nhm

Related EFF article, "Finally Revealed: Cloudflare Has Been Fighting NSL for Years": https://www.eff.org/deeplinks/2017/01/finally-revealed-cloud...

> outsource to people who obsess over doing this right

Completely agree! I often have to fight that "I could just build that myself" mentality, which glosses over the points you made so well.

This is such a neat hack! I wasn't able to figure out how to get a padlock at the start of the spoofed domain, but as an example, chuck this in your browser bar `عربي.امارات/google.com/test/test` (no need to hit enter)

*edit: HN removed the unicode lock. It was after the .com

Contextual / behavioral authentication is taking off! Ping Identity just announced some new contextual features: http://www.businesswire.com/news/home/20160815005676/en/Ping... (Press Release).

And it's what we've been doing at ThisData for quite some time now: https://thisdata.com. Glad to see the topic getting some visibility.

If you're allergic to Forbes, I wrote a short summary on my company blog: https://thisdata.com/blog/bug-in-apple-products-allows-passw...

Tyler Bohan's original disclosure writeup (with some technial details) is here: http://www.talosintelligence.com/reports/TALOS-2016-0171/

Revert is hiring in Auckland, NZ: https://revert.io/careers Looking for a Senior/Intermediate Ruby dev, ElasticSearch and/or "Big Data" experience is a bonus. Also a graduate position, designer, and sales rep. We'd love to hear from you!

I work at Revert, and I second this plug! Evernote is one of our most popular apps, and we also back up Dropbox, Google Drive, Tumblr, and more.

Feel free to ask any questions you might have :)

And a blog post introducing Dr. SaaS: http://rowansimpson.com/2014/11/06/dr-saas/

"... for a total of approximately $2 billion. This includes $400 million in cash and 23.1 million shares of Facebook common stock (valued at $1.6 billion based on the average closing price of the 20 trading days preceding March 21, 2014 of $69.35 per share). The agreement also provides for an additional $300 million earn-out in cash and stock based on the achievement of certain milestones."

http://www.prnewswire.com/news-releases/facebook-to-acquire-...

More details at http://www.prnewswire.com/news-releases/facebook-to-acquire-...

"... for a total of approximately $2 billion. This includes $400 million in cash and 23.1 million shares of Facebook common stock (valued at $1.6 billion based on the average closing price of the 20 trading days preceding March 21, 2014 of $69.35 per share). The agreement also provides for an additional $300 million earn-out in cash and stock based on the achievement of certain milestones."

Here's the founder talking on the local news: http://www.3news.co.nz/Vend-the-new-Xero/tabid/421/articleID...

Facebook has an explanation on that page:

> You can see your name and profile picture because you're using a computer network you've logged in on before.

At least, that's what I saw when I did it on myself in an incognito tab.

In the 16th picture, zoomed in, you can see the server target is 94.100.184.14, which apparently belongs to e.mail.ru

The article isn't proving anything, it's an example of how a known problem affects MEGA. It's saying encrypt your files first, because trusting MEGA (or anyone who uses that kind of encryption) is not enough.

Yea, he did. I think the point is more that MEGA can read the key, and your files without permission. This contradicts their claim "Your data is encrypted by you before upload to our system and therefore we do not and cannot access that content"

>Unfortunately, since it is a university research group, they probably disclosed responsibly and whatever defect allowed this form of jailbreaking will soon be fixed.

I wouldn't consider that unfortunate. Responsible disclosure should be praised!

> You're not going to use Tumblr because Yahoo! is rumoured to be buying the company?

Yes. At least not for a story which reflects badly on the potential acquirer. Makes sense to me.

It was only IMAP, not SMTP, so I doubt it. Then again, if they can get this wrong it's not so unlikely that there are more vulnerabilities.

I just wrote my own post about how, two weeks ago, I could log in to Yahoo Mail with any password (http://nick.malcolm.net.nz/2013-05-20-yahoo-imap-vulnerabili...).

I agree with Nils that talking to bots sucks! These are big issues, and it feels lame if you don't think the issue is being given the attention it deserves (even if that attention is directed at you).

I was going to write this on my tumblr blog, but decided that might not be such a great idea in light of recent events ;)