ryan-c

26 ms·

271.
by ryan-c 7y ago
A trivial way to check for Firefox in javascript: !!{}.toSource There are many others, of course.
272.
by ryan-c 7y ago
Sometimes it shows me stuff from users I've blocked, which I find really irritating.
273.
by ryan-c 8y ago
Are you sure you're not thinking of DNSCurve? It doesn't provide confidentiality, but AFAICT DNSCrypt does.
274.
by ryan-c 8y ago
I believe the Chase Sapphire Reserve has a 50% redemption bonus on "travel" booked through their portal, and Chase Sapphire Preferred is the one with the 25% bonus.
275.
by ryan-c 8y ago
There's also a bunch of good info on https://www.reddit.com/r/churning/ though that is more geared towards signup bonuses.
276.
by ryan-c 8y ago
they try to do that sometimes, but it's rather harder to claim innocence for that than other methods
277.
by ryan-c 8y ago
if client side javascript is blocked, then just don't pay for that impression
278.
by ryan-c 8y ago
Threat models: * The ad server outright telling lies to get paid for nothing. * The ad server not being trusted to validate that views are legitimate. Client-side JavaScript can probe the DOM and execution environment for abnormalities indi
279.
by ryan-c 8y ago
Was that the control sequence that changed the text on the printer's character LCD screen?
280.
by ryan-c 8y ago
I'm a researcher - I don't actually see your email in your profile, you have to include it in the about text if you want it to be seen. I can put you in touch with the right person in sales if you contact me (my personal email is
281.
by ryan-c 8y ago
I work for White Ops, which could reasonably be considered a verification vendor, though we prefer to be known as a security company. As you can imagine, specific techniques used for detecting fraudulent monkey patching (or even whether we
282.
by ryan-c 8y ago
I don't think it's being published. The snippets in the paper were obtained from process memory dumps by folks reversing the malware, so we don't really have a good clean copy - just fragments.
283.
by ryan-c 8y ago
Some technical details: https://services.google.com/fh/files/blogs/3ve_google_whiteo... (note: I work for White Ops)
284.
by ryan-c 8y ago
It was actually well over 800k. Here's a list - note that many have been reassigned: http://methbot.s3-website-us-east-1.amazonaws.com/IPs-CIDR.t...
285.
by ryan-c 8y ago
The actual indictment is here: https://www.justice.gov/usao-edny/press-release/file/1114576...
286.
by ryan-c 8y ago
Any idea what you hit?
287.
by ryan-c 8y ago
> Unlike physical goods which can only exist in one place at one time, it is conceivable that with a powerful enough computer, the solution could be found entirely honestly by a third party simply doing some math and stumbling upon the a
288.
by ryan-c 8y ago
A few comments: * It would be wise to stick an ` https://` in the example URLs. * Starttls is not used when sending, which ought to be fixed. * For anti-abuse purposes, you ought to include the caller's IP address in the hea
289.
by ryan-c 8y ago
Some friends and I experimented with this when running a CTF a few years back. We figured out that setting some of the Chinese Remainder Theorem values in the private key to zero, we could stuff it into a QR code and read it when printed us
290.
by ryan-c 8y ago
Why don't you like package managers?
291.
by ryan-c 8y ago
Chick-fil-a is an awful alternative - they fund LGBTQ oppression. https://thinkprogress.org/chick-fil-a-still-anti-gay-970f079...
292.
by ryan-c 8y ago
I have, actually. Most of our networks were /23s, and the syslog server was a .0 in the middle of one. An SMS sending appliance we bought would not accept IPs ending in .0. Fortunately, the check was client-side in javascript, and once
293.
by ryan-c 8y ago
> until your adversary is manually correlating multiple leaked passwords for you This is a thing that is done, and even automated. If you have a couple password dumps, checking levenshtein distance between them is not hard.
294.
by ryan-c 8y ago
Did you reply to the wrong comment? Normally, to attack a password manager, you must have a copy of its database. With a deterministic password scheme, this is not required. This proves to be disastrous in practice for cryptocurrencies.
295.
by ryan-c 8y ago
English words are ~1.5 bits per character, random ascii garbage is ~6.5 bits per character.
296.
by ryan-c 8y ago
A 40 character password of real words is usually easier to crack than a random 12 character string, though.
297.
by ryan-c 8y ago
There are some minor issues with the magic link workflow - one of them is security scanning software potentially visiting the link. So then you need to open the link in the same browser you want to use. But what if you want to log in on a d
298.
by ryan-c 8y ago
Writing down passwords is usually less bad than password reuse and use of weak passwords.
299.
by ryan-c 8y ago
> We could have one master password, use site and username (and maybe a counter, to make it easy to rotate passwords) as salt, and use a hashing or password derivation algorithm to derive a unique password for each service. This would on
300.
by ryan-c 8y ago
TBH, I'd be more comfortable using insecure public wifi than I would be using Tor. Tor hides the source of your communication, and evades filtering. It does not protect the contents of your communications from eavesdropping. It's

More ›