Feedback

[ebouchut]

This is some of the feedback I received about the current state of this project.

• Password
  • Read ANSSI's book about Multifactor authentication and passwords:
    • Chapter 4.1: Politique de sécurité de mots de passe,
    • Password hardening.
  • Use CAPTCHA to prevent bots from creating accounts
  • Learn about how to configure BCrypt to use salt or pepper with hashed password to prevent attacks
    • Investigate what the S2a$l0$ prefix refers to in a hashed password?
      Does the prefix of a hashed password give a clue about whether pepper is used?
      According to my notes, it does not because this header only contains the algorithm identifier, the BCrypt version, and the cost factor.
      Triple-check the official BCrypt doc to confirm.
• Accessibility:
  • RGAA:
    • Wave is a CLI tool that does something similar to what lighthouse does in DevTools.
• SEO (Search Engine Optimization):
  • Add Search Keywords:
    • Add SEO keywords to a meta tag
      <meta name="keywords" content="..." />
    • Add text content to the home page containing targeted SEO keywords.
  • Add robots.txt to the website's root. This file indicates which search bots can crawl which web pages on the website. However, it is advisory, NOT restrictive (meaning it is not a lock).
  • Add sitemaps.xml to the website's root. This file indicates which URLs, along with their metadata, are available for search engines to crawl.
• GEO (Generated Engine optimization)
  • Add llms.txt (a Markdown file) that points AIs to the important web pages.
  • Learn about GEO (Generated Engine optimization)
• Update the MCD and MLD diagrams because some ORM-related properties (such as created_at and updated_at) do not reflect the customer's vision for their entities. (I was wearing two hats while creating the MCD and MLD diagrams). These properties are more of a developper/database administrator need, and should be added to the MPD diagram.
  That’s a fair point, and I will keep it in mind when I do data modelling in the future.
• RGPD:
  • Add the age property to the USER entity and the users table
• Read the book about Postgres
• Perform a gap analyis using OWASP and RGPD
• Read the OWASP section 3 titled Dependency check
• Advices:
  • Minimize the use of frameworks (framework-less)
  • Make sure to learn the features available in Java 21
• Provide the following deliverables (3 documents):
  • DAT (🇫🇷 Dossier d'Architecture Technique): Architecture manual
  • MIN (🇫🇷 Manuel d'Installation): Installation manual
  • MEX (🇫🇷 Manuel d'Exploitation): Operations/Runbook manual
• Resources:
  • Learn Cybersecurity and practice with Labs and MOOCs:
    • RGPD MOOC of CNIL section Atelier RGPD
    • SecNum Academy (ANSSI MOOC)
    • root-me
    • Book of ANSSI (https://cyber.gouv.fr/en/publications/)
  • Programming:
    • Codecademy (online courses, some of them are free)
    • CodeInGame (challenges)
• Publish the website: Go beyond documenting the deployment.