ctz

53 ms·

421.
by ctz 13y ago
I don't think every connection is TLS. This is obviously a critical mistake, given HTTPS stripping is possibly the biggest weakness in current web transport security.
422.
You shouldn't put all your eggs into the TLS forward secrecy basket(jbp.io)
4 points by ctz 13y ago|0 comments
423.
by ctz 13y ago
Replying to myself: It was the first issue. There is a cyanogenmod issue associated with this: https://jira.cyanogenmod.org/browse/CYAN-1602
424.
by ctz 13y ago
This tantilising and makes me want to work out what the problem is pre-Blackhat. Looking at JAR signing in general (which is what Android packages are) I see a few possible flaws: * The zip format doesn't structurally guarantee unique
425.
by ctz 13y ago
I opened the same URL and did get a phishing warning. Version 27.0.1453.116 m on Windows 7 x64.
426.
by ctz 13y ago
Looks to be including javascript from http://www.tynt.com/ which provides this service. It's pretty unreasonable and ineffective.
427.
by ctz 13y ago
Sounds like a good application for an Electric Imp (WiFi controlled GPIO for $30).
428.
by ctz 13y ago
Likewise, I get 700 miles (~1100km) from a 10 imperial gallon (45l) tank. With that said, it's not sensible to compare a modern european small car with the average US car. Particularly the class of car that the Model S is competing wi
429.
by ctz 13y ago
The government is constrained in what it can do I'm wondering if you consider the existence of Guantanamo, rendition, etc. to be within or outside these constraints.
430.
by ctz 13y ago
I completely failed to find the sources for this :(
431.
by ctz 13y ago
The downgrade is done outside the SSL/TLS protocol, by browser vendors (sorry, I should've made it clear that that point was constrained to real-world deployments of HTTPS, rather than a property of the protocol itself). Browsers
432.
by ctz 13y ago
Point by point: The first paragraphs make the mistake of assuming you need to break keys to collect SSL traffic (assuming no PFS). You can start collecting SSL traffic now, and break the keys at your leisure later on. I can see cases wher
433.
by ctz 13y ago
The content in this post is in the section titled 'SSL on CloudFlare'. The text leading up to that is (at best) fluff and incorrect in parts.
434.
by ctz 13y ago
Interestingly the house where Turing lived and died is up for sale: http://www.rightmove.co.uk/property-for-sale/property-383496... (source: you can see the plaque in the first picture, I attended the unveiling at this
435.
by ctz 13y ago
Anyone one know if GCM is coming soon?
436.
by ctz 13y ago
Disagree. Users ultimately are put at risk by shipping broken code. Everything after that doesn't increase risk , but it might realise that risk.
437.
by ctz 13y ago
You won't need any SSL. A user's typical first interaction with notecrypt will be through http://notecrypt.appspot.com (which just needs to evil reverse proxy to the actual site or an emulation, while backdooring the javascript to send t
438.
by ctz 13y ago
You're right, of course. Let me expand my argument a little. We have two security domains, associated with the first and second server. The first server has sensitive URLs, the second receives these in the referrer header. In making the fi
439.
by ctz 13y ago
I'm willing to bet that it gets sent even if the second HTTPS connection provides no effective security. (If this is the protocol we're building economies on these days, I feel computer security is going to get much worse before it gets bet
440.
by ctz 13y ago
Error connecting to database
441.
by ctz 13y ago
It's a UK government health recommendation: http://www.nhs.uk/Livewell/5ADAY/Pages/Whatcounts.aspx
442.
by ctz 13y ago
There was certainly a bug recently where the whole blockchain split and one half of the split ended up losing all the bitcoins they had mined on that limb. As far as cryptocurrencies go, I'd say that was a serious vulnerability.
443.
by ctz 13y ago
Certain weird-shit UNIX operating systems do not provide privacy for a process's environment. (eg. another user on the same box can see them with 'ps e'). More relevantly, POSIX does not require it. The same is not true of process memory.
444.
by ctz 13y ago
s/process/MITM/
445.
by ctz 14y ago
I just watched two people enter their PINs at a Domino's Pizza somewhere in London. The camera in question has historic playback, too. WTF.
446.
by ctz 14y ago
There's no point implementing TLS1.2 until browsers stop silently downgrading through TLS versions under attacker control. And there's not much prospect of that happening: it seems we're happy to exchange compatibility with less than 1% of
447.
by ctz 14y ago
Or, for the RSA keys your find, calculate the GCD of each key with all others and see if any badly generated private keys fall out.
448.
by ctz 14y ago
Sorry 'illegal' in the sense of being contrary to the requirements of the crypto protocol, in the same way that you can have the concept of an 'illegal operation' in a CPU ISA.
449.
by ctz 14y ago
> except the PS3 hack? To be clear, the PS3 problem was not a problem of randomness quality or a PRNG backdoor. It was illegal nonce reuse in the zero-knowledge proof-of-key-possession protocol embedded in DSA signatures.
450.
by ctz 14y ago
What happened to bitcoins 'mined' on the 0.8 chain in the meantime? Did people lose their currency?

More ›