Viewing profile — bcrypt

Tor Browser does more than just proxying. See my response above.

i run security at Brave and here's the answer from Taylor, our lead Tor dev: Using the Tor network is one part of internet anonymity, serving to conceal where you are. But using th…

Having visited her (I wrote the original post), I can say this is absolutely untrue. She is much, much better off in the prison among other inmates than in solitary. IIRC, solitary…

FWIW, Chelsea reads every single letter she receives unless it's illegible. Mail is much appreciated. -yan (author of blog post)

Yeah, part of the nice/scary thing about HSTS is that it is a highly persistent cache. The browser is reluctant to clear it because it's a security feature. So HSTS pins can be sto…

Tor Browser restricts js timing precision to 100 milliseconds, which makes this way harder. HTTPS Everywhere also creates a lot of false positives, although those can be subtracted…

[edit - just realized this may not answer the question you asked, which is leaks that take advantage of HSTS/HPKP/CSP. hopefully still useful info.] I may write a blog post later a…

In addition to Egor's stuff, I'd recommend just reading the "Privacy and Security Considerations" sections of various RFC's and W3C specs. Lots of theoretical attacks in there that…

In any case, I didn't minify or remove comments, so you can just view-source: http://zyan.scripts.mit.edu/sniffly/index.js

Yeah, I think the accuracy so far has been like 75-80% among my friends (once httpseverywhere is disabled). PS: you can check whether sites are in your HSTS cache in chrome at chro…

I pulled the list of domains out of the Alexa Top 1M plus some domains that my friends run. But I'm not biasing results towards showing up as visited by popularity or anything like…

adblocked domains are indistinguishable from hsts blocked domains in terms of timing. so they show up as false positives. a clever attacker could subtract them out though.

what browser and extensions? feel free to file a bug at github.com/diracdeltas/sniffly

interesting, are you using any browser addons? please file a bug at https://github.com/diracdeltas/sniffly , thanks

sort of. the hsts cache gets cleared when a private browsing session is closed or when you clear it manually in browser settings. it takes a long time (up to a year) to expire on i…

creator here. sorry, i did not expected to be hn'ed. not running js is usually a good idea though!

There's actually a fair number of security researchers looking at browser-level exploits like those in JIT (c.f. pwn2own). My colleague Chris Rolhf co-authored a cool study on atta…

That's really surprising. Thanks!

That's correct. I did not discover vulnerabilities in existing libraries or add backdoors to any of them. :) The attack scenario described in the post is (1) attacker writes some p…

OP here. Agree there probably isn't much benefit to minifying server-side code. However, I wouldn't be surprised if things like Closure Compiler were useful server-side. Not convin…