homakov

62 ms·

661.
A technology to make websites absolutely secure(securecanvas.com)
1 points by homakov 12y ago|0 comments
662.
SecureCanvas – interface-based protection(securecanvas.com)
15 points by homakov 12y ago|4 comments
663.
by homakov 12y ago
This one http://homakov.blogspot.com/2014/12/the-no-captcha-problem.h... they also link my PoC in the end. Instead of linking "the source"?
664.
by homakov 12y ago
BTW, clickjacking was fixed few weeks ago and http://homakov.github.io/nocaptcha.html isn't working anymore.
665.
by homakov 12y ago
Nice copypaste of my article :)
666.
by homakov 12y ago
1981 is cool, but you know what's also cool? 3012
667.
by homakov 12y ago
Sure, Doorkeeper is oauth Provider gem, not client.
668.
by homakov 12y ago
you just need to create a client. Then you will have ID+secret. Most providers allow anyone to get them
669.
by homakov 12y ago
That's true, checking all `rake routes` for proper CSRF handling is a trivial job but would help to spot the bug in 5 seconds.
670.
CSRF in Doorkeeper OAuth2 gem(homakov.blogspot.com)
249 points by homakov 12y ago|79 comments
671.
by homakov 12y ago
I probably didn't make it clear - recaptcha iframe provides 0 useful information about how you browse web. Of course other google services such as analytics and chrome collect more than enough about your habits. But I don't believ
672.
by homakov 12y ago
What habits? There's nothing else google can see, they only track movements inside of recaptcha iframe. They have 0 information about how you browse web.
673.
by homakov 12y ago
But what it has to do with fighting bots? Bots can look like browsers.
674.
by homakov 12y ago
At the end of the day only google.com cookies make sense, everything else can be routinely faked just like author says "Programmatically bypass the captcha by simply executing a rendering engine and automating movements of the mouse.&q
675.
by homakov 12y ago
> the js could just display a "confirm payment" button rather than requesting credentials from the user. clickjacking
676.
by homakov 12y ago
yes they fixed it but i don't know how. Likely there's a way to bypass.
677.
by homakov 12y ago
> I would purposefully enter a random wrong username and password It can be a smart proxy: while you type they type for you in another browser, and log it. >which then automatically logs into paypal without reentering password.. Doesn
678.
by homakov 12y ago
Yeah, and it's very widely used in oauth. (Talking in separate threads is weird)
679.
by homakov 12y ago
If by "server-side" call you mean getting a token for Express Checkout, I don't see how it's different from any existing OAuth implementation where site.com/oauth/twitter redirects to twitter.com/?oauth_to
680.
by homakov 12y ago
>This isn't a new thing, it's been possible for a number of years to integrate paypal using an iframe. Yes, I know about classic integration options. But it's not about what was possible (any kind of phishing is always pos
681.
by homakov 12y ago
To log in paypal account password is enough, user-agent and IP/location can be faked. When you're in you get access to user's transaction history. Ouch.
682.
by homakov 12y ago
Exactly, giving your CC details to some website is a routine, but your email+password are critical credentials.
683.
by homakov 12y ago
You're not getting the core issue - the way real gateway works cannot be distinguished from phishing. "seamless" user experience confuses users and is going to create a whole new wave of phishing
684.
by homakov 12y ago
No incognito tab? Maybe they fixed it
685.
New Paypal gateway UI is a disaster(homakov.blogspot.com)
4 points by homakov 12y ago|0 comments
686.
by homakov 12y ago
Russia is doomed to fail and I want it to happen as soon as possible, to have a probably better country
687.
by homakov 12y ago
I don't work from Russia and I want Github to be blocked in Russia.
688.
by homakov 12y ago
I'm Russian and I don't support it at all. Github is losing its face
689.
by homakov 12y ago
In your demo I'd be more careful with user input >$url = ' https://hashcash.io/api/checkwork/' . $_REQUEST['hashcashid'] . '?apikey=[YOUR-PRIVATE-KEY]'; hashcashid can change U
690.
by homakov 12y ago
It can be helpful. There's (optional!) remoteip parameter server can use to send google IP address of current user. As in wordpress demo sometimes we can send requests with the browser.

More ›