tbiehn

6 ms·

1. 31.▲
   by tbiehn 9y ago

   + extra long text; To date, the strongest technologies that can be deployed to protect against these attacks are insufficient. Some technologies are on the right path – SubResourceIntegrity (SRI) promises to help organizations manage the ri
2. 32.▲
   New Standards for Preventing Browser Hijacking

   1 points by tbiehn 9y ago|4 comments
3. 33.▲
   by tbiehn 9y ago

   I'm a bit confused as to why they cite https://www.usenix.org/conference/usenixsecurity16/technical... , but then don't evaluate their performance relative. The selection of JTR and HashCat rule eval is
4. 34.▲
   by tbiehn 9y ago

   Hey Simon, looks like an interesting game...
5. 35.▲
   Java Deserialization with DNS Exfiltration

   1 points by tbiehn 10y ago|0 comments
6. 36.▲
   by tbiehn 11y ago

   Very cool, I'll have to take a look at the gorilla/sessions work. As for the cookie mode, I'd make encrypt + HMAC [along with the nonce + timestamping & expire goodies] the default. There are a lot of reasons you shouldn
7. 37.▲
   by tbiehn 11y ago

   Interesting. Not sure why you'd keep them intact. What's the hip solution for keeping a session-scoped, server-side data store? Recently dove into that for Hapi.js, found out that many people encrypt these and stuff them into cook
8. 38.▲
   by tbiehn 11y ago

   The security section, specifically on encryption, is dangerously misleading. It really needs an overhaul. To start with - DES is broken, you cannot use it. It also totally blasts over important details like -not re-using the same IV- for AE