Viewing profile — DrewHintz

I’ve had luck with a workflow similar to: git clone a repo Open goose with that directory Instruct it to discover what the repo does Ask it to make changes to the code, being detai…

I tell it to discover that itself by asking leading questions: “What does this repo do?” “How do you run its unit tests?” “What does file foo do?”

I'm guessing an "internal tools scaffold" is something like Goose: https://github.com/block/goose Instead of just generating a patch (copilot style), it generates the patch, applie…

Square | AppSec, vulnerability discovery, pen testing | Remote in North America We're hiring people to find vulnerabilities in Square products and services! The team is brand-new w…

"Consumer Gmail content will not be used or scanned for any ads personalization after this change." Original post: https://blog.google/products/gmail/g-suite-gains-traction-in... D…

https://security.googleblog.com/2013/05/disclosure-timeline-...

Here's the tweet: "The County was working cooperatively with the FBI when it reset the iCloud password at the FBI's request." https://twitter.com/countywire/status/7008878234826301…

Sure thing, I'm happy to help. Our code is at https://github.com/google/password-alert and feel free to email me any questions at drew@overt.org However we haven't published a good…

> isTrusted can apparently be spoofed isTrusted cannot be spoofed in this situation, which is its intended use in Chrome. A Chrome extension in the isolated world is receiving even…

> Yes, we're pushing the notification to a new tab (which can't be blocked or interfered with) We went through a similar iteration with Password Alert. If you're setting focus on t…

This can be protected against by the extension looking at keyboardEvents and verifying the isTrusted attribute. Here are details about how we do this in Password Alert: https://git…

> LastPass also detects you enter your master password on an incorrect domain and notifies you immediately of your mistake Interesting! How does it do this?

I agree that it's not yet ready for general use, but what hardening do you expect to happen in the coming months? I'm one of the original end-to-end authors, but haven't worked on …

Thanks, that's a fair point. However I've been surprised to see that in well-executed attacks, even the best of us can at least occasionally fall for password phishing.

A while ago this was sort of leaked on HN, but someone called it "really unlikely": https://news.ycombinator.com/item?id=8566485 https://news.ycombinator.com/item?id=8566022 Now we…

This diff appears to contain the patch: https://launchpadlibrarian.net/185571456/apt_0.7.25.3ubuntu9... For example, you can see the change in cdrom: handling code as mentioned in …

It's not actually related to Project Zero. There are quite a few people here at Google, both on Project Zero and on other projects and teams, that routinely find vulnerabilities. H…

Just someone reading source code. Coincidentally, the same way Heartbleed was found.

> Is there any evidence of this having been used in the wild anywhere? No.