Buge

56 ms·

571.
by Buge 9y ago
She might have malware. My parents' machine had a malicious extension that made all the search results terrible.
572.
by Buge 9y ago
I know a bit about token bound channels. But the u2f device only talks to Chrome via usb. So anything that the legitimate chrome could say to the u2f device (negotiating tokens, channels, etc) can now be done by the attacker via webusb. So
573.
by Buge 9y ago
>For some reason the FIDO alliance decided they didnt want OTP. OTP is regularly phishable, not requiring any webusb. Before this webusb attack, u2f was unphishable.
574.
by Buge 9y ago
How would that help? Couldn't the webusb simply lie to the u2f device about what the channel is?
575.
by Buge 9y ago
The purpose of a Yubikey is to prevent users from making mistakes. This phishing attack removes the benefit that Yubikeys provided. Sure a smart users can decline the permission prompt. But a smart user can also simply not enter their passw
576.
by Buge 9y ago
CORS is irrelevant. >The attackers would need to get that nonce from the site. The attackers have their own machine with a browser running on it that visits the real site and gets the nonce, then hands that nonce to the victim to be sign
577.
by Buge 9y ago
>So don't do that. How about you tell users to simply not enter their password into phishing sites? When users want to do something (sign in) and there are instructions on the page telling them to do something (enter password or acc
578.
by Buge 9y ago
Yes, here's an article describing the feature from 2010. https://www.pcworld.com/article/213894/Facebook_Adds_Facial_...
579.
by Buge 9y ago
Whether the device will last 1 year, or last 3 years, doesn't change whether you should spend 30 minutes to save $50. The rich people who changed their answers were still illogical.
580.
by Buge 9y ago
>All useful applications need at least some asymmetric crypto, even if it's just to distribute keys for more efficient symmetric crypto. File encryption, whether it be my entire hard drive, or just my password database, doesn't
581.
by Buge 9y ago
You are misunderstanding the article. The study asked some rich people "would you spend 30 minutes to save $50 on a $300 item". Some rich people said yes. Then they asked "would you spend 30 minutes to save $50 on a $1000 ite
582.
by Buge 9y ago
You're thinking that the question is "should I this item or not", or "should I buy this item now or wait a while". Then it could be logical to prefer the higher percent discount. But that's not what the study a
583.
by Buge 9y ago
I think you're misunderstanding. The question had nothing to do with whether the more expensive tablet is better or not, or which one someone would rather buy.
584.
by Buge 9y ago
>Most people think about a dollar as a dollar. They're correct. You should spend the same amount of time to save a dollar on A as you do to save a dollar on B. And you should spend 100x as much time to save $100. If you're will
585.
by Buge 9y ago
Do the ads use any more CPU cycles than the regular video does? And which are more intrusive, TV ads or youtube ads? I can skip youtube ads.
586.
by Buge 9y ago
Not if it was done by an intelligence agency that intends to keep it secret.
587.
by Buge 9y ago
This is covered in the blog post: >With one major exception — iCloud Keychain, which I’ll discuss below — iCloud fails the mud puddle test. That’s because most Apple files are not end-to-end encrypted. The blog post is saying that iCloud
588.
by Buge 9y ago
Looking at Redbox's website, it looks like you have to buy a physical thing containing the code and pick it up at the box. I assume directly telling you the code digitally would be more legally troubling.
589.
by Buge 9y ago
I've heard of Redbox, but didn't hear about these codes.
590.
by Buge 9y ago
There are 3 possibilities for repairing: 1. The government makes a law saying companies have to let you repair. 2. No laws, companies can make it hard to repair, and you can try to repair. 3. The government makes it illegal to repair (becau
591.
by Buge 9y ago
Even if the site doesn't use javascript to update the DOM, it's still vulnerable to similar attacks [0]. The real problem that the attacks relies on is the ability to inject CSS that can load external resources. And Instagram does
592.
by Buge 9y ago
That only works if the website you're logging into supports it. I highly doubt thewingmen.info or avolatvolavitdescendit.com support that (they don't even have https!). Also it requires your browser to support it. And even then, m
593.
by Buge 9y ago
Even if you don't save passwords in Chrome, malware can still keylog you, or steal your password from whatever other password database you use.
594.
by Buge 9y ago
>Elliptic-curve cryptography relies on modular arithmetic, meaning that the values of the numbers that figure into the computation are assigned a limit. If the result of some calculation exceeds that limit, it’s divided by the limit, and
595.
by Buge 9y ago
I wonder when it's going to happen.
596.
by Buge 9y ago
That "Google products" link doesn't show a single Google product.
597.
by Buge 9y ago
And I can't buy Windows laptops at an Apple store. That's because Apple stores only sell Apple products, nothing else. People don't go to an Apple store when they want to buy some arbitrary item. People do go to Amazon when t
598.
by Buge 9y ago
Is Google banning Prime Video from using chromecast? I thought chromecast used an open API and anyone could cast to it. https://developers.google.com/cast/docs/chrome_sender_integr...
599.
by Buge 9y ago
Doesn't the postal service already scan every piece of mail and put those images in a database?
600.
by Buge 9y ago
These only allow attacks where the desired data exists in the html of the page that the browser downloads (or can be forced there). You can also do font-based attacks that will steal data that is entered dynamically. http://mksbe

More ›