homakov

40 ms·

421.
by homakov 10y ago
Especially for flights aggregators are awesome. Same nice UI, secure CC processing, such a time saver.
422.
by homakov 10y ago
Airlines aren't like hotels. Aggregation systems are very mature and I never ever heard someone booking and not being able to fly. Plus the price is nearly the same. Plus you don't need to expose your CC to local airline website f
423.
by homakov 10y ago
I've easily bought flights Rio-SP and to Iguaza with Expedia. Using airline's website is always a bad idea, anywhere. From broken JS to 500 web server, they just suck. Always use proper aggregator.
424.
by homakov 10y ago
I don't know about microdosing, but 300ug kept me 40+ hours awake and caused anxiety/insomnia for 6 months afterwards. So be careful.
425.
by homakov 10y ago
Funny but totally expected, this kind of features is always snake oil with dead simple heuristics
426.
by homakov 10y ago
I know how hard it is to explain an outsider what your product does, but maybe you could try to explain to me who should be using it? Personally, I have enough space on my laptop.
427.
by homakov 10y ago
CF should be thankful Google is doing any of this, clearing their entire cache would cost Google $ to index web from scratch.
428.
by homakov 10y ago
+Yandex
429.
by homakov 10y ago
So there is no cheap in-house solution to DDoS but CF?
430.
by homakov 10y ago
Forgot about that, thanks. However we can use "integrity" attribute
431.
by homakov 10y ago
Chrome marking Cloudflare HTTPS as "Secure" must be turned into something different, like "Not So Secure" or whatever. Secure = end to end. Cloudflare is MitM by design. Chrome and others must not tolerate it. This vulne
432.
by homakov 10y ago
Best explanation https://paragonie.com/blog/2016/08/crypto-misnomers-zero-kno...
433.
by homakov 10y ago
I absolutely agree that it is not consumer ready. I'm trying to fix sharp corners with Truefactor.io, any thoughts?
434.
by homakov 10y ago
I know what you mean, ZK as in password auth. Then why in the first place encrypted storage was called zero knowledge? Complete misuse of the term.
435.
by homakov 10y ago
The secrets critical to the security of the system live on the end user devices: Ok so my desktop is device #1, and mobile is #2. I encrypt a note on desktop, then "query information, but the database operators cannot know what records
436.
by homakov 10y ago
Well, who decides what it is? When security words go marketing, it's pointless to argue. Zero knowledge is yet another "military grade" buzzword.
437.
by homakov 10y ago
Two components left: 1) storage of credentials to encrypt the vault (see my profile for a solution) 2) browser extension that verifies hashes of every HTML response
438.
by homakov 10y ago
Isn't zero-knowledge a subset of end-to-end (where both ends are you)
439.
by homakov 10y ago
It's not about being immutable, but about verified and signed builds (see codehash.db)
440.
by homakov 10y ago
Last time i checked Express. It is trivial to add, as long as you remember to do it . Actually it is silly nginx or apache don't serve those by default.
441.
by homakov 10y ago
Nope, because they, their frameworks or something in between have no XFO. Which proves it being ineffective, even after so many years.
442.
by homakov 10y ago
Hm, okay, except 90% of my clients still have it :D
443.
by homakov 10y ago
Clickjacking is dead, because we have X-Frame-Options! (said no one ever). Opt in solution is not a solution. But still useful.
444.
by homakov 10y ago
In one way or another. Most are vulnerable to bugs in standard (see sakurity.com/oauth) but every single one depends on central authority which is just stupid for auth.
445.
by homakov 10y ago
Yes. Some apps without sensitive info can do it, but that's it.
446.
by homakov 10y ago
That attack is trivially fixed - just inspect token and see its app id. But no one should use oauth for auth.
447.
by homakov 10y ago
That software stack is made to fix previous problems. Backed up as a password, deterministic and scales easily. It is new (tiny and well thought through) API but nobody used client certs anyway, as we found out in this very thread.
448.
by homakov 10y ago
That will happen - truefactor.io
449.
by homakov 10y ago
Ah, no wonder it's dead.
450.
by homakov 10y ago
Are they still working? anyone ever used it as auth method?

More ›