homakov

64 ms·

691.
by homakov 12y ago
Using clickjacking we can get lots of valid tokens, no need to solve challenges.
692.
by homakov 12y ago
they made it easier for users and for bots :)
693.
by homakov 12y ago
> I did read it. So what do you think about clickjacking issue? I made an assumption about their algo and maybe I'm wrong and they do track your mouse, but there's exploitable weakness. My post is 1) your algo seems simple 2)
694.
by homakov 12y ago
Would require an extra roundtrip... Problem is that you get challenges with client side and solve it with server side. It's website who should go, get a challenge for you, put it in your session cookie and make sure you don't go
695.
by homakov 12y ago
That's exactly why I wrote this post. I wish Google proved me wrong and demonstrate us how they use cool tech to detect bots instead of user.isGoogleUser? and user.acceptedCaptchas > 5
696.
by homakov 12y ago
>So my guess would be they analyze users behaviour on the page where captcha is located, things like mouse movements If they can track mouse movements why in incognito mode i'm not a human for them anymore? I was expecting same but
697.
by homakov 12y ago
There's no session ID for current user. They can try to use IP as identifier. Admins can send remoteip to google to prevent spoofing but that parameter is optional and I suppose they don't rely on it.
698.
by homakov 12y ago
Lol no, i simply found original article too promising with minimum technical details so I decided to dig. And a weakness is a weakness, not a vulnerability. Something to think of.
699.
by homakov 12y ago
Yeah malware bot will generate lots of free g-recaptcha-responses! Good idea
700.
by homakov 12y ago
Oh yes http://newsfeed.time.com/2012/01/31/british-tourists-tweets-...
701.
by homakov 12y ago
Scenario 1 - we don't need to create a clickfarm for this, maybe we can clickjack random users online. Literally every porn site will be happy to make some money with it. Scenario 2 - of course we won't just use 1 IP, it will make
702.
by homakov 12y ago
Oh, it's already too late. Google already has enough data about you. I can imagine the future - people train bots like kids, make them visit different websites, google things and pretend to be humans. Your search history will be like y
703.
by homakov 12y ago
Why? If no need to type any captcha - do the verification in the background, don't show me anything until you think I'm a bot
704.
by homakov 12y ago
The problem itself is described in the end: it's about using clickjacking to get a valid token on behalf of "good guys". And this problem has nothing to do with existing systems. Google could have made it so much easier and m
705.
by homakov 12y ago
I wrote my thoughts on this protection http://homakov.blogspot.com/2014/12/the-no-captcha-problem.h...
706.
The No CAPTCHA problem(homakov.blogspot.com)
215 points by homakov 12y ago|96 comments
707.
Hacking file uploaders with race condition(homakov.blogspot.com)
5 points by homakov 12y ago|0 comments
708.
by homakov 12y ago
And if you have a PHP app, timing attack is the very last thing to worry about... go prevent XSS first :) Re http://klikki.fi/adv/wordpress.html#details
709.
by homakov 12y ago
Timing attacks are not working in reality because of many things. You know how many times hackers actually used it? I bet 0. Just little bit faster than bruteforce. But that's how you can make them faster http://homakov.blog
710.
by homakov 12y ago
there's a way of course - what can be done with JS can also be done on server side. But it's not a legit way to use, yes.
711.
by homakov 12y ago
How is it solving CSRF JSON problem? http://homakov.blogspot.com/2012/06/x-www-form-urlencoded-vs...
712.
by homakov 12y ago
There's very simple API and all you need is to insert something like img src=recaptcha?challenge=C. Isn't it?
713.
by homakov 12y ago
As a person who doesn't even own a mobile phone at all I support you wholeheartedly. How am i supposed to use anonymous messenger giving him my real phone number!
714.
by homakov 12y ago
XSS on a shitty website not doing trivial sanitization gets 900 points on HN, oh guys you are disappointing me so much.
715.
by homakov 12y ago
Yeah, nothing clever at all. Tons of ways for user input, and this one just yet another one.
716.
OAuth Security Cheatsheet(oauthsecurity.com)
6 points by homakov 12y ago|0 comments
717.
by homakov 12y ago
Someone should do it; i like it
718.
Bypassing ClearClick and X-Frame-Options:Visible(homakov.blogspot.com)
1 points by homakov 12y ago|0 comments
719.
by homakov 12y ago
Or maybe he wants his story to sound more dramatic >So here I am, back where I started with barely enough money to eat. Come on, you're 37 years old Java professional from Sweden (which is not Nigeria or something). Even unemployed
720.
by homakov 12y ago
37 old Java professional from Sweden spends all of his savings in two months? You have 5 kids or something?

More ›