ejcx

48 ms·

421.
by ejcx 11y ago
To be fair SRI is brand new and doesn't exist yet in most browsers (just went live in chrome in the last..month?). It isn't realistic to expect most people to already be using it.. You can check a particular browser for SRI suppor
422.
by ejcx 11y ago
Says a random tweet from Alex Stamos, who is very well respected in the security community...Oh...and Facebook CSO. Looks like the FB engineers just pop the URL and check for "https?://"[0] at 0 in the string. [0] - htt
423.
by ejcx 11y ago
I think your comment is characterizing exactly what I say not to do, even if you might be right. My comment is about staying healthy over the duration of your life. It's also about doing what you can and not sweating the small stuff. S
424.
by ejcx 11y ago
Fitness and health studies really bug me. People perceive them as actionable when they absolutely aren't and should not be. If your goal is general health in life you only need to do three things (well 4).. 1) exercise regularly 2) ea
425.
by ejcx 11y ago
No. You're actually wrong. The verdict is still out on diet soda and artificial sweeteners. This[1] is required reading. [1] - http://examine.com/faq/is-diet-soda-bad-for-you/
426.
by ejcx 11y ago
You might not need a whole iframe. Why not just an img tag like a regular cross site request forgery over GET. If the WHO isn't logged with any js Magic it will work all the same.
427.
by ejcx 11y ago
Congrats to Bob and Joe and LastPass team. I'm a former LastPass employee and will be forever empressed by their work ethic that I saw. They definitely deserve it.
428.
by ejcx 11y ago
Congrats to Bob and Joe and LastPass team. I'm a former LastPass employee and will be forever empresses by their work ethicc that I saw. They definitely deserve it.
429.
by ejcx 11y ago
Health studies, especially when reported by some article in som publication without an original source are a mess. I personally am extremely skeptical of what the Atlantis says the findings of the paper are. I lost 50 lbs while eating a box
430.
by ejcx 11y ago
Just to let people know. I did some digging into this yesterday Here are the pull requests that fix the bugs. https://veracrypt.codeplex.com/SourceControl/changeset/cf4794372e5dea753b6310f1ca6912c6bfa86d45
431.
by ejcx 11y ago
Not sure about other twitter famous anonaccounts, but @SwiftOnSecurity for example, used to have their real account pointed at SwiftOnSecurity, saying that he was the person managing it. Now SwiftOnSecurity is so huge people who remember&#x
432.
by ejcx 11y ago
In my previous work at a company that made it's money from a browser extension, I saw what hell it was to develop browser extensions for all major browsers. I should note it looks like this issue is mostly fixed going forward. The chro
433.
by ejcx 11y ago
Like others have mentioned, in my experience small startups can and do win Government contracts. Most founders have intimate knowledge of the contract process and a large network from previously working at a large DoD contractor. Once they
434.
by ejcx 11y ago
I've actually seen it cause numerous issues. For example, consider this pseudocode: // Returns binary data shaPass = crypto.sha256(userPassword) // returns an scrypt password crypto.bcrypt(shaPass)
435.
by ejcx 11y ago
By the way. I have an SRI tester to determine if your browser supports SRI. It's still very new and doesn't have a lot of support https://ejj.io/sri/
436.
by ejcx 11y ago
The mobile app does not authenticate by sending plaintext password to the server either.
437.
by ejcx 11y ago
This is not correct. The extension and the webapp authenticate the same way, and neither send the master password over the network. Criticism to using the webapp is generally JS crypto being broken. Code delivered every time coupled with th
438.
by ejcx 11y ago
Full Disclosure. I am a former LastPass employee. This guy's research, and most research regarding password managers is way overblown. Every lp product has a big popup that says "WHAT YOU ARE DOING IS INSECURE" when you click
439.
by ejcx 11y ago
Why? If Uber and lyft did this from the beginning, they would have never lasted a week. "Turns out we can't operate like a Taxi". "Turns out we are actually supposed to be treating the drivers as employees". "T
440.
by ejcx 11y ago
Anyone else notice the date on this article is wrong ? I first expected this to be something about 9/11. I read the date to see when it was published, and it is from tomorrow!
441.
by ejcx 11y ago
Not necessarily. Browser extension APIs have to provide APIs for the way ads are loaded. For example if they are magically loaded, chrome needs to give you an API to intercept magic. I'm not sure if chrome requests API allows you to b
442.
by ejcx 11y ago
I also found this totally strange that people pick up smoking cigarettes once they are old enough to know they are just horrible for you. A recall my first week of college not too long ago. One guy who lived in the same building as me was s
443.
by ejcx 11y ago
By the way, this is a pretty good intro to post-quantum crypto if you are more mathy. http://pqcrypto.org/ The NSA announced they will be transitioning to quantum resistant algorithm in the "not to distant future"
444.
by ejcx 11y ago
Well that's very nice of Python to have an SMTP server module. I did a very similar thing in the past that was an email-sms proxy with the email end being a Postfix email server. It was incredibly painful configuring postfix to pipe em
445.
by ejcx 11y ago
As a fastmail customer I'm glad to hear that.
446.
by ejcx 11y ago
This isn't new territory or groundbreaking research. This is Pocket not performing basic validation techniques. jerf provided excellent information. Maintaining a small blacklist of internal, non-internet routable, and private hostname
447.
by ejcx 11y ago
Every time I see new languages and frameworks being used for web applications I get scared. One reason I am super gung-ho about Golang for an API or website, is it came with the net httplistener package, html/template package, and has
448.
by ejcx 11y ago
From the viewpoint of a security practitioner and engineer I think what Bruce Potter says is really important here. Oftentimes people get hung up in fixing or doing things that are important to do for security, but not a pressing matter, an
449.
by ejcx 11y ago
That seems great. Is there any protection from abuse? It seems that one could say "See you next year" with this and get a year-long vacation. Is that accurate. Would that actually work? Is there any contract saying you won't
450.
by ejcx 11y ago
There's a lot of misinformation about soy and estrogen levels. This[0] is required reading for soy [0] http://examine.com/faq/is-soy-good-or-bad-for-me/ Ps thanks sol (the owner of examine)

More ›