bcrypt

6 ms·

1.
Show HN: Search tool for Bay Area childcare license violations(azuki.vip)
2 points by bcrypt 5mo ago|0 comments
2.
Show HN: Home Exercise Routine Generator(random.training)
2 points by bcrypt 6y ago|0 comments
3.
by bcrypt 7y ago
Tor Browser does more than just proxying. See my response above.
4.
by bcrypt 7y ago
i run security at Brave and here's the answer from Taylor, our lead Tor dev: Using the Tor network is one part of internet anonymity, serving to conceal where you are. But using the Tor network does no good if the application helpfull
5.
Markov mashups of Erowid trip reports and ICO whitepapers(twitter.com)
37 points by bcrypt 9y ago|4 comments
6.
by bcrypt 10y ago
Having visited her (I wrote the original post), I can say this is absolutely untrue. She is much, much better off in the prison among other inmates than in solitary. IIRC, solitary was one of the worst experiences she went through.
7.
by bcrypt 10y ago
FWIW, Chelsea reads every single letter she receives unless it's illegible. Mail is much appreciated. -yan (author of blog post)
8.
by bcrypt 11y ago
Yeah, part of the nice/scary thing about HSTS is that it is a highly persistent cache. The browser is reluctant to clear it because it's a security feature. So HSTS pins can be stored for up to a year in FF/Chrome, even if yo
9.
by bcrypt 11y ago
Tor Browser restricts js timing precision to 100 milliseconds, which makes this way harder. HTTPS Everywhere also creates a lot of false positives, although those can be subtracted out. See discussion at https://trac.torproject.o
10.
by bcrypt 11y ago
[edit - just realized this may not answer the question you asked, which is leaks that take advantage of HSTS/HPKP/CSP. hopefully still useful info.] I may write a blog post later about this, but here are a few that come to mind (o
11.
by bcrypt 11y ago
In addition to Egor's stuff, I'd recommend just reading the "Privacy and Security Considerations" sections of various RFC's and W3C specs. Lots of theoretical attacks in there that people simply haven't built d
12.
by bcrypt 11y ago
In any case, I didn't minify or remove comments, so you can just view-source: http://zyan.scripts.mit.edu/sniffly/index.js
13.
by bcrypt 11y ago
Yeah, I think the accuracy so far has been like 75-80% among my friends (once httpseverywhere is disabled). PS: you can check whether sites are in your HSTS cache in chrome at chrome://net-internals#hsts
14.
by bcrypt 11y ago
I pulled the list of domains out of the Alexa Top 1M plus some domains that my friends run. But I'm not biasing results towards showing up as visited by popularity or anything like that. I didn't set up analytics to figure out how
15.
by bcrypt 11y ago
adblocked domains are indistinguishable from hsts blocked domains in terms of timing. so they show up as false positives. a clever attacker could subtract them out though.
16.
by bcrypt 11y ago
what browser and extensions? feel free to file a bug at github.com/diracdeltas/sniffly
17.
by bcrypt 11y ago
interesting, are you using any browser addons? please file a bug at https://github.com/diracdeltas/sniffly , thanks
18.
by bcrypt 11y ago
sort of. the hsts cache gets cleared when a private browsing session is closed or when you clear it manually in browser settings. it takes a long time (up to a year) to expire on its own.
19.
by bcrypt 11y ago
creator here. sorry, i did not expected to be hn'ed. not running js is usually a good idea though!
20.
by bcrypt 11y ago
There's actually a fair number of security researchers looking at browser-level exploits like those in JIT (c.f. pwn2own). My colleague Chris Rolhf co-authored a cool study on attacking JIT: https://www.nccgroup.trust/u
21.
by bcrypt 11y ago
That's really surprising. Thanks!
22.
by bcrypt 11y ago
That's correct. I did not discover vulnerabilities in existing libraries or add backdoors to any of them. :) The attack scenario described in the post is (1) attacker writes some plausible-looking patches to an existing library like jQ
23.
by bcrypt 11y ago
OP here. Agree there probably isn't much benefit to minifying server-side code. However, I wouldn't be surprised if things like Closure Compiler were useful server-side. Not convinced that HTTP2 will eradicate minifiers; it makes