zemnmez

15 ms·

91.
by zemnmez 6y ago
since this is for security: I'm quite uncomfortable with the way APIs are exposed to the browser instance that does the UI rendering. As far as I can see from the code, extremely sensitive functions such as 'execute' are atta
92.
by zemnmez 6y ago
this is awesome! Terminal programs are so satisfying, but at the same time it always feels like they miss so many primitives that I take for granted for content display
93.
by zemnmez 6y ago
seems like something having a rooted os would fix pretty quickly
94.
by zemnmez 6y ago
looks like there's a password on the plugin it uses (it's optional though, and it resommends it specifically when putting the API online, which is probably slightly more secure)
95.
by zemnmez 6y ago
I don’t see any authentication on this? can’t any website just make requests to my obs via localhost if i install this?
96.
by zemnmez 6y ago
i think perception of novelty and 'quaintness' depends on where you grew up. As someone from the UK, Oxford and Cambridge are, yes, absolutely beautiful: but they were built for the education of, and sponsored by kings and society
97.
by zemnmez 6y ago
if you're dealing with a major corporation paying six figures for a novel exploit to be developed specifically so a national intelligence agency can catch you, i think going to all the effort of preventing disclosure of your IP address
98.
by zemnmez 6y ago
"develop" here refers to the process of (potentially) researching and then subsequently writing the software that exploits a vulnerability (an 'exploit'). It's used in the same sense as any other software developmen
99.
by zemnmez 6y ago
'in one place' is i think using a model of security that's too simple to think about the way Vault works. Those secrets can only be properly decrypted by the right services. To everyone else, they're just noise.
100.
by zemnmez 6y ago
another day, another set of misrepresented vulnerabilities from the security consultancy vuln mill: 1) Zoom client application chat Giphy arbitrary file write This is not an 'arbitrary file write'. There is virtually no 'arbi
101.
by zemnmez 6y ago
This is the best answer I know of. A secret management system is what you want, for several reasons: 1) Secrets checked into code means when the code gets stolen, this is an unimaginably major breach. Code tends to get stolen eventually and
102.
by zemnmez 6y ago
your original post has several replies explaining why this is not a security issue. the token you ultimately get is a signed concatenation of 3 base64 encoded fields, and unless you decided to manually separate and decode these without veri
103.
by zemnmez 6y ago
> I understand why they wanted to modify OAuth 2.0, but departing from a spec is a very risky move. The token described in this disclosure is an OpenID Connect 1.0 Token. OIDC is a state of the art AuthN protocol that supersets OAuth wit
104.
by zemnmez 6y ago
would always recommend the standard id_token form for any authentication JWTs https://openid.net/specs/openid-connect-core-1_0.html#IDToke...
105.
by zemnmez 6y ago
people will really write a bunch of opengl graphics demos and think that's all there is to ui
106.
by zemnmez 6y ago
this is an interesting approach that I hope we see more of! but i specifically meant to refer to security components of a protocol: e.g. that whether a party can impersonate another with access to some information that is public or can be d
107.
by zemnmez 6y ago
being in debt as a country is very different to being in debt as an individual as a country's expenditure directly correlate to its earnings. in this sense, it's unwise for a country to 'save' in the same way individuals
108.
by zemnmez 6y ago
formal verification continues to come up, but it has the issue that you can only formally verify problem domains you already expect -- and the advanced threat actors for which formal verification is necessary have the toolkit to go off-scri
109.
by zemnmez 6y ago
the WHO is... corrupt? this is the first I have heard of such an idea. What would someone gain by I guess bribing the WHO?
110.
by zemnmez 7y ago
sure, you can't separate it out if it didn't need to be separated in the first place
111.
by zemnmez 7y ago
you could fix this pretty effectively with the Content-Security-Policy: sandbox header, which would just deny all same origin policy access
112.
by zemnmez 7y ago
you can get all these benefits by pre-rendering and hydrating using a system like react-snap. this means static rendered html is served and the react control is then re-added, or ‘hydrated’ into the DOM content
113.
by zemnmez 7y ago
Anyone know when this was released? > largely dismissed by computer security reseachers and practitioners due to a history of misunderstandings seems incorrect now as virtually all web auth systems are capability based
114.
by zemnmez 7y ago
> Well the point is, Authenticating the user happens before the JWT token is issued In the case of OIDC, the ID Token is the contract of authentication. So when I login via Google, both the consumption of my username / password to
115.
by zemnmez 7y ago
i cant help but feel Go is the new Javascript. Everyone wants to complain about how its semantics as a language do not align with their favorite programming paradigm. In this case, having complex, algebraic type-based abstractions that atte
116.
by zemnmez 7y ago
i think this is conflates the common use of jwts vs their possible use cases. jwts are just standard signed information after all! Open ID Connect, probably the best extant user authentication protocol leverages JWTs to build the ‘ID Token’
117.
by zemnmez 7y ago
this is a proof that a user viewed a webpage rather than a proof that a webpage existed with given contents, which would need many users to find consensus on the content of a webpage. as a result of this model, there's no way to verify
118.
by zemnmez 7y ago
> I also think it’s unfair to suggest this is an issue due to lack of talent. Although I’d be open to knowing what you think is lacking in particular. I mean talent in the sense of hiring. Games companies don't hire security enginee
119.
by zemnmez 7y ago
What's the benefit of doing it this way vs in a traditional <iframe sandbox="allow-scripts"/> ?
120.
by zemnmez 7y ago
i believe those restrictions are for the same reason. I have a few leading dash hostnames and i only use them for attacking cli tools

More ›