homakov

34 ms·

1. 391.▲
   by homakov 10y ago

   Practically nobody is running own mail server these days. Email is extremely centralized
2. 392.▲
   by homakov 10y ago

   There's no such net, nobody is signing the binaries.
3. 393.▲
   by homakov 10y ago

   Actually magic link sent to your email would be MUCH better. Also central authority but Gmail >>> any telecom
4. 394.▲
   by homakov 10y ago

   Server side or client side? If client side, the only vuln that matters is (DOM) XSS, is it the case? If not, that's not worth patching.
5. 395.▲
   by homakov 10y ago

   I totally don't endorse that. But it gets better, last month they removed visas for Russians and I'm coming soon!
6. 396.▲
   by homakov 10y ago

   Now I see, forgot the context and last events
7. 397.▲
   by homakov 10y ago

   > Look at the visa policy for unmarried women under 30 for Dubai With little googling you can find a reason behind this. Dubai escorts is huge.
8. 398.▲
   by homakov 10y ago

   It's really hard to speak about a subject like this openly and not leave paragraphs that used out of context can show an inverted opinion. Sad.
9. 399.▲
   by homakov 10y ago

   That's news to me. I thought EU can enter US easily
10. 400.▲
    by homakov 10y ago

    Oh boy, I really doubt anyone who stepped on TJ grounds wants to ever come back. Especially not YC people
11. 401.▲
    by homakov 10y ago

    Weird choice of country for this purpose. I wonder who needs visa to the US and doesn't need one to Canada, and I'm pretty sure the number is small.
12. 402.▲
    by homakov 10y ago

    That is well put, probably worth slightly revising your old article to highlight that.
13. 403.▲
    by homakov 10y ago

    Ok, so there's no direct access to your App Store but idea is same - rollout can "hot fix" aka pwn all users at once. I'd be angry if I were apple too.
14. 404.▲
    by homakov 10y ago

    From my understanding people are giving rollout push rights to their app store accounts? So rollout can hijack all the apps it controls? It's a hell of a central authority, a security nightmare waiting to happen.
15. 405.▲
    by homakov 10y ago

    Ok in that sense i am wrong. But it could mean sometging else.
16. 406.▲
    by homakov 10y ago

    English is my second language but i used to think security bypass means breaking the protection. Especially considering the title focuses on the messengers.
17. 407.▲
    by homakov 10y ago

    I refered to "being not surprised that encryption is broken". There was nothing relevant to encr in the document. The title is wrong.
18. 408.▲
    by homakov 10y ago

    There was no bypass of encryption.
19. 409.▲
    by homakov 10y ago

    Bypass encryption means they broke the protocol. They could say "also malware can read your private messages and anything else on your phone". But no, bypassing encryption sounds a lot better. Fake news.
20. 410.▲
    by homakov 10y ago

    Another victim of sensationalism.
21. 411.▲
    by homakov 10y ago

    Try nokia 3310. They made new ones recently.
22. 412.▲
    by homakov 10y ago

    Marketing. Having a fresh look from outside. Not knowing anything except how to build the product.
23. 413.▲
    by homakov 10y ago

    SSRF usually happens inside a request library that doesn't allow linefeeds. SSRF in general is serious, but HTTP GET SSRF is useless on most hosts.
24. 414.▲
    by homakov 10y ago

    > SSRF is an extremely bad vulnerability; it's usually game-over on penetration tests It's usually not. What can you do via HTTP protocol inside the network? Check out ssrf bible.
25. 415.▲
    by homakov 10y ago

    Exposing onmessage wasn't the best idea. Instead it should be something more restrictive with origin check built in. addMessageListener(" https://*.slack.com" , function(data){})
26. 416.▲
    by homakov 10y ago

    It wasnt heavy pentesting, just some params jungling. No way it could cause anything :) still funny coincidence
27. 417.▲
    by homakov 10y ago

    Was just pentesting it, and have some minor result. If you are using S3 browser uploads, make sure parameters you supply to Presign do not contain \n or it can lead to format injection https://s3.amazonaws.com/doc/s3-de
28. 418.▲
    by homakov 10y ago

    localStorage is pretty much only thing we need these days.
29. 419.▲
    by homakov 10y ago

    Meet DNS rebinding: any JS can probe and interact with all internal services.
30. 420.▲
    by homakov 10y ago

    Emirates is most profitable airline ever... special case :)