ptoomey3

8 ms·

31.
by ptoomey3 8y ago
I just tried out the shared album thing. I shared a photo whose original size is 3.4MB. The photo you get when you download it from the shared album on iCloud is 925KB. And, I'm pretty sure there is no checkbox you can check to prevent
32.
by ptoomey3 8y ago
Manually sharing works ok for super casual use, but it is way too much work when you take pictures daily. Plus, you would need to share photos both directions. And, even if you do all that, which photo library is the “source of truth”? Als
33.
by ptoomey3 8y ago
If you want them, let me know and I can drop my hazel rules somewhere. They aren’t wildly complex, but it can be slightly confusing if you’ve never used hazel before. Once you see the rules it‘s super obvious what’s going on.
34.
by ptoomey3 8y ago
Yeah..totally. I only meant “server” in so far as some machine where you want the “source of truth” to be. I personally want my source of truth to be my home iMac since it has a big drive that gets real-time backed up to backblaze. So, for
35.
by ptoomey3 8y ago
Also, while talking up google photos, I must note the home hub is worth the price of admission even if all you use it for is as a photo frame for google photos. I’m mostly an all apple house (HomeKit, etc). But, google photos plus the home
36.
by ptoomey3 8y ago
While I voted for google photos in https://news.ycombinator.com/item?id=18770681 , I will say that apple photos is nice if you have zero need to share a library with family members. For better or worse, apple Unlike third-pa
37.
by ptoomey3 8y ago
This! I’ve tried every option under the sun at least twice and google photos wins. My current system has been this for the past 2 years or so: 1. Create a family gmail account (ex. house-yourlastname@gmail.com) 2. Install Google Photos on t
38.
by ptoomey3 8y ago
Ha..indeed. We wrote something up about it in 2009: https://labs.neohapsis.com/2009/04/21/directory-traversal-in... . But even in that post we note that it was a relatively well known issue.
39.
by ptoomey3 9y ago
And just in case folks aren't super familiar with Cure53, they know their stuff. The report largely speaks for itself in conveying their level savvy on browser security. Google didn't hire some corporate consulting firm that would
40.
Weak cryptographic standards removal notice(githubengineering.com)
2 points by ptoomey3 9y ago|0 comments
41.
by ptoomey3 9y ago
Just a quick preview...we will be posting a blog post tomorrow morning with an update. Because of the delayed final blog post, we are delaying things by one week. The plan is to do a 1hr brownout on February 8th, followed by a permanent dep
42.
by ptoomey3 9y ago
You basically report the data to your own servers and then relay whatever subset you like to google using their “measurement protocol”: https://developers.google.com/analytics/devguides/collection...
43.
by ptoomey3 9y ago
Thank for the kind words. As Neil noted below, we would like to lock things down even further by proxing all data that is sent to Google Analytics. And, as a bonus, it would remove the last destination host for content exfil attacks that w
44.
by ptoomey3 9y ago
We recently developed/deployed a simple “crypto as a service” API for other apps/services to use for easy encrypting, integrity protecting, etc. It was originally developed with an HSM and eventually decided to redo it without. Th
45.
by ptoomey3 9y ago
You can frame the questions in a way that discloses no information to the prover. The questions ideally would have a 50% guess rate either way and leak no info. So, a question like “is her name Alice or Eve?” is a bad one, as you have leake
46.
by ptoomey3 9y ago
SoftU2F was designed fully conscious of this. It was largely developed to help push forward the idea of a software based token with every hope that, over time, native browser and operating system implementations push things fully into the m
47.
by ptoomey3 9y ago
For sure, software based tokens are not the norm (yet). Part of our hope with releasing a software based token is to push the security vs. user experience conversation forward. Sure, hardware tokens are great. But, they don't have the
48.
by ptoomey3 9y ago
You aren't the first: https://twitter.com/search?f=tweets&q=patricktoomey%20sentoo... :-)
49.
by ptoomey3 9y ago
There is no reason software based U2F tokens can't exist. We actually released one just this week: https://github.com/github/softu2f . It went through a certification process and was certified as a valid FIDO U2F i
50.
by ptoomey3 9y ago
Once you have malicious software running it is largely game over. Sure, the hardware token can require a press..but once pressed what challenge is being signed? Malware can just wait and send a challenge for Site A when you are actually try
51.
by ptoomey3 9y ago
The primary reason is exactly the reason you cited (u2f support is not ubiquitous across browsers..especially mobile). We may consider allowing folks to use u2f exclusively in the future, but we started conservatively given the already risk
52.
by ptoomey3 9y ago
Jinx :-)
53.
by ptoomey3 9y ago
What is the attack scenario you feel a hardware token protects you against that a software token will not (for the use cases U2F was designed for)? Sure, hardware tokens prevent malware from actually lifting your private keys. But, to steal
54.
by ptoomey3 9y ago
And the same is true on GitHub. You can use app based TOTP without SMS.
55.
by ptoomey3 9y ago
That is roughly all U2F is. It is a per-origin key pair that is registered with each site and used to sign challenges. At some point browsers themselves might implement something like Soft U2F, at which point, they basically will have &quot
56.
by ptoomey3 9y ago
Mostly because, thus far, it has the best user setup experience (doesn't require user to download a new app and hence can often get enabled in seconds) and has the best "lost device"/"broken device" story (peop
57.
by ptoomey3 10y ago
Indeed, lcamtuf's article was a reference during this effort and was linked to in our CSP post last year: https://githubengineering.com/githubs-csp-journey/
58.
by ptoomey3 10y ago
I've updated the post to spell out/link to a description of CSP upon first mention.
59.
by ptoomey3 10y ago
I have updated the article to link out and define the first reference of CSP.
60.
by ptoomey3 10y ago
Yeah, the missing context is that we are talking about vectors where GitHub would not be sanitizing the input correctly. In other words, vectors that traditionally resulted in XSS. We do exactly as you say in places where we expect user con

More ›