Viewing profile — Xk

You would think that it would. But the way Chrome has implemented CSP, it doesn't. When you specify a CSP in a Chrome extension, it applies to the core extension (the background pa…

There's been a lot of research about this recently (I've brought this up on HN previously). A team from Berkeley broke 50% of the 50 most popular extensions last year [1]. Some oth…

Those interested in this should look at a paper from Vern Paxon and Nicholas Weaver: http://www.icir.org/vern/papers/witty-imc05.pdf A summary of it: A worm used a linear congenita…

Thanks. Will do. edit: support email sent

You have a very severe security vulnerability on your site. Please provide an email address in your info I can contact you at. (The email field is hidden to others.) Edit: interwho…

Either you do it for everything, or you do it for only POST and you end up missing half of the vulnerabilities. Correct me if I'm wrong, but your CSRF attack used a GET request, di…

CSRF is NOT a browser vulnerability. The browser is doing exactly what it's supposed to do: load content. The browser can not (and should not) attempt to identify the "evil" HTTP r…

Researchers at UC Berkeley studied this exact question. About 40% of extensions contain at least one injection vulnerability. Some really popular extensions were vulnerable -- even…

There is an XSS on pen.io. I posted this a while ago, but feint didn't fix it. http://xssdemo.pen.io Suggestion: It is very hard to allow HTML but remove JavaScript. Write a method…

Please don't use this for passwords. Security is very hard to get right. Do they do a secure delete of the contents of the webpages? Who knows. Do they have strong physical protect…

No. If an attacker gets access to the database, chances are very very good they can get access to the key as well. Very few services correctly separate privileges well enough that …

Fine. Assume it's one bit per voxel. 512 petabits = 2 petabytes. So only 2 petabytes of data. I'd like to see the server that processed those 2 petabytes. Notch also points out tha…

That's not the case. Each Telex Station has it's own private key which it uses to decrypt the 224 bit tag. If one Telex station loses its private key, then the user will just use a…

Yeah, I realize that -- I'm just saying, for people who want to read more on the subject of Tetris there is a lot out there.

For those that care, a few years ago some researchers proved Tetris is NP-complete for many problems. http://arxiv.org/abs/cs.CC/0210020

They have an XSS on https://secure.trust-guard.com/ (enter a username like -- yes, it won't work with chrome's XSS filter)... somehow I'm inclined to believe they are not so great.…

The current implementation uses an iframe and so they can't read the data out of the iframe (same-origin policy). This would require injecting javascript on to news.ycombinator.com…

The problem with captchas is they have to be readable to humans. Sure, a captcha of "lI0Ol1o" would would probably be unreadable to a computer ... but it would be to a human too. W…

Alright; I'm confused. First they say that they "generate around 1 petabyte of data per second" Then they say "ATLAS produces up to 320M bytes per second, followed by CMS with 220M…

No. Not at all. If someone managed to break in to your website and get the password hashes, chances are they also have your "secret" salt. There is no reason to separate the salt f…

It is true that scrypt is better than bcrypt, but the transition from salt+SHA-1 to bcrypt is significatnly better than from bcrypt to scrypt, and scrypt doesn't have nearly as nic…