anaphor

30 ms·

271.
by anaphor 7y ago
Same. I've been messing with Xlib/XCB/Cairo/etc for the past few weeks and it's all I've been thinking about lately. I guess if you use the Xlib/XCB backends for Cairo surfaces then you would get some sort
272.
DNS Rebinding with Robert RSnake Hansen(youtube.com)
1 points by anaphor 7y ago|0 comments
273.
by anaphor 7y ago
Which is sort of exactly my point. There is no need to have a blanket ban on any linking between local/non-local sites. You just need to make sure they are set up to handle requests securely.
274.
by anaphor 7y ago
A confirmation might be helpful, yes. I think the challenge is to design a standard for that which won't completely flood people with warnings. I'm sure there are some "enterprise" applications that will load a ton of di
275.
by anaphor 7y ago
Also, like someone already mentioned. DNS rebinding is a thing. So the SOP can be subverted under certain circumstances (browsers will do DNS pinning to protect against this but it's not a perfect solution)
276.
by anaphor 7y ago
Define "access". The SOP does not stop a page from initiating a request to any other origin, it stops it from interacting with it , so that, e.g. attacker.com cannot steal your session cookies from banking.com You can do all kind
277.
by anaphor 7y ago
How do you differentiate between a valid and invalid request to localhost / the LAN? Lots of websites will link to something like ` http://localhost:9200` (e.g. Elasticsearch) in the documentation. So you decide to make it i
278.
by anaphor 7y ago
Pretty much everyone involved in the infosec community has known and understood this for the past 20 years or more. I'm not sure how this can make things any worse. If anything it will make things better because now more people are lea
279.
by anaphor 7y ago
They can redirect you as well (or you can put a non-image inside an image tag). Which means you have to make sure it's safe to merely navigate to a page/resource, otherwise you have a "Confused Deputy" vulnerability (i.e
280.
by anaphor 7y ago
If you do that, I would recommend looking at writing an extension first to see if there's any way to do it without a fork (maybe using the same technique that things like ublock origin have) https://developer.mozilla.org&#x2
281.
by anaphor 7y ago
I think just because they're afraid of breaking things? I'm honestly not sure what the rationale was for not implementing this. They do DNS pinning which helps mitigate DNS rebinding attacks, but I don't think they do anythin
282.
by anaphor 7y ago
Pretty sure some tools like NoScript already do that, but to protect against DNS rebinding (which can subvert the SOP), not as a protection against cross-origin requests coming from a public site to an internal one. https://en.wi
283.
by anaphor 7y ago
Not sure why you're getting downvoted. It's a valid point. I think it's because people intuitively think of access control as an answer to the question "Who are you?", which means your authentication credential need
284.
by anaphor 7y ago
I was curious to see if there was any record of this and I found some interesting discussions from '09 https://lists.w3.org/Archives/Public/public-webapps/2009AprJ... Very interesting to read this now.
285.
by anaphor 7y ago
You can work around that by submitting it within an invisible iframe element, e.g. https://stackoverflow.com/a/17953761/903589 But yeah, you can't just make arbitrary requests like this with XHR
286.
by anaphor 7y ago
That makes more sense then. Yes, it will make sure not to send authentication data in that case.
287.
by anaphor 7y ago
I think you could implement that with CORS + CSRF tokens (blocking all types of Cross-Origin requests) but the default behaviour is to allow Cross-Origin writes (e.g. with form submissions). See https://developer.mozilla.org&#x2F
288.
by anaphor 7y ago
> I'm pretty sure you're incorrect - requests to sites different from the one you are currently on will not include auth data by default because of the same-origin policy Not necessarily true. You can have Javascript running on
289.
by anaphor 7y ago
Maybe, but people want to write applications that can easily interact with each other in a secure way. Trying to do that when your browser implicitly authorizes you no matter what the origin of a request is makes that extraordinarily diffic
290.
by anaphor 7y ago
That is because CORS is a kludge to work around the fact that we decided to use session cookies "because developers understand it easily" instead of just re-doing everything. See https://w3c.github.io/webappsec-cor
291.
by anaphor 7y ago
The spotify one is for spotify connect most likely. I'm guessing (although not sure, someone could verify it) that spotify connect requires some sort of authorization to work. Edit: here you go http://cgbystrom.com/arti
292.
Schneier: Full Disclosure of Security Vulnerabilities a 'Damned Good Idea'(schneier.com)
3 points by anaphor 7y ago|0 comments
293.
by anaphor 7y ago
This is why full disclosure is so effective. Nothing else works quite like dropping a full PoC and details of an exploit publicly to light a fire under their ass to fix it.
294.
Good Practices for Capability URLs(w3.org)
2 points by anaphor 7y ago|0 comments
295.
by anaphor 7y ago
Yeah, that's really an unsolvable problem I guess. But you could at least make it clear to the user what some app is requesting. If it's requesting the root capability / ambient authority (basically access to everything) th
296.
by anaphor 7y ago
Have you looked into the object capability model of permissions? https://en.wikipedia.org/wiki/Capability-based_security This is exactly the type of problem it solves, usability with security.
297.
by anaphor 7y ago
This is what things like https://sandstorm.io and Google's Fuchsia OS are trying to solve. Of course it requires a huge shift in how you design applications, but it does not impose any burden on the user's side really.
298.
by anaphor 7y ago
For the longest time the Linux client would just crash randomly. It also tends to heat up your laptop and use all of your cores at 100% if you're looking at someone's screen. Just run `strace -f zoom 2> wtf.zoom` to see all of
299.
by anaphor 7y ago
> Activate the Zoom link and hope the person is AFK. Spy on their home/office/whatever. Also a violation. I think this is the most likely scenario. There are ways you could potentially delay it (e.g. they leave a tab open and y
300.
by anaphor 7y ago
The point is that they shouldn't be confused as having the same goal. The reason object capabilities are so difficult to integrate is that you basically have to refactor all of your software to use a different style of programming. I d

More ›