ryalfalpha

13 yıl öncediscuss

You can fake it with a number of extensions, but there's a load of fingerprinting options that are sneakier than the user agent. The Tor Browser project has a document outlining changes they had to make to make things less fingerprintable.

ryalfalpha

13 yıl öncediscuss

The real question is, can you delete it completely? :)

ryalfalpha

13 yıl öncediscuss

That's a fascinating idea, even if it's not made public to the end user. Getting the git blamed stacktraces mailed to the dev team would be interesting!

ryalfalpha

13 yıl öncediscuss

Definitely recommend this site, it was a big influence in my early programming days, I found it way more interesting than Project Euler.

ryalfalpha

13 yıl öncediscuss

Whenever said members/affiliates are former leaders we're really just splitting hairs. I get your point though, I mistook what he had said as there is no link at all between them. Instead he is saying 'The Irish government never commanded the IRA' which I'd largely agree with.

ryalfalpha

13 yıl öncediscuss

I don't get your comment?... prominent members from various versions of the IRA are and have been members of Irish governments, see Gerry Adams/Martin McGuinness (Or even Michael Collins if you're talking way back).

ryalfalpha

13 yıl öncediscuss

Here's my reference for reference, http://www.slideshare.net/grugq/opsec-for-hackers (slide 137/138)

I cannot recommend either, but I would note that in your link they do seem to state 'Anyway, not so many people seem to do use a tunnel before they connect to Tor, therefore it's not so well tested, do not rely on it too much.'. So I'd be wary of their advice for anything you need to bet your life on.

ryalfalpha

13 yıl öncediscuss

I don't want to slam your site too much, but just because You don't log Typeview information doesn't mean someone doesn't. If you're using regular HTTP then everything the user types in your textbox can be intercepted by people on the network or logged on proxy servers anywhere. This is not something the user expects to have to worry about.

Mentally, the google search box has a very different contract than a textbox to communicate with support staff, the user generally gets immediate feedback and understands their data is being sent as they type.

ryalfalpha

13 yıl öncediscuss

From what I remember, Wave had it optional as they even said themselves a lot of people were uncomfortable with the idea of people seeing their train of thought (and mistakes). It's an interesting idea but it's a horrible way to treat the user.

ryalfalpha

13 yıl öncediscuss

If you have to update your browser to read a site, on a site that's main function is to provide someones thoughts in text form, then I'd consider the website at fault.

ryalfalpha

13 yıl öncediscuss

Yes, as far as I've heard,

  VPN -> TOR = DANGER, 
  TOR -> VPN = PROBABLY_OK

You should probably make the 'Lahana is not super secure' really BIG and BOLD for the reader so they can understand their risk.

ryalfalpha

13 yıl öncediscuss

I'd replace 'good at programming' with 'proven ability to ship'. Most of the time it's values way over a decent codebase from what I can see. Which is often fair enough!

ryalfalpha

13 yıl öncediscuss

Haven't done much golang and don't have it installed on this laptop, but are string comparisons constant time?

If not, I think there is potential for a timing attack here?

if usr == _admin_usr && pw == _admin_pw { return RootMode, nil }

ryalfalpha

13 yıl öncediscuss

Someday ;)

Perhaps there could be open whitelists where sites could nominate their sites as 'https only'. Wouldn't even need to be built into the browsers, could just be a thing people do when they launch a clean browser install, hit up https://blahsitelist.com and click a button that fires off https requests to all of those sites which would cache the HTST header? (I've only stumbled on HTST headers today, so I may be overly flamboyant as to their usefulness)

Although, come to think of it, isn't that just basically what the HttpsEverywhere extension does?

ryalfalpha

13 yıl öncediscuss

That's a valid point, but I can't see it being an impossibility that the user will never accidentally stumble sending a http request rather than https. Whether that is user input, or a maliciously placed link.

My understanding is that the HTST header would make this attack less useful. But it's still a concern if you used Private Browsing/Incognito. The initial request will still hit a 301 (vulnerable to interception by MITM). I've just verified this with Facebook.com on my machine (Chrome 26, OSX).

I think it's quite fair to expect a user using this kind of site is likely to use Incognito.

I'm actually kind of surprised as I thought Chrome had a standard list of sites that use https only such as Facebook. (Woah.. seems the preload list is TINY http://www.chromium.org/sts )

ryalfalpha

13 yıl öncediscuss

I said 'Not sure how valid that still is' for a reason :). I just found it extremely interesting and 'out of the box'. After reading up a bit on modern defences, I think you're right that it's irrelevant nowadays. (Unless you're in legacy hell, doubtful for the target user demographic)

But the parent comment is still valid, there's nothing to stop Moxie registering another domain even note-crypt.com or notecrypt.org or anything like that and the average user will be complacent with that. (same applies for appspot, note-crypt.appspot.com vs notecrypt.appspot.com vs notecrypto.appspot.com)

It only takes a single lapse in checking the domain and they've lost their login details and encryption key to the attacker.

Point is, the JS crypto does not add anything to the situation. All the security is provided by SSL, and once it goes, the JS doesn't help. It just gives the users a fake sense of an additional layer of security, which is dangerous.

Moxie broke the current SSL usage, and therefore, he broke the JS crypto (as he controls the communication channel). He beat the current state of the challenge.

ryalfalpha

13 yıl öncediscuss

I think it's also worth pointing out in Moxie's sslstrip talk he does go into detail on using IDN http://en.wikipedia.org/wiki/Internationalized_domain_name to spoof something similar (for non-english TLDs).

Not sure how valid that still is (as the talk is a couple of years old? I only watched it today), but it has to be assumed that a portion of users are going to fall for even a badly mimicked url.

Gotta say the IDN stuff is impressive in how generalised it could be. Terrifying. I'm convinced he's owed the $1,000.

ryalfalpha

13 yıl öncediscuss

Could probably ensure it fits in the window nicely though, with zooming etc. Seeing only the North-West of London on screen without scrolling is not as useful. I'd imagine it's damn hard to use on a laptop without two direction scrolling. Functional over pretty, I vote :)

ryalfalpha

13 yıl öncediscuss

I'm pretty sure there's a market for this, I was in talks with a major Chinese company hiring to achieve a similar service for brands on Weibo (Chinese Twitter/Tumblr mashup). But it sounded kinda scummy to me and I dislike social media so I bailed.

They seemed to have a pretty manual system already up and running and were working on automating a lot of the churn, not sure how well that would translate to English markets, but I'd bet some companies would pay for it to save themselves hiring 'that social media guy/gal'.

ryalfalpha

13 yıl öncediscuss

It's just a larger, older model with less storage capacity! http://upload.wikimedia.org/wikipedia/commons/8/82/8-inch_fl...

comments