arkadiyt

74 ms·

961.
by arkadiyt 6y ago
What is an ICO really - just a company minting tokens for people that they can exchange for something. They're not using any of the properties of blockchain, and no one is running nodes except for the company itself. They should just s
962.
We were not hacked, a clever criminal convinced us to give him our data(mybroadband.co.za)
3 points by arkadiyt 6y ago|0 comments
963.
Spotify hit with outage after forgetting to renew a certificate(bleepingcomputer.com)
37 points by arkadiyt 6y ago|8 comments
964.
by arkadiyt 6y ago
Cloudflare CEO Matthew Prince has already tweeted [1] his support: "Sad to see Joe Sullivan allegations. Joe's had a distinguished career as a US Attorney & exec at eBay, PayPal, Facebook, Uber & Cloudflare. Anytime an opp
965.
Expired certificate led to an undercount of Covid-19 results(bleepingcomputer.com)
2 points by arkadiyt 6y ago|0 comments
966.
by arkadiyt 6y ago
Also the fact that libxml2 has had frequent vulnerabilities over the years.
967.
by arkadiyt 6y ago
I've been a Mullvad customer for several years now and love it - thank you for the service.
968.
by arkadiyt 6y ago
Individuals and organizations certainly run malicious exit nodes, but there's literally not a hint of evidence in this post to backup the author's claim that these exit nodes are operated by a single group?
969.
by arkadiyt 6y ago
Previous discussion: https://news.ycombinator.com/item?id=24077359
970.
by arkadiyt 6y ago
> I suppose it's not much of a security risk. It wouldn't be much of a security risk if the authors had correctly isolated user content into its own origin, which would have made this a self-xss only. As it stands the app itsel
971.
by arkadiyt 6y ago
Take backups, practice restoring them, invest in a security program.
972.
Cybersecurity and the Board: A Fresh Perspective?(philvenables.com)
1 points by arkadiyt 6y ago|0 comments
973.
by arkadiyt 6y ago
There is an explosion of no-code tools these days - companies have gotten paying customers and become profitable without writing a single line of code. I'd try making a PoC and seeing if you can find interested customers.
974.
A new default Referrer-Policy for Chrome: strict-origin-when-cross-origin(developers.google.com)
2 points by arkadiyt 6y ago|0 comments
975.
Should web apps use PAKEs?(emilymstark.com)
3 points by arkadiyt 6y ago|0 comments
976.
by arkadiyt 6y ago
The companies that were hacked as a result (Dave.com, Flood.io) must have been storing secrets in source code, which has got to be one of the most negligent ways to suffer a breach.
977.
Twitter contractors reportedly made a 'game' of accessing Beyoncé's data(engadget.com)
2 points by arkadiyt 6y ago|0 comments
978.
Tech unicorn Dave admits to security breach impacting 7.5M users(zdnet.com)
2 points by arkadiyt 6y ago|0 comments
979.
Instacart blames reused passwords for account hacks, but still doesn't have 2FA(techcrunch.com)
1 points by arkadiyt 6y ago|0 comments
980.
by arkadiyt 6y ago
It doesn't seem so bad to me. Fetch Metadata will be handled by your framework of choice (Rails, Django, etc) & COOP is a single header that can be deployed by the security team in your app or at the edge. TrustedTypes are the only
981.
by arkadiyt 6y ago
Fantastic summary. For anyone wanting to search CT logs, Sectigo operates https://crt.sh/ for that. For instance here are all non-expired certificates containing a twitter subdomain: https://crt.sh/?Identity
982.
Cryptography Dispatches: Replace PGP with an HTTPS Form(buttondown.email)
13 points by arkadiyt 6y ago|5 comments
983.
by arkadiyt 6y ago
- config.cryptography.password is always set to a default value if not provided, it will never hit your error case [0]. This is trivially verifiable and I suggest you try it. - no, you accept the algorithm as an environment variable - someo
984.
by arkadiyt 6y ago
This seems dangerous to use? Just a few issues looking at the code: - No master password is required - if you don't set one a default value of "hide" is used - The description says it uses AES256 (it is the default) but the c
985.
Cryptography Dispatches: DSA Is Past Its Prime(buttondown.email)
2 points by arkadiyt 6y ago|0 comments
986.
by arkadiyt 6y ago
The author touched on the performance problem but is anyone aware of homomorphic encryption being used in the real world today, outside of academia?
987.
by arkadiyt 6y ago
Chime | Application Security, Infrastructure Security | Full Time | Remote during covid & SF/Chicago/Vancouver after Chime is the largest and fastest-growing player in the challenger-banking space, providing mobile and online
988.
by arkadiyt 6y ago
They could do the same by using the access keys directly - using this service is strictly better since it would identify the attacker by their Stripe payment method.
989.
by arkadiyt 6y ago
For personally monitoring his parents' health it works great. For accepting healthcare data from the public it's unacceptable.
990.
by arkadiyt 6y ago
> Bank level security and best security practices. > All your data is encrypted with 256-bit encryption at rest and the data exchanged with our servers are encrypted with 256-bit SSL. Stuff like this makes me cringe. If this is the on

More ›