Stefan-H

11 ms·

91.
by Stefan-H 11y ago
Using a JS lib would not mitigate any risk here unless the compromising of the server that hosts the JS is separate from the compromsing of your web server.
92.
by Stefan-H 11y ago
A malicious server doesn't need malicious javascript to do it, it already receives the password in the plain, but that is what is trying to be mitigated in these efforts.
93.
by Stefan-H 11y ago
As the page points at, the malicious website does not recieve a hash of the password, but rather a public key derivied from the password: "The worst attack a malicious server can mount is an expensive brute force attack, attempting to
94.
by Stefan-H 11y ago
If you read the mechanism, you'll see that this involves more than a site faking the UI - it requires browser integration. This mechanism does not protect a single site, but rather the ability to pivot from one site to another with th
95.
by Stefan-H 11y ago
Not quite - a malicious server would receive the plaintext password in the current status quo.
96.
by Stefan-H 11y ago
My coment is not at all talking about what the OP was doing. I think that he went beyond what he ought to have. I am specifically referring to the mentality of "employees should trust their coworkers and can therefore leave their com
97.
by Stefan-H 11y ago
This mentality is patently wrong to me. You have to realize that maintenance, house keeping, and any manner of other people may enter your area(either legitimate people, or people in disguise). Additionaly, if I were to "go rogue&quo
98.
by Stefan-H 11y ago
The censorship is not happening by the community, it is coming from the admins that are on the reddit payroll. There are some posts that are auto-deleted based off of keywords during some of the more turbulent times in reddit.
99.
by Stefan-H 12y ago
Bug bounty programs seem to be more and more necessary for a mature security program. I feel like this can span the gamut from resources for responsible disclosure all the way to robust bug bounty programs that offer pay outs. The barrier
100.
by Stefan-H 12y ago
I am a big fan of the Nope that had a kickstarted a little while ago. It is small and still allows your macbook to close: http://erlibird.com/go/nope
101.
by Stefan-H 12y ago
I could understand this being a tough position from google's perspective. When talking about how secure something is, one has to consider the threat model - there is not absolute. If the goal is to keep naughty pictures confidential
102.
by Stefan-H 12y ago
It is interesting to consider if this was bred from sloppy ethics or ignorance. It would not shock me to find that someone really thought that this is good enough "security". That being said, those that do not have the skills to
103.
by Stefan-H 12y ago
I actually went the other direction. I have no problem charging my phone every night, and charging a watch at the same time would be a non-issue. Upon hearing that the apple watch will hit a battery life closer to 18 hours rather than the
104.
by Stefan-H 12y ago
If you live in a state that has concealed-carry laws, then you are likely wrong about your comment that "the only time" you interact with people with guns.
105.
by Stefan-H 12y ago
If you are using corporate hardware it should not really be secret that your traffic is being man in the middled, this should be assumed. I think it makes sense for a corporation to be able to whitelist their certificate to make intermedia
106.
by Stefan-H 12y ago
All of the reasons that benefit the company. Data Loss Prevention, web filtering, malware detection, take your pick.
107.
by Stefan-H 12y ago
Trustwave is still in the Mozilla CA bundle: https://wiki.mozilla.org/CA:IncludedCAs
108.
by Stefan-H 12y ago
At this point I feel like we need to simply remove Chinese root CAs from trust stores and have user's opt-in to allowing certificates issued from china. I realize that any CA can be mismanaged, but the risk of Chinese government hands
109.
by Stefan-H 12y ago
Now is the time to ensure you know what your surface area is for OpenSSL. Do you terminate SSL on your hosts? Do you have a loadbalancer that terminates SSL for you? Do you distribute OpenSSL to clients? Do you have network devices that
110.
by Stefan-H 12y ago
With babies we know the shape. It is not as if we are likely to get a 2d slice of just an arm to estimate the age. With tumors we do not have an idea of the shape, and therefore could accidentally take a slice of the narrowest portion the
111.
by Stefan-H 12y ago
So this only applies to those that use doorkeeper to act as oauth providers, not to those that allow logins through other oauth providers, right?
112.
by Stefan-H 12y ago
Am I missing something? While there does not seem to be a reason to allow CSRF here, doesn't the fact that you need to have a client Id and client secret for the oath endpoint make it so that this is a non-issue? https://gi
113.
by Stefan-H 12y ago
In events like this it is a good idea to avoid sites that have apparently been compromised in case they start serving up malware.
114.
by Stefan-H 12y ago
"only sensitive to gluten in American products" I have a hard time believing that the nationality of the gluten has anything to do with her reactions. Perhaps you are confusing correlation with causation? I think the more likely
115.
by Stefan-H 12y ago
I believe this is because the angle of attack shifts as well. A plane that is generating lift away from the force of gravity, if turned 180 degrees on it's forward facing axis, will generate lift facing towards the force of gravity.
116.
by Stefan-H 12y ago
The author specifically mentions he is still under his parent's health insurance.