palant

18 ms·

151.
by palant 8y ago
Security bugs don't live on GitHub, they are on HackerOne. It is up to the vendor whether to make them visible. This particular one is still hidden, probably because I have code there demonstrating how this issue could be exploited.
152.
by palant 8y ago
By "trusted UI" I meant user interface within the browser that clearly doesn't belong to the webpage - such as the browser action's pop-up. As I said, an extension like Keybase could delegate this action to their app. Ot
153.
by palant 8y ago
Bug report on Hacker One. While it has been resolved, it hasn't been made public for some reason.
154.
by palant 8y ago
Yes, I didn't bother expanding this further. Spoofing Keybase UI would still be possible, but users would notice that their message doesn't get sent. Still, the only complete solution would be to delegate even the initial message
155.
by palant 8y ago
The quotes come from a bug report on HackerOne. While this report has been resolved, it wasn't made public. The extension is very much an official Keybase product and recommended heavily on their end. Why should I waste more time on a
156.
by palant 8y ago
The article actually does explain it. The bruteforcing speed doesn't change at all, the same value (PMK) as before is being bruteforced. What changes is merely the approach to get it from the router - an attacker no longer needs to wai
157.
by palant 8y ago
Oh, that's nice - it was restored without giving me any kind of notification. Developer Dashboard says that the screenshot is there, not sure why it doesn't show. Edit : Got a mail now, supposedly the issue here was an internal m
158.
by palant 8y ago
For reference, the Chrome version was released in January 2017. So - yes, they had plenty of time to object.
159.
by palant 8y ago
No, the reason isn't obvious. The extension wasn't popular enough on Chrome, Google simply wouldn't bother doing anything about it. This might be a trademark issue, the extension's name has "Google" in it - the
160.
by palant 8y ago
If you remember special relativity theory, it's the same thing - merely depends on your point of view. From my point of view, Mountain View is moving. But if you are a Google employee, then I must be moving of course.
161.
by palant 8y ago
Nowhere in the Chrome Web Store policies does it say: "Extensions aren't allowed to violate Google's business interests." Supposedly, acceptance in CWS depends on user value, and the policies protect the user rather than
162.
by palant 8y ago
Firefox still allows installation from third party websites, they merely require add-ons to be signed by AMO. This allows Mozilla to revoke a signature for malicious add-ons, not sure how often this happens in practice.
163.
by palant 8y ago
Quite remarkably, they are only moderately successful in keeping malicious actors out of Chrome Web Store. Centralizing deployment won't give you that automatically, you also need the manpower to enforce policies. And Google isn't
164.
by palant 8y ago
Given that these copycat extensions usually aren't giving you a way to find their creator - good luck with the legal system. And even if you can find them, what will you do about them if they are located somewhere in China? The legal r
165.
by palant 8y ago
I'm not sure what their approach is. My article links to another about fake ad blockers - flagging these usually yielded in no results, neither when flagging trademark infringements nor malicious functionality. The process took months
166.
by palant 8y ago
Yes, the original blog post has a more technical description: https://blog.adguard.com/en/over-20-000-000-of-chrome-users-...
167.
by palant 8y ago
The 60 minutes delay is completely artificial, it is only there in case you change your mind. If you use the API, extensions are published immediately. Whatever automated scanning takes place there, it's very quick.
168.
by palant 8y ago
Good luck trying to get the publisher's name from Google. Google knows which credit card was used to pay for the publisher's account, but they won't tell anybody - and I doubt that they are interested in going after the publi
169.
by palant 8y ago
There is an automated validation process and occasionally (very rarely) your update will get flagged for manual review. This will prevent you from uploading known malware samples and supposedly some other suspicious stuff as well. This migh
170.
by palant 9y ago
> Look, I'm sure the 1Password guys are nice, upstanding people, but implementing crypto correctly is hard, really hard. Sure, they are probably telling the truth about what algorithms they use. But did they implement them correctly
171.
by palant 9y ago
Yes, 1Password is closed source. But as far as their security design goes, they are as open as possible. In fact, I recently started looking into https://1password.com/files/1Password%20for%20Teams%20White%... to under
172.
by palant 9y ago
An 80 bit password would be secure. In fact, now that I am aware of this issue I generate the master password for Thunderbird with PfP: Pain-free Passwords and it's in fact around 80 bits strong (too bad that I cannot use PfP in Thunde
173.
by palant 9y ago
Yes, it is stupid to leave your computer unlocked but it happens all the time in every workplace. If spending a minute pulling two files from an unlocked system is all it takes to get access to all of person's passwords - that's s
174.
by palant 9y ago
Well, the software to crack Firefox master passwords is there for anybody to download. Maybe not quite as well optimized as hashcat with a GPU but it's easy enough to use that plenty of people might decide to try it out.
175.
by palant 9y ago
I am all for using a better password manager. In fact, with PfP: Pain-free Passwords I developed one myself - and I invested much thought into making sure the master password cannot realistically be guessed unless it is absolutely trivial.
176.
by palant 9y ago
No, I didn't miss the threat model. I am all for password managers, in fact I am even developing one myself. The sad truth is however, most password managers aren't exactly a shining example of security best practices. This blog p
177.
by palant 10y ago
Point is: this can be done right. I develop Easy Passwords myself, with the same/better convenience factor and without offering a huge attack surface. It's not about LastPass making mistakes, rather about them not learning from
178.
by palant 10y ago
I'm "slightly" biased but to me Easy Passwords is a better solution (see https://palant.de/2016/04/19/easy-passwords ). In fact, I programed it myself :) Syncing data between different computers
179.
by palant 10y ago
Frankly, I cannot really understand him being positive about that. A vendor that rushes out a fix without verifying that they fixed the issue everywhere - that's not great at all. I definitely prefer vendors who take a few days to look
180.
by palant 10y ago
I only had a quick look at 1Password browser extensions source code but there were no obvious red flags - much unlike LastPass. Let's see what Tavis Ormandy digs up, supposedly he found some issues.

More ›