handsomeransoms

8 ms·

31.
by handsomeransoms 12y ago
We've been working on this with some of our deployment partners for a while now :D Great idea! I didn't know anybody else did it, it's cool to hear about c't.
32.
by handsomeransoms 12y ago
Definitely! The challenge is getting the news orgs to change their entire site, which often involves a lot of complex, entrenched infrastructure and sometimes involves reluctant third parties such as ad networks. We're working on a bes
33.
by handsomeransoms 12y ago
(Securedrop dev) That's not an implicit encouragement, despite it being your interpretation. Library computers, in my experience, do not typically allow you to install software on them, such as the Tor Browser Bundle, which is needed t
34.
by handsomeransoms 12y ago
Maybe you could use JS to randomize the timing of the iframe load after the article load?
35.
by handsomeransoms 12y ago
(Securedrop dev here) This is a really good point. Unfortunately, we're "as safe as SSL" no matter what, unless the source has a separate way to verify the .onion address on the SSL-protected page. They can use the SecureDrop
36.
by handsomeransoms 12y ago
(Securedrop dev here) We often suggest ideas like this to deployment operators, and others as well. For example, we encourage deployments to mirror the Tor Browser Bundle so sources don't have to go to Tor's (monitored) website to
37.
by handsomeransoms 12y ago
Securedrop dev here. We tried to balance the memorizability of codenames (aka Diceware passphrases) with their length. The current minimum length is 8 words from a list of 6969 words, so you get math.log(6969 8, 2) = 102 bits of entropy, w
38.
by handsomeransoms 12y ago
It is not useless if you have some other way to verify the key, such as the Web of Trust.
39.
by handsomeransoms 12y ago
It's also on the keyservers: http://pgp.mit.edu/pks/lookup?search=0xEBA34B1C&op=index
40.
by handsomeransoms 12y ago
(Firefox dev here) When you say Security Exception, do you mean you're seeing a certificate error on this page? The certificate is valid for me, so that indicates something dodgy on your end (perhaps a captive portal, or middlebox on a
41.
by handsomeransoms 12y ago
With enough sampling, it should be possible. Additionally, the values you are trying to infer are pretty small (8 bytes each) so that makes it easier.
42.
by handsomeransoms 12y ago
> Additionally, what about addressing insecure forms that fail to utilize https. FWIW, Firefox detects insecure login forms and emits a security warning to the web console. This is aimed at developers, however, not users (because the dev
43.
by handsomeransoms 12y ago
Mozilla dev here! Sorry to hear you're having so many problems! A few things to consider: 1. Many of Firefox's stability issues are due to 3rd party components (plugins and addons). I recommend disabling all of them, restarting th
44.
by handsomeransoms 12y ago
That's a great idea! I would be willing to help, and could probably find some others to help too!
45.
by handsomeransoms 12y ago
> I have been completely dedicated to write an extension which completely informs the user about what a web page does, and gives the user full control over what web sites do in his/her browser. That's awesome! At Mozilla we&#x2
46.
by handsomeransoms 12y ago
Exactly! gorhill, if you're interested in a position at either Mozilla or EFF, PM me :) - One of the Privacy Badger devs
47.
by handsomeransoms 13y ago
It landed on Nightly a week ago, check it out! You can help us by testing it [0] or reviewing the code [1]. [0] https://wiki.mozilla.org/SecurityEngineering/mozpkix-testing... [1] https://wiki.mozilla.org&#x
48.
by handsomeransoms 13y ago
"Don't want to" is a bit uncharitable. We want to, but have limited resources and a lot to do. We actually recently rewrote the certificate validation library and it is currently on Nightly. Check it out! Of course, it is ope
49.
by handsomeransoms 13y ago
The key idea of TACK is that it puts controls of pins in the hands of the site operators. The goal is to protect trustworthy site operators from rogue or compromised CAs (e.g. Diginotar, Comodo). The site operators have a better idea than a
50.
by handsomeransoms 13y ago
This is a great reminder for others to consider a donation to the Freedom of the Press foundation's ongoing campaign to fund the development of encryption tools to benefit journalists, sources, and everyone who communicates digitally!
51.
by handsomeransoms 13y ago
Or just customize the UI and remove the search bar if it bothers you so much. Right-click the toolbar in <29, click the menu button and choose "Customize" on the bottom left in >=29.
52.
by handsomeransoms 13y ago
> why not always use a VPN? Because then you're susceptible to remote MITM? VPNs are useful but do not replace end-to-end encryption.
53.
by handsomeransoms 13y ago
I think he's referring to app updates, not iOS updates. Also, desktop Mac OS X.
54.
by handsomeransoms 13y ago
As a general rule: if you think Firefox is slow/laggy, try running it with addons disabled. One or more addons are often the culprit. For page load lag, addons like ABP are often especially bad because they're running the URI of e
55.
by handsomeransoms 13y ago
This property of ES6 generators, along with Promises, is what enables task.js [0] If you're interested in concurrency patterns for JS, you need to check it out. Does this mean that we can use Task.js in ordinary web pages now? [0] htt
56.
by handsomeransoms 13y ago
This posts reeks of cisgender privilege [0]. Gender is a social construct, not a biological inevitability, and it is disrespectful to refer to someone as a gender that they have explicitly stated they do not identify with. I'll let you
57.
by handsomeransoms 13y ago
> Aaron, I am sorry to say, has died in vain. This contrived conclusion mars an otherwise sensitive synopsis of the film, and through that, Aaron's life. The drive to reform CFAA continues. Strides are being made for open access to
58.
by handsomeransoms 13y ago
> I'm not sure but I think it's not a real sandbox, the code is still executed like any native code It is actually quite different, read: http://static.googleusercontent.com/media/research.google.co... The
59.
by handsomeransoms 13y ago
TLS 1.2 will be enabled by default in the next release, Firefox 27, which will be released the week of February 4th. So, in less than 4 weeks, Firefox release will be "good".
60.
by handsomeransoms 13y ago
Should be pretty easy to add that functionality! File a bug on https://bugzilla.mozilla.org . In fact, this would make a great first bug for a new contributor :)

More ›