pfg

69 ms·

661.
by pfg 10y ago
U2F is immune against phishing.
662.
by pfg 10y ago
> I really can't be bothered into using a password manager, so what's the alternative besides reusing passwords? The alternative is getting burned by password reuse repeatedly until you can be bothered, I would assume. Alternat
663.
by pfg 10y ago
Having access to the plaintext traffic of 5% of all web sites on the internet makes them a huge target for anyone from hackers to nation states/intelligence agencies and what not. I have a lot of faith in their security team, but thi
664.
by pfg 10y ago
I'm not following that logic. Using salted password hashing would not prevent them from checking your new password against the previous hash.
665.
by pfg 10y ago
Not a bad point - it's a trade-off. You could make a similar point about the centralized backup management server - it needs to have "some kind of login" to all your production database server, so of that host is compromised
666.
by pfg 10y ago
It works reasonably well against typical DDoS attacks. I've read that booters have started to show warnings that they're ineffective when used against IPs belonging to OVH. It probably doesn't do much against resource exhaust
667.
by pfg 10y ago
Good point. Future versions of the project could theoretically work with encrypted blobs, with the keys (which are significantly easier to keep in multiple physical locations) only known to the Internet Archive. This would probably require
668.
by pfg 10y ago
This might be a good opportunity to mention IA.BAK[1], an effort to back up the Internet Archive. Currently, the entire Internet Archive is stored in one physical space. IA.BAK allows users to store copies of the archive which can be used a
669.
by pfg 10y ago
Most of these services have some kind of fair-use policy. Nothing that you would notice as a small to medium-sized user, but if you push the kind of bandwidth that I imagine the Internet Archive would, or if you're suffering from a lar
670.
by pfg 10y ago
> How does it prevent password reuse? It does not prevent password reuse, it mitigates the risks of password reuse in that it adds the requirement of having physical access to a device, which is a show-stopper for most attackers. If
671.
by pfg 10y ago
That is one valid way of solving this problem. Another option is to have a permission system that allows you specify that the server can only append new data, but not delete or overwrite existing files. This is useful if you don't want
672.
by pfg 10y ago
Okay, that's pretty bad if it leaks the actual platform. My assumption was that that the way they spoof the platform (and related values) in windows.navigator and the user agent would apply here as well. If that's not the case, th
673.
by pfg 10y ago
The fact that you're using Tor is obvious based on your IP address. I believe TBB uses the same set of defaults for the other parameters across all platforms (i.e. Linux, OS X and Windows users all appear to be using Windows 7), so tha
674.
by pfg 10y ago
Amazon has deployed HTTPS across all their sites a couple of weeks ago.
675.
by pfg 10y ago
Good point and very similar case (though in an entirely different category of "damage caused", plus there seemed to be a prior offense).
676.
by pfg 10y ago
In case you're referring to the General Data Protection Regulation, it does not apply until May 2018. The penalty that would be applied would probably be this one, given that the number of prior offenses, the gravity and duration of th
677.
by pfg 10y ago
FWIW providing an email address is optional.
678.
by pfg 10y ago
I think that's what many enterprise deployments do with shadow copies, mostly for file shares. It would probably make sense for Microsoft to push this feature for personal usage/smaller networks as well (not sure if you can curr
679.
by pfg 10y ago
The same logic could be applied to their built-in anti-malware software (Windows Defender), so I don't think that's what's stopping them.
680.
by pfg 10y ago
I wouldn't call CloudFlare end-to-end encrypted. They see the plaintext, independent of whether communication with the backend is encrypted or not.
681.
by pfg 10y ago
You don't have access to their private key. The fact that it is the same certificate is irrelevant. Anything you can do now, you could also do if they'd use separate certificates per subdomain.
682.
by pfg 10y ago
There's a good argument to be made for signing the update information using offline keys - it reduces the damage that could be caused by a compromised SSL key. That being said, they should've still used HTTPS to secure the transpo
683.
by pfg 10y ago
Update checks are usually implemented as soft-fail, i.e. failing to connect to the update server won't result in a notification, unless it's an active update check performed by the user. HTTPS alone wouldn't fix this scenario
684.
by pfg 10y ago
I think in many cases there's no conscious decision not to implement TLS or code signing. It could just be that no one who cares enough about security is in a position to drive that change. There are many organizations that quite sim
685.
by pfg 10y ago
The "fun" thing about this article is that pretty much every claim they make is debunked one or two paragraphs later, but that doesn't seem to be stopping them from making click-baitish claims. I'd almost be willing to a
686.
by pfg 10y ago
Which makes sense, because anyone who could install a root certificate on your system could easily disable any such check, backdoor Chrome, install a keylogger, etc. This would lead to a false sense of security, which I believe would be wor
687.
by pfg 10y ago
I'm quite happy that there's no way to bypass the intersitial for HSTS sites. Preventing non-technical users from clicking through SSL warnings (which is very common) is definitely more important than supporting a use-case that
688.
by pfg 10y ago
The way the update system works (according to the article) is that it shows a pop-up with the new version, and that pop-up opens their site (via HTTP). It is conceivable that they'd rely on the impressions coming from update dialogs fo
689.
by pfg 10y ago
Projects should not be exempt from criticism just because they're free. That's a terrible attitude. The article does not attempt to dictate anything, I would not even call it a complaint. It merely points out unsafe practices and
690.
by pfg 10y ago
The question here isn't whether BlueCoat would go out of business, but rather Symantec. I don't like Symantec, nor do I like BlueCoat. That being said, we have no evidence that this certificate was used for misissuance. Symantec c

More ›