hdhzy

19 ms·

151.
by hdhzy 9y ago
Do you mean the URL shared or displayed in address bar?
152.
by hdhzy 9y ago
Errr... I don't think this is as nice as advertised. I did a lot of technical interviews (as an interviewer) in a format "show me you project and walk me through it and I'll ask some questions" and for me the most import
153.
by hdhzy 9y ago
If you're taking about the EU "cookie law" then it is neither about cookies nor about third party data. The summary is you can store data if they support the primary function of your site without the popup. E.g. you have a sh
154.
by hdhzy 9y ago
Exactly this. If one doesn't audit and build the software yourself they can't be sure what they are getting (remember we're still far away from reproducible builds for everything).
155.
by hdhzy 9y ago
Yes, although they cannot make people backup the inactive pinned key they at least get them to think what they are doing.
156.
by hdhzy 9y ago
Excellent! That also shows damage that can be done by people blindly perusing A+/100% on security tests. The same goes to ssllabs that needs 4096 bit RSA keys (or equivalent) to get 100%. Just... a bad idea.
157.
by hdhzy 9y ago
They do cap: 10 weeks in Chrome, 60 days in Firefox [0] but you can still poison future owner's domain. [0]: https://mobile.twitter.com/spazef0rze/status/900698403629391...
158.
by hdhzy 9y ago
Well actually HPKP will not work if there is only one pin present. The browser will reject the entire header.
159.
by hdhzy 9y ago
Scott, so take HPKP out of your securityheaders.io site. Encouraging people to deploy this extremely sharp tool can bring only bad results.
160.
by hdhzy 9y ago
Interesting because actually it was AMP that pushed me out of Google properties, to Firefox for Android with uBlock and DuckDuckGo and I'm planning to stay using this setup even though Google's engine is better (minus AMP).
161.
by hdhzy 9y ago
Well I don't have eResidency card. I just want to know how long it is valid once issued.
162.
Why is secp521r1 no longer supported in Chrome, others?(security.stackexchange.com)
1 points by hdhzy 9y ago|0 comments
163.
by hdhzy 9y ago
The funny fact is that some browsers (Chrome?) did not have this behavior initially but it was introduced to match what others (IE?) did.
164.
by hdhzy 9y ago
Does anyone know how long the eResidency card is valid?
165.
by hdhzy 9y ago
Another common mistake is accidentally not awaiting a function that returns a promise. That makes some really hard debugging (race conditions) as this issue is not caught even by TypeScript.
166.
by hdhzy 9y ago
Because people don't need coroutines, just a simpler way to write async code than callbacks and manual promises. While we're at it why coroutines? You can implement coroutines, generators, even try/catch and return given cont
167.
by hdhzy 9y ago
Interesting because that was one of benefits of DDG for me. 80% of my time I do not want local searches because I'm looking for the best IT results and local often has subpar quality. Google thinks I value local better than English and
168.
by hdhzy 9y ago
That's the common thinking that if you don't have latest Android it's a problem. But some manufacturers like Samsung push security updates monthly even for old devices such as Note 4. They do have many features years before t
169.
by hdhzy 9y ago
I've switched 6 months ago and despite the fact that I use !g at least once per day I'm positivity surprised by the quality of results. If they improve by 10% I'd be able to leave Google Search completely. DDG's added be
170.
by hdhzy 9y ago
Origin is used to create "key handle" that is given to the service and need to be used during login. See Yubico documentation for details: https://developers.yubico.com/U2F/Protocol_details/Key_gener...
171.
by hdhzy 9y ago
Great! Thanks for the reference.
172.
by hdhzy 9y ago
Could you point to where does it mention USB? I see only: > The API supports both NFC and BLE U2F devices.
173.
by hdhzy 9y ago
Can't speak for Apple Secure Enclave but Intel Embedded Security threat model explicitly states that the firmware code is not encrypted and not meant to be secret. [0] [0]: http://www.apress.com/us/book/978143
174.
by hdhzy 9y ago
Unfortunately solutions based on SGX lose two advantages of hardware tokens: no physical touch button and no portability. SGX doesn't provide any real advantage. For example Chrome team was evaluating storing Token Binding keys in SGX
175.
by hdhzy 9y ago
TPMs are more complex. They can be used as a virtual smart card. TPM can be used to store client certificate used in HTTPS. U2F on the other hand is super simple by design. For example Yubikey uses one symmetric secret to generate P-256 key
176.
by hdhzy 9y ago
Unfortunately they are basically unusable on Android. Only Yubikey NEO has NFC interface and others cannot be used even by USB-C/OTG interface. The support would have to be implemented in Google Authenticator but it seems they are not
177.
by hdhzy 9y ago
> I do wish it was easier to load (SSL/TLS) certificates on them What do you mean by "easier"? Yubico PIV manager is super simple to use. Of course you have to generate the certificate with OpenSSL yourself but that's
178.
by hdhzy 9y ago
Ha, it's funny because for me the format is just perfect. There are numerous presentations on the internet focused on one specific topic but your free form style is just like I'd talk with a friend. The interdisciplinary nature an
179.
by hdhzy 9y ago
Very cool. I'll definitely subscribe and watch for how this progresses. I'll like that it is minimal but still have display. Unfortunately if someone controls user machine they still can spoof the destination address so it's
180.
by hdhzy 9y ago
> Most content websites have become such a massive crapfest of ad-bloat, bad UX, huge page sizes and general usability hell that it's nigh impossible that I'd be able to reach the actual content of a non AMP site in the first 5

More ›