ejcx

38 ms·

331.
Show HN: Pennyearned, a free Pinboard like spending tracker(pennyearned.in)
3 points by ejcx 10y ago|2 comments
332.
by ejcx 10y ago
This is interesting. Doping is really common in a lot of other sports too, weightlifting being the one I personally care about. The IAAF banned Russia not the IOC. I don't like that this is being enforced inconsistently so I'm cur
333.
Credential Management Comes to Google Chrome(developers.google.com)
2 points by ejcx 10y ago|0 comments
334.
by ejcx 10y ago
OP isn't blaming the victim. Op is playing with fire, KNOWS IT, and is surprised when they get burned. Right now there are many solutions for password management. Free and open source, free and closed source, paid and closed source, en
335.
GitHub Security Update: Reused Password Attack(github.com)
250 points by ejcx 10y ago|135 comments
336.
Show HN: Pennyearned is pinboard for expense tracking(pennyearned.in)
2 points by ejcx 10y ago|2 comments
337.
by ejcx 10y ago
Heheheh, no problem. I recognized it was your article, Tom. Sorry to be pedantic. Jose is really just way too complicated. Go Dukes!
338.
by ejcx 10y ago
If you have a secret in the JWT you definitely want to encrypt it (JWE instead of JWS). But yes, it's true. A signature will protect against manipulation though, like the article points out, which is enough for a lot of applications.
339.
by ejcx 10y ago
Just to be a little bit pedantic about the article. Do not contain any sensitive data in a JWT. If there's nothing sensitive in the JWT then why might we encrypt it? Sometimes the whole purpose of a JWT is to pass some sensiti
340.
by ejcx 10y ago
A couple things that I think are important to being more "senior" - Owning the problem. Don't pass the buck when you see a problem and it's well within your realm to own and fix. - Ownership and delivery. You have to del
341.
Show HN: Pennyearned, a pinboard like spending tracker(pennyearned.in)
10 points by ejcx 10y ago|0 comments
342.
by ejcx 10y ago
I think that JWTs are not what you're looking for. JWT's are meant to be stateless. Encrypt some claims, sign them, but no storage is necessary. A truly stateless system and the concept of revocation are mutually exclusive. When y
343.
by ejcx 10y ago
I think it's a great name. The author probably has this as a binary living in his PATH so they can just type $ arc <args> It might be obvious, but who wants a long or strange name when you're using a command line ut
344.
by ejcx 10y ago
I actually added this same type of warning when I worked at lastpass.com (you can see it on their login page). It's attempting to solve the "people" problem in security. Even if you can make a site bulletproof from XSS, it is
345.
by ejcx 10y ago
This is super awesome! It's a good speedtest that works on mobile, which I had not been able to find. Funny thing is I found this in the source.  <!--&l
346.
by ejcx 10y ago
Yes. It is. I went down hard...
347.
by ejcx 10y ago
This article is strange. Unless something has changed recently, AP exams do not have a concept of pass or fail. You get a score and colleges can choose to give you college credit based on the score. I got a 1 on the AP Calculus exam but col
348.
by ejcx 10y ago
SEEKING WORK - SF, DC, Seattle, NY, and Remote. Application Security on all layers of the stack, Security Engineering, and security engineering at a massive scale. You can contact me at evan@twiinsen.com
349.
by ejcx 10y ago
Many have pointed out that it's a recruiting effort, which it is. But it's also an easy way to get rid of people who don't work out. If it's clear an intern is not performing well or not cut out, it's easier to weed
350.
by ejcx 10y ago
I don't buy your second point. Your argument is that an attacker can try the password elsewhere faster, when the list of sites an attacker is interested in is small. An attacker could try every site in the Alexa 1m before anyone knows
351.
by ejcx 10y ago
Ah great find. This also needs to be checked. Thanks
352.
by ejcx 10y ago
Some people may disagree with me but that's fine. There really isn't a correct answer here. It's a product decision balanced with security. I think _strongly_ wanting this is mostly FUD. I firmly believe in secure defaults (w
353.
by ejcx 10y ago
Not encrypting site names was a UX decision. If site names were encrypted, listing entries in your password store would require a prompt for your password.
354.
by ejcx 10y ago
Sharing the password informally generally leads to bad practices, like a group email with the password, or multiple sticky notes. A password sharing solution I have no problem with since there are real reasons to share
355.
by ejcx 10y ago
I went with a master password and AEADs because I don't like GPG. It appeals to a bigger number of people, too, since not all devs understand GPG and shouldn't be expected to.
356.
by ejcx 10y ago
Sharing a password is bad for several reasons. I plan to build sharing in to passgo, since I realize it would simplify things for a lot of teams
357.
Show HN: passgo, a command line password manager written in go(github.com)
40 points by ejcx 10y ago|47 comments
358.
by ejcx 10y ago
The point is they have consistently given money to people who are trustworthy and asking them to do their best work. Not all branches of government share the same goal.
359.
by ejcx 10y ago
Many people held in high regard by HN for "encryption apps" received DARPA grants for similar work (through CFT). For example, moxie [0]. DARPA does good work and I'm sure they are very interested in having a bullet proof sec
360.
by ejcx 11y ago
To go deeper, the challenge of balance begin from the most basic decision in Starcraft. Starcraft has three races and random. At top pro levels, picking random is unheard of and actually extremely difficult to play against because it compli

More ›