homakov

52 ms·

571.
by homakov 11y ago
So true, actually.
572.
by homakov 11y ago
How two factor auth will prevent loss of your source code? (assuming your password is unique)
573.
by homakov 11y ago
Steals your bitcoins from agora with CSRF attack I guess. I didn't test but it's no news darknet websites are poorly developed.
574.
by homakov 11y ago
This is a very good tip (for security) and I don't see it used anywhere yet. Should be enforced.
575.
by homakov 11y ago
Can you elaborate with attack scenarios how U2F mitm is different? There's no display on youbiky, which means it's the same thing
576.
by homakov 11y ago
Thanks but no, google auth can be installed on any mobile device. Why bother with some "keys"
577.
by homakov 11y ago
Was it abused? money stolen?
578.
by homakov 11y ago
It's the title - I'm using the minimal number of words to carry the idea.
579.
Mongo BSON Injection: Ruby Regexps Strike Again(sakurity.com)
128 points by homakov 11y ago|50 comments
580.
by homakov 11y ago
LOL. I mean... LOL.
581.
by homakov 11y ago
What a great tool. I wish it was more customizable http://r.weavesilk.com/?v=4&id=ssa105e6rw0
582.
Hacking Starbucks to get unlimited coffee(sakurity.com)
10 points by homakov 11y ago|2 comments
583.
Hacking Starbucks to get unlimited coffee(sakurity.com)
65 points by homakov 11y ago|2 comments
584.
Hack to subscribe to any private Pusher channel(sakurity.com)
5 points by homakov 11y ago|0 comments
585.
How simple crypto bug compromised Pusher(sakurity.com)
2 points by homakov 11y ago|0 comments
586.
by homakov 12y ago
Not useful for obfuscation :( Just remove last ()
587.
by homakov 12y ago
Because it's quicker and no fees? And I get paid in it too.
588.
by homakov 12y ago
Remote contracting jobs at Sakurity for excellent security consultants (web app pentests). Contact info@sakurity.com What are you good at? Programming languages you can (fluently) read, frameworks you worked with? Examples of bugs you found
589.
by homakov 12y ago
> When I DID see it, tried it myself with a quick shell script that that curled and backgrounded the same request a bunch of times, I just kind of chuckled. It was a good bug That's the problem with OWASP, when developer from a big
590.
by homakov 12y ago
Didn't quit the job (working remotely), on my 3rd around-the-world already. Feels perfect
591.
by homakov 12y ago
I made it on the fly because "know that you've been hacked" is not important at all for regular users. They can't remember a random picture - true, but they also don't care if their password doesn't work anymor
592.
by homakov 12y ago
> potentially ZERO indication to the end user that their account has been compromised It's not exactly zero. For example you can generate new "security image" every time user logs in. If last time it was some cat and now i
593.
by homakov 12y ago
So your point is it is less secure because the same weak feature is being used more frequently? > all it takes is someone to intercept those emails on their way from your SMTP server out to the wider internet it doesn't matter when
594.
by homakov 12y ago
Can someone open developer console and type "alert('hacked!')"? See, you're vulnerable too. TL;DR: not an issue.
595.
by homakov 12y ago
How exactly is it worse if it's not different from classic scheme?
596.
by homakov 12y ago
you're free to use any password manager. my scheme is for developers to build better authentication
597.
by homakov 12y ago
I will take it as a slight disadvantage. I personally never log out, so I would never know if someone else changed my password while I keep using it on my laptop. Also remember this scheme is not for advanced users (which care about "w
598.
by homakov 12y ago
Ok, i thought you mean you will see an incoming email. Anyway, is it critical to know or not if your account was breached? If it's breached nothing else matters. Safari manager is probably great, like other managers. But my scheme is f
599.
by homakov 12y ago
>(i.e no password reset by the attacker) Login link = reset link. it's not different from classic scheme. Equally insecure. "What if" doesn't work, it's 2015 and the problem is still huge. "Use password mana
600.
by homakov 12y ago
By no means trying to invent/re-invent anything. Just making classic scheme safer by getting rid of passwords.

More ›