andygambles
Drop-Down Usability: When You Should (and Shouldn't) Use Them
It's Pronounced 'Jif' Not 'Gif' Inventor Confirms
Browser Exploit Finder
INFORMATION ABOUT DATA SECURITY INCIDENT BY THIRD-PARTY SUPPLIER
Re:Google Private Key Compromise
on Monday April 02, 2018 @09:06AM (#16734139)
Re:Accessing Google’s Private Key
on Monday April 02, 2018 @05:47AM (#16733372)
Cloudflare Key Compromise: https://twitter.com/ECCTLS/status/980661799539310592
Accessing Google’s Private Key
Google Private Key Compromise
Introducing the security center for G Suite–security analytics and best practice
Re:Are EV certificates worth the paper they're written on?
on Wednesday December 06, 2017 @03:01PM (#15864448)
> One of the things that I wish we had across browsers was a consistent UI so we could reliably inform users of the indicators to look for.
The UI was consistent with a green address bar as agreed in the cab forum. It was Chrome that broke away from this consistency.
Re:Are EV certificates worth the paper they're written on?
on Wednesday December 06, 2017 @02:56PM (#15864397)
There needs to be a mechanism where a site can provide its verified identity to allow the user to know exactly who they are.
Not every site will need or want this but the ability should exist.
At the moment EV provides this ability. If EV is not seen as the answer then we need to have something else instead. We could decouple this from HTTPS but identity is also a valid purpose of signed certificates.
Morrisons data leak: Supermarket liable for staff details breach
UK Porn Is About to Change in a Way You're Not Going to Like – VICE
Microsoft Browser Fails During Microsoft Demo Presenter Downloads Google Chrome
Disclosure: WordPress WPDB SQL Injection – Technical – Ircmaxell's Blog
Re:Google Payments Center
on Wednesday October 25, 2017 @03:26AM (#15548183)
Behind a Google Login but interface is at https://payments.google.com
Google Payments Center
Chrome Full Screen is no longer showing tabs in windows on Mac OS
Re:Key Reinstallation Attacks – Breaking WPA2 by Forcing Nonce Reuse
on Monday October 16, 2017 @09:11AM (#15482906)
Have I got this right in lay-mans terms.
The client is forcibly disconnected from the WiFi network and reconnects to the attackers network instead.
The attacker doesn't need to know the WPA2 password but it accepts the connection setting the encryption to zeros.
The client thinks it is connected to the original wifi network and continues as normal.
Wifi traffic is intercepted and unencrypted.
Re:Equifax website hacked again, this time to redirect to fake Flash u...
on Thursday October 12, 2017 @07:47AM (#15457272)
Which is easy if you set preload header.
Re:Ask HN: What is your preferred method of sending large files over t...
on Wednesday October 11, 2017 @03:28AM (#15447889)
https://wetransfer.com
Often sending to non-technical people and this I have found is the easiest solution they understand. Click and download.
Would use Google Drive but it makes the download process rather complicated and non-obvious.
A $96B fund firm created a AI hedge fund, but didn’t know how it worked
Hacker Typer
EUD Security Guidance: Chrome OS 56 – NCSC Site
DigiCert to Acquire Symantec’s Website Security and Related PKI Solutions
Re:Google Search: Inurl:server Filetype:key “-----BEGIN RSA PRIVATE KE...
on Monday July 31, 2017 @09:46AM (#14891882)
I used inurl:server to restrict the results to mainly just server.key files so revealing the private keys of HTTPS websites.
Of course you can remove it. Just means more results to wade through.
Re:Google Search: Inurl:server Filetype:key “-----BEGIN RSA PRIVATE KE...
on Monday July 31, 2017 @08:31AM (#14891283)
Some of the results are web servers leaking the private keys of the website or in some cases mail servers.