acorn221
Joined 2 years ago
Karma
43
Submissions
60
Member since
Jan 22
Recent submissions
Comment · 1 month ago
TL;DR. SConnect - 1M+ users, an extension middleware+native host for authentication with eIDs, 3SKeys and other hardware signing tokens had a drive-by RCE which enabled any site or iframe a user saw to silently download and execute a dll due to a poor hand-rolled implementation of RSA-2048 token validation, enabling a use of uninitialized memory validation bypass which enabled "plugins" (DLLs) to be loaded. v2.16.0.0 of the extension and native host is vulnerable. CVE-2026-18397. CVSS 9.4.
Comment · 2 months ago
Damn Rory, I didn't know you wrote fiction! Nice work here
Comment · 2 months ago
The only numbers I've got right now are the 2M+ weekly active users on the chrome web store listing - I've not got exact numbers for how many people use the card readers but I get the impression it's more common in the legacy enterprise/government world.
The 2M+ WAUs would still be vulnerable to the RCE (assuming the native host is setup) independent of whether or not they have a card reader.
Comment · 2 months ago
Thanks! ItsMe actually uses the connective signing ext system to sign users up so it's likely lots of people signed up for itsme with this flow and just never uninstalled the extension and native host.
Comment · 2 months ago
The thumbnail is ai generated, the content is not. I'm OP here.
I can't afford artists to draw all the thumbnails and I'm not going to refrain from using all the tools at my disposal.
Comment · 3 months ago
First DEF CON, first conference talk and I loved it.
Comment · 4 months ago
This is my extension, I made it because I hate the UX of PGP.
It uses passkeys (or passwords) to encrypt all keys (public and private) at rest so your contacts can't get leaked easily.
I do a bunch of vulnerability research with sensitive info and I hated having to go to the CLI every time I wanted to encrypt a new message. I found myself getting lazy and not encrypting messages.
Uses SequoiaPGP via WASM in rust, private keys only persist in ram when they are being used (or you can choose to cache them) and it doesn't let the JS hold the pvivate keys where garbage collection can persist them longer than needed - it zeroizes wherever private keys are being used.
[ my public key: https://keybase.io/acorn221; my proof: https://keybase.io/acorn221/sigs/HNuGB86oGNLZmZ5LKSsMcUw47UUd0ws0whQiuzhudHQ ]