In Germany we have the completely wrong mindset for such things. Instead of being grateful, all we care about is "whose fault is it" and CYA tactics. And no one wants to be "guilty" or have their incompetence revealed, so suits will do anything they can to avoid that. Somethings serious needs to go wrong first, so that loss of face already happens, before anyone will move. Maybe we need to get hacked by Russia a few more times.

As a German I fear the only way I can see one of our government agencies to react upon an external pentesting report is if you threatened to release data from it anyway (this is not a recommendation, please don't raid my home). I just do not see them fixing even a dangerous bug if a stranger came along and told them to.

Yeah.

And I do think that security research should have some regulation about it, but it should be more about responsible handling of the privileged access you gained, or a responsibility to disclose found vulnerabilities in private and/or to a government entity. You know, "If you have gained access to a system, and you saw a button <Turn off cooling pump 2> and you pressed it, you are on the hook for the damages". That is common practice with paid pentesters already.

But we're at a point where a court had do decide if discovering an endpoint on an API without authorization is a "circumvention of a security boundary" or not. Luckily, we now have a ruling that accessing API endpoints without authorization logic is no circumvention of a security boundary, due to a lack of a security boundary like authorization.

That's the level we are at. I don't want to know what happens if foreign nation state actors start acting on this seriously.

It's a good way to ensure that people outside of Germany pentest German sites instead :D

To be fair, most of this stuff could be found with any normal browser. You don't even need browser dev tools. But if you write a simple script to automate any of this... yeah. They can totally get you for doing that. Probably one or the best examples why politicians should not be allowed to pass technical laws they fundamentally can't grasp.

Tiny request that you probably can't do anything about - but despite this page being in English, the HTML is incorrectly reporting it as lang="nl-NL" in the first line of the source. There's a few other hreflang="nl" floating around pointing to English pages as well.

(Only noticed because I have a tiny indie search engine that can only index English right now, and the "nl-NL" is causing the page to be misclassified.)

Weird niche bug report aside though - love to see this project, congratulations for working on this. I think it's a great idea.

I'd personally love to see a closer look on government sites that drop cookies before the consent banner has asked permission to do so. I'm not worried about cookies, but if we're going to ignore the consent banner anyway, why waste everyone's time with asking in the first place.

Maybe post this as Show HN? And adjust headline to fit max chars.

Q: would you mark google.com with any "high risk" findings?

there are quite a few like this, that on close inspection, are just fine

> A nice addition would be to add who is hosting their email.

Something like this? https://livenson.github.io/mxmap/

A few countries have those, here's a Github repo of the Swiss one (has a list of forks in there too): https://github.com/davidhuser/mxmap

Not making it red would downplay the "SEC" part in DNSSEC.

We already have some privacy metrics in addition to tracking cookies, and there will be more. All are important at the same time.

[dead]

I get emails from the German Federal Office for Information Security (BSI) via hetzner letting me know if I have db ports open etc.

Might be worth enclosing that URL in quotes or using [dot] in the URL instead, so people don't accidentally click on that "mortal-kombat-2-cs.pdf" file that Europa.EU is hosting.

VirusTotal claims the PDF file is clean, but I don't think I'd fully trust it anyway. If you do find malicious content, could be worth submitting the URLs to VirusTotal so that the domain is flagged by browsers (eg Google SafeBrowsing) and people can't accidentally visit ec.europa.eu domains until it has been cleaned.

What we have is published on https://securitybaseline.eu/datasets openly. Some governments publish lists, and they will be incomplete. In the article we point to our most successful approach: sifting through the (partial) zone file with domain owner information. That delivered thousands of sites the Dutch government didn't even know about.

Perhaps a freedom of information request might also work, but that will take a lot of time to write correctly and does not scale across all governments.