homakov

76 ms·

781.
by homakov 13y ago
1) it is nothing new 2) original article is so unclear, I don't comprehend which of two bugs author meant
782.
by homakov 13y ago
This is BS
783.
by homakov 13y ago
So what? Vulnerability in random noname website worth approx. $0
784.
by homakov 13y ago
>Wouldn't Coinbase need to fully redirect to their own domain, or popup a window with the URL visible in order for users to know they're really dealing with Coinbase? Yes, of course
785.
by homakov 13y ago
No, since there's no way to check iframe's domain I don't think it can be fixed for iframes . They should stop asking for user's password right there, because it makes people trust any iframe
786.
by homakov 13y ago
There's another bug when you can substitute coinbase's iframe with your own, when you use coinbase button. This iframe can ask for username / password, and there's no way for user to distinguish fake iframe from real. Th
787.
by homakov 13y ago
Hm, how to differ "i'm addicted and can die" and "i just like beer"? Is there obvious symptoms ?
788.
by homakov 13y ago
To you and others - i didn't know it's not a drug. It was my opinion, apparently wrong. Thanks for clarifications! Will do beers only on fridays then!
789.
by homakov 13y ago
That's sad, but you are not doing drugs - you can quit easily, just do it! Try to do sports or stuff like that, travel.. Seriously, alcohol is disgusting if you drink it every day. I have a hooker problem, no joke. Since we are talking
790.
by homakov 13y ago
they can claim to be secure, but nobody spent enough time to audit them. Too unpopular
791.
by homakov 13y ago
All non-mainstreem web frameworks are very immature in terms of web security. No CSRF/XSS/SQLi projections built in, don't even say about security headers. If you use an unpopular framework you should do all protections yours
792.
by homakov 13y ago
I used to work as security consultant for a while and final cost depends on how thoroughly you want to go. There's never "i'm done" state. There's always something left to check. 1) app-agnostic bugs, such as XSS&#x
793.
by homakov 13y ago
> Why are the cheap teams turning down free money? Hi, i double that. Also I understood your advice better now. Undercharging = making it worse for everyone (consultant profit, work quality, dumping).
794.
by homakov 13y ago
CSRF http://homakov.github.io/#{"url":"https://anonyfish.com/api/... also why not it snap-chat style and remove messages after 10 s?
795.
by homakov 13y ago
if this is AI why it scores only 512 square as max?
796.
by homakov 13y ago
This is one of the scariest thing i read on the internet in a while... I feel so sorry.
797.
by homakov 13y ago
Not until I see a security audit will I believe any exchange is secure definitely! Everyone saying "im secure" must also say "the X will prove it"
798.
by homakov 13y ago
Not testing everywhere, but "smoking test" that your SSL implementation protects from MITM, at all, and none of your programmers screwed it (with gotofail or anything else). This is what I expect from an OS developers
799.
by homakov 13y ago
More importantly, why Apple doesn't run test suites, basic checks? Test driven development must be everywhere
800.
by homakov 13y ago
Why compare yourself to unsuccessful people? there are always plenty of them. Almost anyone who can read & do maths can say "i'm smarter than 50% of Earth population" so..
801.
by homakov 13y ago
Why in release note of Apple it wasn't mentioned?
802.
by homakov 13y ago
Mac os is not vulnerable
803.
by homakov 13y ago
What about MITM, if I show image of client 1 on client 2?
804.
Telegram API was revealing private conversations' titles(translate.google.com)
1 points by homakov 13y ago|0 comments
805.
Paperclip vulnerability leading to XSS or RCE(homakov.blogspot.com)
2 points by homakov 13y ago|0 comments
806.
by homakov 13y ago
But gist is not a front end app. Gist has web frontend and Rails backend, which is supposed to store the token safely.
807.
by homakov 13y ago
Oh, there are tons of other silly wontfixes. I gave up. They really don't care about web apps. E.g. instead of /../ i could have used /%2e%2e/!
808.
by homakov 13y ago
I found that quirk occasionally. http://homakov.blogspot.com/2014/01/evolution-of-open-redire...
809.
Paperclip vulnerability leading to XSS or RCE(homakov.blogspot.com)
4 points by homakov 13y ago|1 comments
810.
by homakov 13y ago
There was 2 or 3 cases I regret about. The rest of my work is alright and responsible, no?

More ›