ecesena

59 ms·

1. 661.▲
   by ecesena 8y ago

   If you say "is hiring me" I assume you've not started yet. Given that launching a startup is no joke, if I were you I'd start working on the tool for them, paid in full, keeping your idea to turn it into a startup in bac
2. 662.▲
   by ecesena 8y ago

   +1 - Looking forward for Cryptography II
3. 663.▲
   by ecesena 8y ago

   How about starting with AWS SageMaker? The blog posts at the bottom are nice tutorials that you can go through quickly: https://aws.amazon.com/sagemaker/developer-resources/
4. 664.▲
   by ecesena 8y ago

   Yes, you can have a single certificate for both a.com and b.a.com. You can also have it for a.com and <star>.a.com. No, you can't get <star>.com. Typically, at least for known root CAs, you have to prove ownership of your t
5. 665.▲
   by ecesena 8y ago

   I'd be curious to know how many phishing sites support 2fa, i.e. can also phish time-based codes. If anyone from PhishLabs is reading... :) Edit: grammar
6. 666.▲
   by ecesena 8y ago

   There are great comments on the technology itself, including SQS/PubSub/RabbitMQ, or Celery. However if you need 1) management, i.e. easy way to look at what went wrong and retry 2) dependencies between jobs, you should look into
7. 667.▲
   by ecesena 8y ago

   Solo, an open source security key: https://github.com/soloKeysSec/solo/ In terms of dev/sw, the most exciting things are 1) adding support for openpgp/ssh in addition to FIDO, 2) rewriting the firmware i
8. 668.▲
   by ecesena 8y ago

   If anyone is interested in code, this is an implementation in Java made by a friend: https://github.com/comodal/secret-shamiracle
9. 669.▲
   by ecesena 8y ago

   The hostname of the website you're visiting is cryptographically signed by the security key. So, if by accident you're on phishing.com, the key will generate a signature containing phishing.com. When the attacker forwards it to go
10. 670.▲
    by ecesena 8y ago

    My personal opinion: it's enough and you should recommend it on Google & Facebook, particularly to protect against phishing, and especially to non-tech people. Security keys are supported on Google and Facebook on (almost) all brow
11. 671.▲
    by ecesena 8y ago

    Note that this is only for a login from a new device. If you have your phone, you can change the settings easily. Same if you have a browser already logged in.
12. 672.▲
    by ecesena 8y ago

    U2F also works over usb on Android. Not sure it's very usable, but it works.
13. 673.▲
    by ecesena 8y ago

    Currently works on Chrome, Firefox, Edge. Safari is under development: https://webkit.org/status/#feature-web-authentication
14. 674.▲
    The Next Era of Bug Bounty at Pinterest(medium.com)

    2 points by ecesena 8y ago|0 comments
15. 675.▲
    by ecesena 8y ago

    Would it be possible to know, ballpark, how much a similar security assessment can cost? I understand it's hard to say in general, but given this output I assume it's possible to "get a quote". In an ideal world, all sec
16. 676.▲
    by ecesena 8y ago

    Lately I read this interesting article on STM flash protection, incredibly clear, but also rich of low level details: https://www.usenix.org/conference/woot17/workshop-program/pr...
17. 677.▲
    by ecesena 8y ago

    I’d also highly recommend to share a link to your code now. You’re top on hn/ask, you’ll get quite some folks looking at it and maybe someone is interested in helping you out.
18. 678.▲
    by ecesena 8y ago

    You should check out bombsheller, custom 3d printed leggings, very high quality. (I’m not affiliated but I know the people running it.) http://bombsheller.com
19. 679.▲
    by ecesena 8y ago

    Can anyone confirm if the server certificate in the server hello message is encrypted or not? I've heard many time it's encrypted, but I can't find it explicitly written in the RFC. And it seems unencrypted in this example.
20. 680.▲
    by ecesena 8y ago

    Pinterest | Security | San Francisco, CA or Seattle, WA | Full-Time | Onsite I'm looking specifically for Product Security, but my team is also hiring for Infra & Corp Security. Feel free to reach out directly, I'll need your
21. 681.▲
    by ecesena 8y ago

    Thanks for the pointer.
22. 682.▲
    by ecesena 8y ago

    > BPF is a highly flexible, efficient code execution engine in the Linux kernel that allows bytecode to run at various hook points, enabling safe and easy modifications of kernel behaviors with custom code. Can someone explain the
23. 683.▲
    Attacking Google Authenticator(unix-ninja.com)

    1 points by ecesena 8y ago|0 comments
24. 684.▲
    Launching a Technical Kickstarter – Solo: Open Source Security Key(hackernoon.com)

    1 points by ecesena 8y ago|0 comments
25. 685.▲
    by ecesena 8y ago

    Thank you! Yes, the color is exactly an attempt to attract other people. And yes, your comment is exactly my point :) > why someone concerned about security should bother about color First: why do we have colored phones then? Why someone
26. 686.▲
    by ecesena 8y ago

    Thank you for this, I'm one of the creators of Solo. BTW, to add to your point, a couple interesting numbers. 1) Search "login" on Kickstarter [1]. All 22 campaigns from 2011 to 2018 have failed! 2) Search "security&quot
27. 687.▲
    Open Source Security Key – Launching a Technical Kickstarter(hackernoon.com)

    2 points by ecesena 8y ago|0 comments
28. 688.▲
    Open Source Security Key – Launching a Technical Kickstarter(hackernoon.com)

    2 points by ecesena 8y ago|0 comments
29. 689.▲
    by ecesena 8y ago

    Open source code: https://github.com/SoloKeysSec/solo Previous discussion: https://news.ycombinator.com/item?id=18131651
30. 690.▲
    Solo: open source security key – last week on Kickstarter(solokeys.com)

    2 points by ecesena 8y ago|1 comments