Status_code equals <statuscode>    \n   And  response contains message equals "<message>"\n   Examples:\n   |email     \t\t|password    | statuscode |  message\n   |          \t\t|            |   401      | Required email and password\n   | abc\t  \t|            |   401      | Email format is incorrect\n   | abc@mail7.io  \t|\t     |   401      | Required password\n   | abc@mail7.io   \t| password   |   401      | Email and Password combination Incorrect
\n

Save the above code as login.feature

\n\n

StepDefinition:\nNow you have your feature file ready with test scenarios defined. However, our job is not done yet. Cucumber doesn't know when should execute which part of code. So StepDefinition acts as an intermediate to your runner and feature file. It stores the mapping between each step of the scenario in the Feature file. So when you run the scenario, it will scan the stepDefination file to check matched glue.

\n

How to write step definition:\nWe have a chrome extension(Tidy Gherkin) to convert your feature into a step definition.
\nCopy your scenario from the feature file and paste it in Tidy Gherkin and click on Java Steps; copy the Java Steps.\nCreate a new file name a StepDefinition.java and paste the Java Steps

\n
package com.loginradius.login\nimport cucumber.api.java.en.Given;\nimport cucumber.api.java.en.When;\nimport cucumber.api.java.en.Then;\nimport cucumber.api.java.en.And;\nimport cucumber.api.junit.Cucumber;\nimport org.junit.runner.RunWith;\nimport static io.restassured.RestAssured.given;\nimport static org.testng.Assert.assertTrue;\nimport io.restassured.http.ContentType;\nimport io.restassured.response.Response;\nimport io.restassured.specification.RequestSpecification;\nimport io.restassured.RestAssured;\n\npublic class StepDefinition {\n\tprivate  static  final  String  BASE_URL  =  "https://www.loginradius.com";\n\tString email = "abcxyz@mail7.io;\n\tString password = "password";\n\tRequestSpecification request;\n\tprivate  static  Response response;\n\tprivate  static  String  jsonString;\n\n    @Given("Post Login API")\n    public void post_login_api() {\n\t    RestAssured.baseURI  =  BASE_URL;\n\t\trequest  =  RestAssured.given();\n\t\trequest.header("Content-Type",  "application/json");    \n    }\n    \n   @When("Provide Valid Credential")\n    public void provide_valid_credential() {\n      response  =  request.body("{ \\"userName\\":\\""  +  email  +  "\\", \\"password\\":\\""  +  password  +  "\\"}")\n\t\t\t\t\t\t  .post("/user/login");\t\n    }\n\n   @Then("Status_code equals {int}")\n    public void statuscode_equals_(int agr) {\n\t    Assert.assertEquals(arg, response.getStatusCode());\n    }\n\t\n\t@And("response contains IsPosted equals {string}")\n    public void response_contains_IsPosted_equals_(String message) {\n\t    Assert.assertEquals(message, getJsonPath(response, "IsPosted"));\n    }\t\n\n   @And("response contains message equals {string}")\n    public void response_contains_equals_(String message) {\n\t    Assert.assertEquals(message, getJsonPath(response, "message"));\n    }\n    \n\t@When("Provide different combinations to {string}, {string}")\n    public void provide_different_combinations_to_somethingsomething(String email, String password){\n\t    response = request.body("{ \\"userName\\":\\"" + email + "\\", \\"password\\":\\"" + password + "\\"}") .post("/user/login");\n    }\n\n\tpublic String getJsonPath(Response response, String key) {\n\t\tString resp = response.asString();\n\t\tJsonPath js = new JsonPath(resp);\n\t\treturn js.get(key).toString();\n\t}\n\t\n}
\n

Now we have Our Feature file and StepDefinition Ready, we need a runner file to run our Test Scenario's

\n

Runner File:\nA runner will help us to run the feature file and acts as an interlink between the feature file and StepDefinition Class\nBelow is the code which will help you to run the tests

\n
package runner;\nimport io.cucumber.testng.CucumberOptions;\n\n@CucumberOptions(\n\t\tfeatures= {"feature_files/login.feature"},\n        glue= {"step_definations/StepDefinitation.java"},\n        tags= "@validLogin",    // based on tags scenarios will run\n        monochrome=true, dryRun=false,\n\t\t)\t\npublic  class  TestRunner  {\n\n}
\n

Now We have Feature, StepDefinition, and runner files ready, We can run the runner file to see the results.

\n

Conclusion

\n

Cucumber is very useful in understanding the overall testing process without having coding knowledge. Since it uses simple English to write the feature file and makes developer, QA and other stakeholders on same page before starting the actual development.

\n","frontmatter":{"date":"November 05, 2020","updated_date":null,"description":"This article is about basic overview of how to automate Rest API using Cucumber and JAVA.","title":"Automating Rest API's using Cucumber and Java","tags":["Automation","Cucumber","Rest API","Java"],"pinned":null,"coverImage":{"childImageSharp":{"fluid":{"aspectRatio":1.5037593984962405,"src":"/static/6185494b9a177d30a2dc78ccaca79e14/ee604/cucumber_rest_assured.png","srcSet":"/static/6185494b9a177d30a2dc78ccaca79e14/69585/cucumber_rest_assured.png 200w,\n/static/6185494b9a177d30a2dc78ccaca79e14/497c6/cucumber_rest_assured.png 400w,\n/static/6185494b9a177d30a2dc78ccaca79e14/ee604/cucumber_rest_assured.png 800w,\n/static/6185494b9a177d30a2dc78ccaca79e14/f3583/cucumber_rest_assured.png 1200w","sizes":"(max-width: 800px) 100vw, 800px"}}},"author":{"id":"Surendranath Reddy Birudala","github":"reddysuren","avatar":null}}}}]},"markdownRemark":{"excerpt":"Identity is evolving, and developers are at the forefront of this transformation. Every day brings a new learning—adapting to new standards…","fields":{"slug":"/identity/developer-first-identity-provider-loginradius/"},"html":"

Identity is evolving, and developers are at the forefront of this transformation. Every day brings a new learning—adapting to new standards and refining approaches to building secure, seamless experiences.

\n

We’re here to support developers on that journey. We know how important simplicity, efficiency, and well-structured documentation are when working with identity and access management solutions. That’s why we’ve redesigned the LoginRadius website—to be faster, more intuitive, and developer-first in every way.

\n

The goal? Having them spend less time searching and more time building.

\n

What’s New and Improved on the LoginRadius Website?

\n

LoginRadius’ vision is to give developers a product that simplifies identity management so they can focus on building, deploying, and scaling their applications. To enhance this experience, we’ve spent the last few months redesigning our interface— making navigation more intuitive and reassuring that essential resources are easily accessible.

\n

Here’s a closer look at what’s new and why it’s important:

\n

A Developer-Friendly Dark Theme

\n

\"This

\n

Developers spend long hours working in dark-themed IDEs and terminals, so we’ve designed the LoginRadius experience to be developer-friendly and align with that preference.

\n

The new dark mode reduces eye strain, enhances readability, and provides a seamless transition between a coding environment and our platform. Our new design features a clean, modern aesthetic with a consistent color scheme and Barlow typography, ensuring better readability. High-quality graphics and icons are thoughtfully placed to enhance the content without adding visual clutter.

\n

So, whether you’re navigating our API docs or configuring authentication into your system, our improved interface will make those extended development hours more comfortable and efficient.

\n

Clear Categorization for LoginRadius Capabilities

\n

\"This

\n

We’ve restructured our website to provide a straightforward breakdown of our customer identity and access management platform capabilities, helping you quickly find what you need:

\n\n

This structured layout ensures you can quickly understand each capability and how it integrates into your identity ecosystem.

\n

Developer-First Navigation

\n

\"This

\n

We’ve been analyzing developer workflows to identify how you access key resources. That’s why we redesigned our navigation with one goal in mind: to reduce clicks and make essential resources readily available.

\n

The new LoginRadius structure puts APIs, SDKs, and integration guides right at the menu bar under the Developers dropdown so you can get started faster. Our Products, Solutions, and Customer Services are also clearly categorized, helping development teams quickly find the right tools and make informed decisions.

\n

Quick Understanding of Integration Benefits

\n

\"This

\n

Developers now have a clear view of the tech stack available with LoginRadius, designed to support diverse business needs.

\n

Our platform offers pre-built SDKs for Node.js, Python, Java, and more, making CIAM integration seamless across popular programming languages and frameworks.

\n

Over to You Now!

\n

Check out our revamped LoginRadius website and see how the improved experience makes it easier to build, scale, and secure your applications.

\n

Do not forget to explore the improved navigation and API documentation, and get started with our free trial today. We’re excited to see what you’ll build with LoginRadius!

\n","frontmatter":{"date":"February 21, 2025","updated_date":null,"description":"LoginRadius’ vision is to give developers a product that simplifies identity management so they can focus on building, deploying, and scaling their applications. To enhance this experience, we’ve redesigned our website interface, making navigation more intuitive and reassuring that essential resources are easily accessible.","title":"Revamped & Ready: Introducing the New Developer-First LoginRadius Website","tags":["Developer tools","API","Identity Management","User Authentication"],"pinned":true,"coverImage":{"childImageSharp":{"fluid":{"aspectRatio":1.7857142857142858,"src":"/static/80b4e4fbe176a10a327d273504607f32/58556/hero-section.webp","srcSet":"/static/80b4e4fbe176a10a327d273504607f32/61e93/hero-section.webp 200w,\n/static/80b4e4fbe176a10a327d273504607f32/1f5c5/hero-section.webp 400w,\n/static/80b4e4fbe176a10a327d273504607f32/58556/hero-section.webp 800w,\n/static/80b4e4fbe176a10a327d273504607f32/99238/hero-section.webp 1200w,\n/static/80b4e4fbe176a10a327d273504607f32/7c22d/hero-section.webp 1600w,\n/static/80b4e4fbe176a10a327d273504607f32/1258b/hero-section.webp 2732w","sizes":"(max-width: 800px) 100vw, 800px"}}},"author":{"id":"Rakesh Soni","github":"oyesoni","avatar":"rakesh-soni.jpg"}}}},"pageContext":{"limit":6,"skip":654,"currentPage":110,"type":"///","numPages":161,"pinned":"ee8a4479-3471-53b1-bf62-d0d8dc3faaeb"}},"staticQueryHashes":["1171199041","1384082988","2100481360","23180105","528864852"]}