jrpt

19 ms·

181.
by jrpt 7y ago
Here's a clickable link to the site: https://enchantedsecurity.com/
182.
Launch HN: Enchanted Security, the virtual content security policy for websites
6 points by jrpt 7y ago|1 comments
183.
by jrpt 7y ago
You don't actually recover the key, which is cryptographically impossible. You just get ownership of the account. Perhaps you can do it with Bitcoin's scriptSig, but it's easier to do it with a cryptocurrency like Ethereum. O
184.
by jrpt 7y ago
Q - What about front-running the challenge? ("HFT-style actors") A - It uses a two-phase commit and reveal procedure to prevent front-running, like was used with name registration on Namecoin.
185.
by jrpt 7y ago
To answer some common questions: Q - How much do you have to put in escrow to recover an account? A - It's up to the user but they'll probably set it at a percent of the amount at stake. Or if it's a self-sovereign identity t
186.
by jrpt 7y ago
I actually said in the paper that accounts can enable/disable it, and customize their price and duration depending on their use case. Also, I said that it's not secure against kidnapping, jailing, etc. but if someone's willin
187.
Tell HN: I came up with an interesting way to do decentralized account recovery
131 points by jrpt 7y ago|111 comments
188.
Escrovery: Decentralized Account Recovery with Escrowed Payments [pdf](github.com)
2 points by jrpt 7y ago|0 comments
189.
by jrpt 7y ago
Depending on how the code is being served, cloaking is a big problem for scanners... if you think it's no risk you're probably overlooking the risk. Google put out a report on it and there's lots of papers on it and related t
190.
by jrpt 7y ago
You're correct that it's not using CSP headers (which is difficult in practice to use), which is why I call it a virtual content security policy. Yes, it's another resource that expands your attack surface but when you have s
191.
by jrpt 7y ago
For your first question, there's an optional hash you can add that locks the code to its known hash. Also, you can self-host everything if you like. The type of product it sounds like you're running is a scanner and scanners have
192.
by jrpt 7y ago
For those who are wondering what happened, British Airway’s website had malicious JavaScript included in some files they were using. Compromised third party libraries (in this case, the Modernizr library) was the attack vector. The malware
193.
What Open Redirects and Open Datastores Do to CSPs(enchantedsecurity.com)
2 points by jrpt 7y ago|0 comments
194.
by jrpt 7y ago
I didn't downvote you but this site is very downvotey for anything that doesn't fit the hivemind. The downvotes on Dropbox's first post are infamous. You're absolutely right that CSP and SRI are good in theory but fail i
195.
by jrpt 7y ago
That's because the website's main purpose is marketing, not explaining inner workings. The site explains four steps and you mentioned only the first step, installing it: https://enchantedsecurity.com/how-it-works
196.
by jrpt 7y ago
Companies derive so much value from third party JS that it's pretty much impossible to not use any third party JS. There's some paper on it that I can't find right now but the average site has dozens of third party resources
197.
by jrpt 7y ago
It's not magic security dust. I don't claim all you have to do is use it to have a secure website, but to address a few prominent classes of attacks you can use it. And security is hard, so defense in depth makes sense.
198.
by jrpt 7y ago
Thanks. That's a leftover from some automatic changes. It should have only showed up if you didn't complete the form though.
199.
by jrpt 7y ago
I’ve come to the conclusion that the way to secure your website from third party JavaScript is to monitor everything happening on your site: https://enchantedsecurity.com/ These third party libraries are a necessary part of
200.
by jrpt 8y ago
Can you describe what you're trying to do better? Is it your open source code and you want to know who's using it? Or is it your closed source code and you want to know the licensing of everything you're using?
201.
How to Automate the “Best Sales Prospecting Email Ever”(blog.dogpatchadvisors.com)
3 points by jrpt 9y ago|0 comments
202.
Accelerated Moving Walkways (AMWs) as a Transport System in Urban Centers [pdf](transp-or.epfl.ch)
1 points by jrpt 9y ago|0 comments
203.
The ACCEL moving sidewalk from ThyssenKrupp is a dream come true(treehugger.com)
2 points by jrpt 9y ago|0 comments
204.
Show HN: Registration library for open source software(supso.org)
5 points by jrpt 9y ago|0 comments
205.
by jrpt 10y ago
In my case, it's someone with a different name, but they think the car belongs to me. It's my old car that I sold to a dealer, who then sold it to this person. I'm pretty sure the DMV knows because I updated the registration,
206.
by jrpt 10y ago
No joke, this is happening to me right now with the SF MTA. I've already proved to them I don't own the car, but it seems like they didn't update their system last time, so I got another ticket for something I didn't do,
207.
by jrpt 10y ago
By malicious, do you mean inappropriate, or containing a malicious metadata inside the image? The images are probably stripped and/or compressed, removing any malicious metadata. You can use machine learning to classify images of vario
208.
by jrpt 10y ago
How did Dwarf Fortress become popular?
209.
by jrpt 10y ago
Sure it'd be nice, but at what cost? The estimate of $125 million to $1 billion per mile is incredibly expensive.
210.
by jrpt 10y ago
Is it business software or consumer software? Check out https://supportedsource.org/ You can have your code public on GitHub, while still releasing it under a paid license.

More ›