homakov

48 ms·

511.
by homakov 10y ago
Billion of apps, omg :O
512.
by homakov 10y ago
Scrypt seems to be performing better in the browser because of 32 bit operations. Argon2 in browser was slow in my tests.
513.
by homakov 10y ago
Flagged, the title should be "How to take a gmail username, the hard way"
514.
by homakov 10y ago
I call "printf antipattern" format injection e.g. http://sakurity.com/blog/2015/03/03/duo_format_injection.htm...
515.
by homakov 10y ago
There's absolutely no situation when it's a risky behavior. It is not a problem at all.
516.
by homakov 10y ago
Bitcoin is useful when you already have it. There's no point to go and buy it solely for purpose of transferring it (via some weird wb21). Neither you nor tradezero use it properly.
517.
by homakov 10y ago
Also, if you're using ruby's open-uri: http://sakurity.com/blog/2015/02/28/openuri.html
518.
by homakov 10y ago
Auth is a routine job, only a really silly developer manages to make simple token auth vulnerable. There's no a "tradeoff" in leaving auth to MitM because it's "hard", oh also there's bunch of libraries ou
519.
by homakov 10y ago
But apigee becomes a man in the middle, which is very bad for your security.
520.
by homakov 10y ago
This is unfair to banish a company for not having enough "security experience". It could happen to anyone (i mean making such a design mistake), plus they afaik had some external audits. "Aha, no security background!" is
521.
by homakov 10y ago
Isn't it race condition?
522.
by homakov 10y ago
Is there much sense in auditing things that are usually used by the admin and are by design exposing a lot of control of the server? Sure it must not be exposed to an outsider, but if auth is done right, it doesn't matter how far the
523.
Sakurity OAuth: Secure OAuth 2 Replacement(sakurity.com)
2 points by homakov 10y ago|0 comments
524.
by homakov 10y ago
> Would this "nonce" in the database? Only in revoked list=1,2,5,7 etc. Unlike storing all sessions, you only store revoked integers which takes way less space and achieves same revocation you wanted. > That's optimis
525.
by homakov 10y ago
What's refresh token for?
526.
by homakov 10y ago
>You are essentially powerless, and cannot 'kill' a session without building complex (and stateful!) infrastructure to explicitly detect and reject them, defeating the entire point of using stateless JWT tokens to begin with. j
527.
by homakov 10y ago
Reminds me of Coldfusion (XML as programming language)
528.
by homakov 10y ago
Applying the term "simulation" from subsystem (our attempts at VR) to the system (our world) are meaningless. The system above is nothing "like" what we have in the system over here.
529.
by homakov 10y ago
They should use localStorage
530.
by homakov 10y ago
This is how cookies were supposed to work from very beginning. After two decades of vulnerable web apps finally fixes it with a flag, funny.
531.
by homakov 11y ago
Hm, ok, they reinvented brakeman
532.
by homakov 11y ago
A link with _blank + expected to change/interact with opener? Maybe there's a few, but most cross domain transports would use window.open() manually.
533.
by homakov 11y ago
On this particular behavior unlikely
534.
by homakov 11y ago
I was implying "make it a default for everyone, now"
535.
Thredded: A New Forums Engine (Ruby on Rails)(thredded-demo.herokuapp.com)
6 points by homakov 11y ago|0 comments
536.
by homakov 11y ago
They ever heard of "security by default"? I guess no.
537.
by homakov 11y ago
Yes, in rare cases other windows leak status codes e.g. timing attack on location.history. Other than this, this feature is a bad idea and shouldn't be implemented. Neither fixes any unsolved problem, nor does it gracefully.
538.
by homakov 11y ago
It does make exploitation harder (need to change JS) so it's good enough. There are no other usable options anyway.
539.
by homakov 11y ago
That's true. I myself would never poke around some corp. website w/o a bounty program
540.
by homakov 11y ago
At least non-admin XSS is much harder to define as "hacking" by a judge. Otherwise, writing something like "Send your password to ha@ck.er plz!" would be considered severe hacking attempt too.

More ›