ygjb

56 ms·

661.
by ygjb 13y ago
Happy to answer any questions you might have!
662.
by ygjb 13y ago
We did tell it like it is. In the security reviews (note the plural; we have ongoing reviews). Here is the documentation from the initial public release: https://wiki.mozilla.org/Security/Reviews/Identity/bro
663.
by ygjb 13y ago
https://github.com/mozilla/browserid/blob/dev/lib/db/mysql.j...
664.
Ask HN: As a founder, what do you wish you knew about security?
25 points by ygjb 13y ago|2 comments
665.
by ygjb 14y ago
I (sort of) understand the argument, but it does feel kind of out of place since the specific objective of that page is providing guidance on building UI for a specific mobile platform that is build using a modern browser at its core :/
666.
by ygjb 14y ago
You just made his point.
667.
by ygjb 14y ago
It really depends how much they go into the Google Apps bit; for $50 you are not getting word and excel, you are getting a whole range of related IT services, including online document sharing with access controls. That in and of itself is
668.
by ygjb 14y ago
I don't see a detailed analysis of your RNG that would support the claim that it is suitable for use as a CSPRNG.
669.
by ygjb 14y ago
Until DomCrypt[1] is implemented there is no reliable way to implement a CSPRNG in Javascript (that I am aware of!). The only way to do this securely would be to supply a page that includes some javascript to process a secret key that the
670.
by ygjb 14y ago
letting someone else generate your private key, seems legit!
671.
by ygjb 14y ago
Just a further comment, anyone interested in writing such an analysis or document should contact us with any questions!
672.
by ygjb 14y ago
Nothing is extremely painful for a federated identity protocol (although I think it should be a clear option for those of us who take these things seriously!). Printed reset codes are part of the way there, but how many people will actua
673.
by ygjb 14y ago
Your last point is not completely accurate; with Persona and 2-factor auth on your email account, you would then have verified ownership of your email account via 2-factor authentication. This doesn't mean that every assertion generated
674.
by ygjb 14y ago
Assuming of course, that your platform allows you to run virtual machines...
675.
by ygjb 15y ago
It would be pretty easy to build a tool to route around that type of law. I create a service that encrypts blobs of data (encryptmyblo.bs), and uses a (publicly defined somewhere) postMessage API to communicate that blob to and from a key
676.
by ygjb 15y ago
How much is "as far as I know" worth these days?
677.
by ygjb 15y ago
So close... add a couple more details: - Google makes money from ads - Promoting open web technologies reduces the stack they have to support - Promoting open platforms removes roadblocks to reaching customers - Supporting "competitors" tha