homakov

53 ms·

601.
How to Fix Authentication: Email as a Password Manager(sakurity.com)
10 points by homakov 12y ago|20 comments
602.
by homakov 12y ago
>Anyone else already find the XSS in genius.it? This is a sandboxed domain, like googleusercontent, so not a bug. XSS on genius. com would be a vulnerability.
603.
by homakov 12y ago
Maybe in webdev it is different but my story is simple - offer clients something they cannot get anywhere else. I offer rails security audit and charge minimum 375 per hour, but usually around 500. Bugs I find can save clients millions. Oth
604.
by homakov 12y ago
It would. They didn't do it probably because they didn't try this trick. But they could i think.
605.
by homakov 12y ago
While i agree that reports are high quality and slack should've handled it better, I don't see any security risks in both reports. They would close it as N/A one way or another. Just rude response though.
606.
by homakov 12y ago
BTW actually new version of devise hashes tokens.
607.
by homakov 12y ago
Why wait and not use it right away? If you have read access now you can exploit now.
608.
by homakov 12y ago
> Even without an ID in the post, you could hash the input and search for a matching value in the DB, right Hmmm indeed! if we hash incoming value before searching then it would work. So with blackbox it's impossible to tell, I&#
609.
Slack. Or why you need to hash reset_token like password(sakurity.com)
3 points by homakov 12y ago|2 comments
610.
by homakov 12y ago
This is why you need to hash reset tokens too http://sakurity.com/blog/2015/03/27/slack_or_reset_token_has...
611.
by homakov 12y ago
No, if your computer is infected (=monitoring software) there's no difference because token is transaction-agnostic. 2fa won't help
612.
by homakov 12y ago
It's totally fine to use web based otp generator. Don't listen to others, you don't need a smartphone.
613.
by homakov 12y ago
It doesn't. The only case when it's worse is when your laptop is stolen and you don't know about that - very unlikely for corporate laptops
614.
by homakov 12y ago
You can use http://gauth.apps.gbraad.nl/ on another computer or on same machine (wouldn't protect if computer is stolen, otherwise the same)
615.
by homakov 12y ago
The parent meant "This probably could've been prevented by disallowing non-number inputs" in SDK libraries. Yes, if SDK would cast everything to digits it wouldn't be possible. It is also quite obvious security-in-depth
616.
by homakov 12y ago
SMS is the worst kind of 2fa, better not use it at all.
617.
by homakov 12y ago
If you have a reset_token you still can log in, even when passwords are hashed. Likely reset tokens were stored in the same table
618.
by homakov 12y ago
I am retired on my private island ;)
619.
by homakov 12y ago
Russian kid :D
620.
by homakov 12y ago
you should put cert checker on top, seems like a great feature
621.
How “../sms” could bypass Authy everywhere(sakurity.com)
11 points by homakov 12y ago|2 comments
622.
How “../sms” could bypass Authy 2FA(sakurity.com)
16 points by homakov 12y ago|0 comments
623.
Facebook refused to fix hijacking bug in Facebook Connect(sakurity.com)
10 points by homakov 12y ago|0 comments
624.
Reconnect – hijacking accounts abusing Facebook Login(sakurity.com)
1 points by homakov 12y ago|0 comments
625.
RECONNECT – critical bug in websites with Facebook Login(sakurity.com)
11 points by homakov 12y ago|0 comments
626.
by homakov 12y ago
I demonstrated high profile websites who get it wrong and explained what leads to this bug. It's not "new/unknown" but "complex" - probably yes. Also I explained the best way to solve this issue
627.
Critical vulnerability in Spree Commerce, explained(sakurity.com)
1 points by homakov 12y ago|0 comments
628.
Your API Authentication is insecure, and we'll tell you why(sakurity.com)
11 points by homakov 12y ago|3 comments
629.
Ruby's open-uri library is an example of the Ruby-Insecure-Way(sakurity.com)
5 points by homakov 12y ago|0 comments
630.
Format Injection in Duo Web SDK(sakurity.com)
3 points by homakov 12y ago|0 comments

More ›