zemnmez

16 ms·

31.
by zemnmez 5y ago
all the places I grew up in england, we would have a wooden rack (just some wooden slats attached to kind of metal hangers) with a small winch above the boiler in the boiler room. When the washing was done, my mum would put the washing on t
32.
by zemnmez 5y ago
it seems like if this is OAuth2, the protocol is not giving an audience specifier? That would mean that any token is as good as any other, and say, authenticating to evilsite.com, the site could use the token its granted to itself log onto
33.
by zemnmez 5y ago
if handled correctly, sure. but it also means that implicit cookie authentication ('ambient authority') is possible and can easily happen by accident
34.
by zemnmez 5y ago
CORS tries to prevent CSRF issues by preventing cross-origin cookie authentication.
35.
by zemnmez 5y ago
Please use Access-Control-Max-Age instead. CORS has some nice security properties.
36.
by zemnmez 5y ago
I would look at your email forwarding filters. It's common to see compromises with this pattern where the email for your account was compromised and all the email is being forwarded to an attacker.
37.
by zemnmez 5y ago
It's interesting that the exchange (juicebox.money) takes a 3% cut, so they made about $5M off of this, despite its apparent failure.
38.
by zemnmez 5y ago
Like vinyl gloves?
39.
by zemnmez 5y ago
To clarify, that's what happens once you pass it through the obfuscation and THEN closure compiler. If you click the link you will see the obfuscation is much more complex
40.
by zemnmez 5y ago
If I recall, the whole thing took about 6 hours
41.
by zemnmez 5y ago
personally, I find the code it outputs to be easier to understand often than the source because it simplifies a lot of stuff into the most abstract logic. I think it takes some getting used to for your brain to connect those pieces, though
42.
by zemnmez 5y ago
I think most of these artefacts come from british occupation of egypt while it was a vassal of the ottoman empire, the zeitgeist of which basically started when napoleon started studying and abducting ancient artefacts into france to suppor
43.
by zemnmez 5y ago
I think closure compiler's 'obfuscation' is an incidental part of its minification passes.
44.
by zemnmez 5y ago
JScrambler I actually did de-obfuscate to bypass some very significant bot detection a few years ago, but it took a bit more doing -- it uses ES6 features IIRC so I had to transpile it down to ES5 via babel first, but it worked OK after tha
45.
by zemnmez 5y ago
makes me sad to hear that :( I will say, as a reverse engineer, that javascript minifiers like closure compiler will optimize almost all obfuscation out, and the rest you can usually translate to a form which it can understand and then it w
46.
by zemnmez 5y ago
the flowers literally die off seasonally, the only difference here is that they die looking beautiful in the home of someone you love
47.
by zemnmez 5y ago
thank you! always want to make this kind of this more accessible – especially since its so interesting. I can only say the grey market becomes more enticing every time. I personally feel like pure web bugs like this just generally get paid
48.
How to Hack Apple ID(zemnmez.medium.com)
9 points by zemnmez 5y ago|2 comments
49.
by zemnmez 5y ago
No, a CSRF token only introduces information that is not part of the ambient authority of the HTTP client (i.e. an attacker cannot implicitly use it) – it is not uncommon to have deterministic or relatively constant CSRF tokens (e.g. the do
50.
by zemnmez 5y ago
This is not related to replay. This is just a rate limiting issue. Throwing arbitrary auth mechanisms between the server and the client like that just means they need to make more requests per fulfilled request. The client is authorised to
51.
by zemnmez 5y ago
I'm so confused. The article you wrote says that you fix gimbal lock by using quaternion rotation, quote: >To fix gimbal lock, we must avoid modelling this physical gimbal system. > In 3D, instead of using 3 fixed angles that we
52.
by zemnmez 5y ago
1. I think it's important to compare the security issues that JWT has had to the alternative. There, 'vanilla' cookie auth (which I assume to be session IDs) is by far the biggest offender. 2. It's not true that JWT is
53.
by zemnmez 6y ago
I benchmarked this recently and I am pretty sure this is not true. Many of these 'single page site frameworks' work via this method.
54.
by zemnmez 6y ago
> don't use the implicit grant, please. Use the authorization code grant with PKCE. Here's an example (from a doc I helped write, talking about how bad the implicit grant is: https://fusionauth.io/learn/exp
55.
by zemnmez 6y ago
How do you make a parallel language that transpiles to a reentrant one?
56.
by zemnmez 6y ago
the fundamental assumption of the system as stated in the article is that the device manufacturer will simply never attempt to forge keys
57.
by zemnmez 6y ago
this article describes a centralised system with the fido2 key manufacturer as the source of truth
58.
by zemnmez 6y ago
No. The original art either has to be gated by a central source of truth (not decentralised), or entirely made public by uploading it in full to the blockchain. There is also not much of a concept of ‘lending’ the data, as owning the token
59.
by zemnmez 6y ago
I never made the argument that no application should ever encrypt anything at the application level. Password managers are very niche uses. "secret servers" or key-management systems are just fine using TLS imo. I helped draw up t
60.
by zemnmez 6y ago
This is a knock on application-level crypto.

More ›