homakov

51 ms·

1. 541.▲
   by homakov 11y ago

   One caveat: client side attacks like XSS that don't execute or break backend part are rather ok 100% of time
2. 542.▲
   by homakov 11y ago

   What's best way to move to US and not work for anyone and not invest much money? O-2? I work in infosecurity
3. 543.▲
   by homakov 11y ago

   See Homakov edition of OAuth, it's simpler and more secure http://www.oauthsecurity.com/
4. 544.▲
   by homakov 11y ago

   What's also bad is it's under shared origin dl-web.dropbox.com so some kind of persistent XSS or cross window JS can leak all your passwords.
5. 545.▲
   by homakov 11y ago

   I'm a single developer, imo no one will read these messages until Beta version.
6. 546.▲
   by homakov 11y ago

   Email itself is salt (or rather public part of passphrase). So from email+passphrase encryptionKey is derived using scrypt. So it's actually sha(scrypt(email+passphrase))
7. 547.▲
   by homakov 11y ago

   Credentials are encrypted with passphrase and seamlessly stored on the server by token=sha256(passphrase). https://truefactor.io/
8. 548.▲
   by homakov 11y ago

   Is there JS API to use HTTPS certs to sign specific strings? Like "send 1 bitcoin to X"
9. 549.▲
   by homakov 11y ago

   Open truefactor:// app. Currently there is only a Web version and it has serious downsides (web crypto is a bad idea), but think of it as a Light version. Desktop apps to come later.
10. 550.▲
    by homakov 11y ago

    I'm working on the same problem, and there's a working prototype https://github.com/sakurity/truefactor The problem is bigger than that - we should stop making users type password at all. There should be an a
11. 551.▲
    by homakov 11y ago

    Sounds like clickbait, did not find content interesting. It makes you think windows 10 users a banned by microsoft. Should be "torrent sites ban windows 10 users".
12. 552.▲
    by homakov 11y ago

    The fast way to handle 20-200 tabs. Something like built in tab search, with tab caching.
13. 553.▲
    Using Appcache and ServiceWorker for Evil(sakurity.com)

    2 points by homakov 11y ago|0 comments
14. 554.▲
    by homakov 11y ago

    Should be 1 long string, then if something fails use bsection
15. 555.▲
    by homakov 11y ago

    > then he was not allowed to work on fixing up his own house Then tourists are not allowed to cook and must go to restaurants, and coding for open source is also illegal? I think guards were wrong.
16. 556.▲
    by homakov 11y ago

    > Of course I have to suggest Python/Django But do you have bugs?
17. 557.▲
    by homakov 11y ago

    Just don't want it to be yet another "We found 123 vulnerabilities, sign up to learn more". E.g. if it's Rails RCE it confidence should be 3/3, if some app-specific, 2/3 etc. But anyway great job
18. 558.▲
    by homakov 11y ago

    Someone should reestimate severity of those "CVEs". I got 10 warnings and none of them is any severe for my app(and yours too, likely), so I'm definitely not vulnerable. Also LOL "CSRF Vulnerability in jquery-rails"
19. 559.▲
    by homakov 11y ago

    Nothing new, private keys are generated per account, the entire app will be in appcache, and sync is done via simple API and encrypted with your passphrase messages (same as crypton - zero knowledge). From the start you get 2 private keys b
20. 560.▲
    by homakov 11y ago

    I thought instead of cutting off out of range results we could num*85/4294967296 and round it. But now realized buckets for rounding won't be of equal size and it's wrong.
21. 561.▲
    by homakov 11y ago

    In theory, haha. In practice it gives me some numbers twice more. [2001954, 1000322, 998546, 1001551, 999105, 2000886, 998760, 998705, 1000001, 998424, 1000978, 2000907, 1002097, 998786, 1000101, 998818, 1000381, 1999818,
22. 562.▲
    by homakov 11y ago

    This also works i guess max = 100 length = 85 num = rand(max) puts (num * length)/max
23. 563.▲
    by homakov 11y ago

    For 0..max random integer it depends on max and length. If max is 2^32 and 2^32 modulo charset.length = 0 it should be fine. Am I right? In our case length is 85 and it is indeed biased. Needs a pull request.
24. 564.▲
    by homakov 11y ago

    ^ hopefully i didn't sound too confident! Thanks for explanations.
25. 565.▲
    by homakov 11y ago

    % shouldn't decrease the entropy, modulo of random is still random.
26. 566.▲
    by homakov 11y ago

    What's wrong with window.crypto.getRandomValues?
27. 567.▲
    by homakov 11y ago

    This is cool, will install it right now. Shameless plug: I work in the same field but instead of storing passwords trying to replace passwords and 2fa altogether with one scheme working as a web app: truefactor.io/app
28. 568.▲
    by homakov 11y ago

    Great, that's what I wanted to see in the article.
29. 569.▲
    by homakov 11y ago

    And why should I care?
30. 570.▲
    by homakov 11y ago

    Interesting, sqli that works only for reading encrypted_hash from DB? But since password is unique it cannot be bruteforced even locally.