Xk

5 ms·

1.
by Xk 13y ago
You would think that it would. But the way Chrome has implemented CSP, it doesn't. When you specify a CSP in a Chrome extension, it applies to the core extension (the background page) and all content scripts. It does not, however, apply to
2.
by Xk 13y ago
There's been a lot of research about this recently (I've brought this up on HN previously). A team from Berkeley broke 50% of the 50 most popular extensions last year [1]. Some other researchers looked at explicitly malicious extensions [2]
3.
by Xk 14y ago
Those interested in this should look at a paper from Vern Paxon and Nicholas Weaver: http://www.icir.org/vern/papers/witty-imc05.pdf A summary of it: A worm used a linear congenital generator to generate its randomness. It used this gener
4.
by Xk 14y ago
Thanks. Will do. edit: support email sent
5.
by Xk 14y ago
You have a very severe security vulnerability on your site. Please provide an email address in your info I can contact you at. (The email field is hidden to others.) Edit: interwho has fixed the vulnerability. There was a CSRF allowing you
6.
by Xk 14y ago
Either you do it for everything, or you do it for only POST and you end up missing half of the vulnerabilities. Correct me if I'm wrong, but your CSRF attack used a GET request, did it not? [1] Web applications make state-changing operation
7.
by Xk 14y ago
CSRF is NOT a browser vulnerability. The browser is doing exactly what it's supposed to do: load content. The browser can not (and should not) attempt to identify the "evil" HTTP requests from the "good" ones. The browser's job is to make r
8.
by Xk 15y ago
Researchers at UC Berkeley studied this exact question. About 40% of extensions contain at least one injection vulnerability. Some really popular extensions were vulnerable -- even a couple Google authored ones. http://www.eecs.berkeley.ed
9.
by Xk 15y ago
There is an XSS on pen.io. I posted this a while ago, but feint didn't fix it. http://xssdemo.pen.io Suggestion: It is very hard to allow HTML but remove JavaScript. Write a method called something like isJSPresent() and then after you've
10.
by Xk 15y ago
Please don't use this for passwords. Security is very hard to get right. Do they do a secure delete of the contents of the webpages? Who knows. Do they have strong physical protection around the server? Who knows. Do they run up to date sof
11.
by Xk 15y ago
No. If an attacker gets access to the database, chances are very very good they can get access to the key as well. Very few services correctly separate privileges well enough that an attacker can not gain more access once they have databa
12.
by Xk 15y ago
Fine. Assume it's one bit per voxel. 512 petabits = 2 petabytes. So only 2 petabytes of data. I'd like to see the server that processed those 2 petabytes. Notch also points out that even still, 8m is quite a small height. Take it to 16m a
13.
by Xk 15y ago
That's not the case. Each Telex Station has it's own private key which it uses to decrypt the 224 bit tag. If one Telex station loses its private key, then the user will just use another.
14.
by Xk 15y ago
Yeah, I realize that -- I'm just saying, for people who want to read more on the subject of Tetris there is a lot out there.
15.
by Xk 15y ago
For those that care, a few years ago some researchers proved Tetris is NP-complete for many problems. http://arxiv.org/abs/cs.CC/0210020
16.
by Xk 15y ago
They have an XSS on https://secure.trust-guard.com/ (enter a username like <img src=g onerror=alert(1)> -- yes, it won't work with chrome's XSS filter)... somehow I'm inclined to believe they are not so great. (An attacker could e
17.
by Xk 15y ago
The current implementation uses an iframe and so they can't read the data out of the iframe (same-origin policy). This would require injecting javascript on to news.ycombinator.com. It wouldn't be so bad, but it would require user interacti
18.
by Xk 15y ago
The problem with captchas is they have to be readable to humans. Sure, a captcha of "lI0Ol1o" would would probably be unreadable to a computer ... but it would be to a human too. We're quickly approaching the point that image recognition is
19.
by Xk 15y ago
Alright; I'm confused. First they say that they "generate around 1 petabyte of data per second" Then they say "ATLAS produces up to 320M bytes per second, followed by CMS with 220M Bps. The data from ALICE amounts to 100M Bps and LHCb produ
20.
by Xk 15y ago
No. Not at all. If someone managed to break in to your website and get the password hashes, chances are they also have your "secret" salt. There is no reason to separate the salt from the hash, and, in fact, there are no implementations w
21.
by Xk 15y ago
It is true that scrypt is better than bcrypt, but the transition from salt+SHA-1 to bcrypt is significatnly better than from bcrypt to scrypt, and scrypt doesn't have nearly as nice of an interface as bcrypt does.
22.
by Xk 15y ago
That's not the attack you worry about: instead, consider the case where someone somehow obtains the database and can do an offline attack on it. Be it a SQL injection or account compromise (or sheer negligence and publishing the database),
23.
by Xk 15y ago
> and/or stop using a single word and use sentences (phrase) True. This isn't meant for the user, though. This is meant for the developers. No matter how hard the developers try, users will always pick bad passwords. If you use salted S
24.
by Xk 15y ago
> don't disagree with most of what you said, but...you sure about this part? Yes. I am sure. I have far, far, far less than 0.000001% of the total money in the bank. If they could not produce this much money when I wanted it, there wo
25.
by Xk 15y ago
If I had any bitcoins hosted on mtgox and, for some reason, had not already taken them out, I would do so right now . When you give them your bitcoins, you are trusting them to keep your money safe. I trust my money with my large bank for
26.
by Xk 15y ago
That is indeed what it sounds like, but what's really worrisome about that is that anyone who thinks the solution to keeping passwords is to triple-salt them really needs to learn some things about keeping passwords safe. I could quintuple-
27.
by Xk 15y ago
(1) You should put your email in your "about" section so the rest of us can see it. (2) Do you have the source of it? Do you have a non-obfuscated version? (3) Even if the answer to both questions in (2) is "yes", I still doubt any serious
28.
by Xk 15y ago
> Maybe it is public/private key, and they use (derive?) the public key from the name of the server? How would that work though? Maybe I just don't know enough, but I can't think of a way to generate a public key from some known source,
29.
by Xk 15y ago
If they're using their own algorithm and then AES, what's the point? They're worrying about AES being broken? But yeah, you're right. Seems like it would be better to spend time on the implementation of other parts of their botnet (like ...
30.
by Xk 15y ago
> TDL-4's makers created their own encryption algorithm Two comments about this -- I give it maybe a week or two against a good cryptographer. You never, ever invent your own encryption algorithm. -- Even if the encryption algorithm hap

More ›