theboss

12 ms·

61.
by theboss 13y ago
I don't understand how anyone can throw last pass under the bus here. 0day where an unbelievable amount of sites are affected. last pass comes out and says we were vulnerable and we fixed it and provides information as to what it means
62.
by theboss 13y ago
That is the login form. I'm not sure how to paste code onto hacker news so here is a pastebin of the registration form. http://pastebin.com/Ctkw6S2h Well a better practice would be all HTTPS for the site. There are a l
63.
by theboss 13y ago
The form action for registration is not https. Also, they have nothing to prevent a MITM from changing where the form action goes. Why would anyone use this...
64.
by theboss 13y ago
Not even just the code....your password and email are both over http.......
65.
by theboss 13y ago
Or use a secret skype if it is necessary... A lot of streamers use skype to provide content of them interacting with others in an interesting way (and skype is pretty good for this without the hassle of ventrilo, mumble, teamspeak, or whate
66.
by theboss 13y ago
Hey I am not looking for a job but I love flight aware and use it daily (even though I fly only once or twice a year). It is just fun.
67.
by theboss 13y ago
The only thing safer about this that I see is it is extremely small. No high assurance design, etc. What am I missing here that makes them advertise its safety?
68.
by theboss 13y ago
There was a keybase security vulnerability reported last week as well. I'm not sure if it is 100% relevant because it had nothing to do with js crypto, but it could have allowed someone to impersonate 'liz' as 'iiz'
69.
by theboss 13y ago
Car security is a big deal. The amount of code running on cars compared to the amount of security researchers working on it is incredible. I can count the car security researchers I know of on one hand. This is really something we really ne
70.
by theboss 13y ago
Now lets see you find kernel32.dll and do it on windows when you can't make syscalls however you want =]. Good write-up it was well written and very understandable.
71.
by theboss 13y ago
There are a few funny things about keybase. First, should they even make it an option to give them your private key? I believe they should not. The thing this doesn't solve is it opens the door for new attacks. What happens if I make a
72.
by theboss 13y ago
You clearly did not understand what I said. I wrote that I used chrome, which I assume has a pin for google sites because even when you allow HTTP in your Gmail account, you would be taken to the HTTPS site. Then, when going to firefox, It
73.
by theboss 13y ago
Clearly I did notice otherwise I wouldn't have a personal story about how I noticed. Also, there isn't much you can do. You type in gmail.com, and on one browser I would be automatically taken to https for years. I switch to a dif
74.
by theboss 13y ago
It is incredible that gmail even had HTTP enabled. It was an option in the gmail account settings. Honestly I am ashamed it took this long. Their documentation stated that by default HTTPS was enabled, but this wasn't the case for me.
75.
by theboss 13y ago
>Top candidates If they are top candidates, why are you asking them to solve a problem that might as well be copied directly from a college text book? >my version of fizzbuzz How many times do you write a for/while loop a day whe
76.
by theboss 13y ago
I have an interview with Google this week. I've expressed my interest in security to the recruiter 3-4 times and I have been told I will be interviewing as a software engineer (aka....a data structures and algorithms interviewing...)..
77.
by theboss 13y ago
I'm not sure I agree with ``carelessness, undeserved self-confidence'' but I definitely agree with ignorance. I think the best thing is that people writing code just don't understand the internals of how a lot of web att
78.
by theboss 13y ago
I dont think you realize how common the WTFs in this situation are. If you are dealing with a reputable company, this is super super WTF. When you are looking at a small website/API someone made for fun or something....It can normally
79.
by theboss 13y ago
those reports were already confirmed false (insane, less than a minute later) http://www.theguardian.com/world/2014/mar/08/malaysian-airli...
80.
by theboss 13y ago
My first thought too. I'm assuming it works like. 1. I need to find something, I tell trackr the id of my token. 2. trackr tells other trackr users the id to look for. 3. trackr enabled phones search in vicinity for it. What happens wh
81.
by theboss 13y ago
I'm currently a student. I think it's easy to get us to drink the Kool-Aid about how much nicer life is at one of those big companies. Myself included, it is easy to forget you have a lot of work to do at these places. I've h
82.
by theboss 13y ago
I can vouch for this guy. He works for cigital and is a good guy. I've actually never heard him say anything negative about Cigital either.
83.
by theboss 13y ago
I've talked to Silent Circle at conferences and what not. It is not like they have some crypto noob working on their project...They have Phil Zimmerman. But, knowing nothing about them, when I asked them ``How does your protocol compar
84.
by theboss 13y ago
I've also experienced this. Recently I interviewed at a big tech company and when I received the original e-mail it said "Hello NAME" instead of my first name. I asked if it was recruiter error or programmer error and never g
85.
by theboss 13y ago
Yeah the biggest problem with mobile devices I see that desktop applications have less often is crypto problems..It will get better as the time goes on.
86.
by theboss 13y ago
Is it possible that this is also for user retention rather than solely adding new users?
87.
by theboss 13y ago
You're right it isn't well suited for security people.... But is it well suited for software engineering types? Most code people write is not a search sort insert etc. Most of the details of using these data structures are invisib
88.
by theboss 13y ago
Believe me, I can and do implement them, but I always do so backhandedly. ``I am a security engineer, what does this have to do with security''. In reality, I have not accepted an offer from any companies who ask me these question
89.
by theboss 13y ago
So accurate. I'm a grad student who studied security deeply during my time in school. I want to keep my hands on a keyboard and I don't like airplanes (which rules out consulting) so I've applied at a lot of companies to be a
90.
by theboss 13y ago
I don't see why a lot of people disagree with his advice. Perhaps it is the words he uses. These are his basic divisions of cash. 1. Live cheaply. Don't waste money where you don't need to. 2. Expand your network by being nic

More ›