ejcx

45 ms·

391.
CrashSafari.com Analysis(ejj.io)
3 points by ejcx 11y ago|0 comments
392.
Abusing Your Browser: Infinitely Large Favicons(ejj.io)
92 points by ejcx 11y ago|44 comments
393.
The Web Is Dangerous: Phishing and Browser Extensions(ejj.io)
25 points by ejcx 11y ago|3 comments
394.
by ejcx 11y ago
Nowhere in this thread/article is any mention of the Credential Management draft[0]. This is something I expect to see in canary in the next yr and a half. [0] - http://w3c.github.io/webappsec-credential-management&#x2F
395.
by ejcx 11y ago
Is it really that bad still ? I went to JMU from 2008-2014 and I remember only two shooting deaths. One in 2008 and one in 2014. I just looked it up and there were 4-5 in the time I was there, most under unusual circumstances (partying, do
396.
by ejcx 11y ago
Am I understanding this correctly? Just under 10% of the cost was spent on fonts? $~800? That seems unbelievably high.
397.
Handling Go: Authentication The Right Way(ejj.io)
6 points by ejcx 11y ago|0 comments
398.
by ejcx 11y ago
Thanks a lot. I'm familiar with those projects and while v1 of my project doesn't use it it would be amazing to use it for the higher interaction canaries/honeypots I build.
399.
by ejcx 11y ago
Hey I really appreciate the interest. If you email the email address in my profile I'll make sure to get you set up for free when I'm set up in the next month. The same "email for free access" offer goes for anyone else
400.
by ejcx 11y ago
I have a logging and alerting aspect with email/SMS, as well as way more types of services than just SSH. Mine are also easily hackable from a developer standpoint. People who buy it can easily add new alerting and logging servers of t
401.
by ejcx 11y ago
I've already built it and I am finalizing website copy, static pages, etc before launching. I built network 'canaries', for lack of a better word, that do a couple things. 1) They emulate popular services, Web Server, FTP
402.
by ejcx 11y ago
I'm not sure what your comment adds and if I'm reading it right there is a lot of information that's just blatantly wrong I cant discuss your whole comment because it's long and I'm on a phone. "If you issue y
403.
by ejcx 11y ago
There are many reasons. One old reason is because your browser will only make so many concurrent Connections to one domain, so this spreads the load. I'm not sure how many concurrent resources they will download nowadays though. Anothe
404.
by ejcx 11y ago
I'm in the same loop. Click link, verify email, tells me to login, already logged in, re log in, verify url, still says verify. With that. Congrats to all three of you. It's an exciting day edit: Woot. Fixed.
405.
by ejcx 11y ago
I think the syntax is terse mostly for the sake of example. There's a lot going on in about 3 lines.
406.
by ejcx 11y ago
Their cert used to be an EV cert. I remember this because the address bar looked absurd as an EV cert "The Washington Post" plus the extra iconography associated with an EV cert. It took up a quarter of my URL bar on a small scree
407.
by ejcx 11y ago
Lots of very partisan folks here. My mother is an avid believer that climate change is a hoax and we don't need to take care of the planet. She says 'Mother earth knows how to take care of herself', but she deeply respects Ar
408.
by ejcx 11y ago
Please do not add allow domain "*" into your crossdomain.xml EVER unless on a CDN domain (a domain specifically for hosting a CDN) or serving static files. This breaks SOP.
409.
by ejcx 11y ago
Anyone have explanations on how this is possible? I'm familiar with the basics of options trading but it is still very confusing...
410.
by ejcx 11y ago
Go learn. It's always best to learn on the job and start something, but not everyone is in that position. Take a hard job where you will learn the most, and get to where you want to be in the future.
411.
by ejcx 11y ago
Downloaded it. Hopefully being a new browser it might be minimal on power gobbling? Interesting to note. I downloaded it and checked it for SRI, sub-resource integrity, and it isn't supported. I used my tester https://ejj.io
412.
by ejcx 11y ago
I can break mobile apps too, but my workflow is less pretty for churning through a hundred companies, so didn't do anything mobile for the talk. The talk was 100% web based
413.
by ejcx 11y ago
I did my first conference talk[0] on this, and also have a similar list. Security consulting is expensive and the value just isn't there at all for early stage companies. It's why I think Owasp top 10 should be required reading fo
414.
by ejcx 11y ago
like you said, the security considerations are mostly theoretical. It actually might seem basic turning it into a real attack but it requires a fair bit of work. It is always my favorite section of the RFCs. Along with anywhere that says &q
415.
by ejcx 11y ago
AFAIK most of that info is in HN and twitter discussions between webappsec people. Here's a link[0] to a CSP leak that was briefly discussed on the webappsec mailing list. I also know Homakov wrote one[1]. That's one of the reason
416.
by ejcx 11y ago
Preload does not suffer the same issue as pinning using a header. All sites on the list would just look like you probably visited them, which means ambiguity. Not all UAs share the same preload list, but they all borrow from the chrome prel
417.
by ejcx 11y ago
There's a lot of pressure to turn the includeSubdomains flag on, with the new Google Submission Process (submit a form to hstspreload.appspot.com). Not all businesses are in a situation where they can just turn on HTTPS across all subd
418.
by ejcx 11y ago
No. Leaks were known far beyond the "supercookie", but attacks were not as high quality as these.
419.
by ejcx 11y ago
Mitigation, get your site added to the HSTS Preload list. Most of the advanced webappsec security features leak information. CSP, HPKP, HSTS, etc, which was all 100% known. This talk is excellent because it puts together the attacks into re
420.
by ejcx 11y ago
Security is kind of a weird space. You can't just buy security. It's lots of consulting and training firms with some products that enterprises buy. I have a feeling this is going to be just like all the other ones, with some propr

More ›