garrettr_

12 ms·

61.
by garrettr_ 11y ago
Not really. Since you need to know the correct hash ahead of time, Subresource Integrity works best when you're requesting a well-known piece of static data from a 3rd-party server, e.g. jQuery version x.y from a CDN. For a site like P
62.
by garrettr_ 11y ago
> b) increasing the probability of malicious injection Subresource Integrity (SRI) [0] was designed to avoid this potential vulnerability. It's a brand-new browser feature (jus t landed in Chrome stable, is riding the trains to Mozi
63.
by garrettr_ 11y ago
I didn't design this so I can't say for certain, but from reading their post there are a couple of benefits that NaCL confers over PGP for generating per-device keys. The most important benefit is probably that NaCL keys are 256-b
64.
by garrettr_ 11y ago
From an ad network's point of view, maybe, but from a publisher's point of view, no. This is just another variation on click fraud, because fake people don't buy real goods. If you actually read the article, the Heineken adve
65.
by garrettr_ 11y ago
The point is that it's using ECB mode with RSA, which indicates the developer has no real knowledge of crypto and is just blindly using pairs of "encrypt/decrypt" functions from Node's built-in crypto lib (which is
66.
by garrettr_ 11y ago
Freedom of the Press Foundation | Software Engineer for SecureDrop | Full time | SF | Python We're a non-profit in San Francisco dedicated to defending transparency and press freedoms in an increasingly surveilled world. We run crowd-f
67.
by garrettr_ 11y ago
https://www.offensive-security.com/
68.
Click-to-Play keeps the Hacking Team away: A guide for Firefox and Chrome users(freedom.press)
4 points by garrettr_ 11y ago|0 comments
69.
by garrettr_ 11y ago
I don't understand the skeptical scare quotes around "separate cookie". If you read the linked bugs, you would see that when SafeBrowsing was originally added to Firefox, it used the same cookie jar, which meant that SafeBrow
70.
by garrettr_ 11y ago
They're designed to trick you , so I don't think any population, no matter how sophisticated, should trust themselves to correctly identify malicious websites 100% of the time. Additionally, some sites may potentially contain exp
71.
by garrettr_ 11y ago
Please for the love of god do not disable the Google SafeBrowsing preferences. SafeBrowsing protects you from a lot of malicious websites, and does not leak much information to Google. For most people the security benefits of SafeBrowsing
72.
by garrettr_ 11y ago
The tiers are Platinum, Gold, and Silver. Check out the current sponsors [0] and info on becoming a sponsor [1]. [0]: https://letsencrypt.org/sponsors/ [1]: https://letsencrypt.org/become-a-sponsor&#x2F
73.
by garrettr_ 11y ago
In that case, sounds like you probably want a wildcard. Also, if this is just your home system and you are the only person who needs access to these machines, why not use a VPN instead? Makes more logical sense, easier to configure, and you
74.
by garrettr_ 11y ago
There are several ways to resolve this issue: 1. Get a separate certificate for each subdomain. Let's Encrypt makes this feasible since the certs are free and require a minimum of human overhead to obtain. 2. Get a single certificate t
75.
by garrettr_ 11y ago
How is this different from/superior to Let's Encrypt's built-in "standalone authenticator"? [0] [0] https://github.com/letsencrypt/lets-encrypt-preview/blob/mas...
76.
by garrettr_ 11y ago
Nitpick: the property OP describes is actually second pre-image resistance, not preimage resistance (or collision resistance). See https://en.wikipedia.org/wiki/Cryptographic_hash_function#Pr...
77.
by garrettr_ 11y ago
This looks more like a fake sub key that someone tried to pollute the public key servers with Does anybody know how that would be possible? I can't understand why a key server would accept a subkey unless it was correctly sig
78.
by garrettr_ 11y ago
/dev/random is a PRNG, and predictable. You shouldn't use it for security applications but only for specific state/algorithm randomness. /dev/urandom requires hardware noise/key events, etc. to gene
79.
by garrettr_ 11y ago
Tor uses entry guards [0] to mitigate this kind of an attack. [0]: https://www.torproject.org/docs/faq.html.en#EntryGuards
80.
by garrettr_ 11y ago
> You are saying that if one part of your trust chain is limited to a certain security level, then it makes no sense to make any part stronger. Security is only as strong as the weakest link. My argument is that if your adversary is powe
81.
by garrettr_ 11y ago
Even if the Yubikey supported larger RSA keys (3072 or 4096-bit), you might not want to use them. Decryption is quite slow with a 4096-bit key on a smartcard (for example, it takes ~5 seconds to decrypt with a 4096-bit key using a g10code s
82.
by garrettr_ 12y ago
Best practice would be to use an HSM to store the key. It provides the usability benefits of an unencrypted private key with strong guarantees about the security of that key. It's worth noting that the security benefits of encrypting t
83.
by garrettr_ 12y ago
I'm not familiar with the security benefits of VT-d; might you have a link to a whitepaper or another resource?
84.
by garrettr_ 12y ago
Entropy checkers are based on a faulty premise and are always at a disadvantage compared to the state of the art in password cracking. Online security would be in a better place if they had never been invented at all. The only way to guaran
85.
by garrettr_ 12y ago
It's easier on keyboards (since we spend most of our time typing lowercase letters as part of text) and also on mobile (since you don't need to do annoying and error-prone context switching for capital letters or symbols). I think
86.
by garrettr_ 12y ago
Basing passphrases off of a (since you've just mentioned it on Hacker News) well-known public source is usually a bad idea. Why not just pick random words (using a CSPRNG like /dev/urandom) from a dictionary? This is the &quo
87.
by garrettr_ 12y ago
Note that `unsort` uses the Mersenne Twister for its PRNG, which is not cryptographically secure [0]. However, cracking Mersenne does require a significant amount of random bytes generated from the same seed, and a quick glance at the sou