evanreichard

9 ms·

61.
by evanreichard 5y ago
Interactive demo doesn't appear to work on Firefox?
62.
by evanreichard 5y ago
About a year ago I was attempting to book a room through the Hilton payment system but my card kept getting declined. Opening up the web inspector revealed that the JS was stripping any leading 0's for the CVV. I ended up manually craf
63.
by evanreichard 6y ago
This is hilarious. I have another somewhat related story. Back in 7th grade I stumbled upon the "net send" command. So, bored in the back of class one day, I sent a few messages and saw them pop up simultaneously on all the comput
64.
by evanreichard 6y ago
Agreed. Just pointing out what information they have access to if they wanted to start logging as much as they could.
65.
by evanreichard 6y ago
My understanding: If you verify the safety numbers in person, then I believe you can be confident that it's E2E encrypted for that conversation. If the safety numbers are different, then there could be a nefarious actor listening in. S
66.
by evanreichard 6y ago
I know in Chinese "four" is pronounced: sì (四) - which sounds very similar to "death": sǐ (死). There's some additional context about the numerology here: https://en.wikipedia.org/wiki/Chinese_nu
67.
by evanreichard 6y ago
I keep a copy of CyberChef [0] locally. Can do the majority of the data manipulation I need. Does JWT Decoding / Signing / Verification and JSON Validation / Pretty as well. You can experiment with insignificant data here [1]
68.
by evanreichard 6y ago
This is the block list I use if anyone is interested: https://raw.githubusercontent.com/jmdugan/blocklists/master/...
69.
by evanreichard 6y ago
There was no reference to the iPhone model in the Twitter thread that I noticed besides the logo, which could be an iPhone X. The iPhone X is vulnerable to an unpatchable BootROM exploit (checkm8), which could bypass the need to even brute
70.
by evanreichard 6y ago
Yeah, thats exactly my point. So the MITM who got the PW after client side hash, but before server side salt and hash would have to brute force that hash in order to use it on those other sites. That's the only benefit I see, and a ver
71.
by evanreichard 6y ago
I think (s)he is saying to hash client side, salt, then hash again server side. So if the database gets compromised, the attacker still has to apply the salt to brute force the hash. I can't see a reason why this hurts, but it's p
72.
by evanreichard 8y ago
I did something similar. Hook "WebSocket.prototype.send", check if arg is type "typing", if so return. Likely against their ToS ( https://old.reddit.com/r/programming/comments/9bc6gi/by
73.
by evanreichard 10y ago
The author doesn't say to re-lock the bootloader or restore the stock recovery. Having a indefinitely unlocked bootloader and an unsafe recovery is a huge security risk. After installing LineageOS you should restore the stock recovery
74.
by evanreichard 10y ago
> Also, community colleges are a great resource. I think my lackluster grades in High School were actually a blessing in disguise. I attended Rockland Community College (as no one would accept me anywhere else) and received an A.A.S. in
75.
by evanreichard 10y ago
SafetyNet is pretty flexible. It actually isn't implemented inside any APK - "The SafetyNet service reaches out to a Google server and downloads a binary package with the code. It goes to great lengths to validate the integrity of
76.
by evanreichard 10y ago
You can get several /48 and /64 IPv6 allocations from Hurricane Electics TunnelBroker for free.
77.
by evanreichard 10y ago
The Rimac Concept_One is a fully electric car that has two gears (DCT though). I'm not sure any one has tested as to whether the range is extended in one gear vs the other. I would assume it would.
78.
by evanreichard 10y ago
Click "web" right under HN's link to the article and then access it via Google. No more pay wall.
79.
by evanreichard 11y ago
Why not use an SSH tunnel as a SOCKS proxy? Would save you a few steps there.