erbbysam
Joined 14 years ago
Karma
226
Submissions
32
Member since
Jan 10
Recent submissions
Comment · 10 years ago
Comment · 12 years ago
A short story on that as a Defcon 22 badge competitor - When we reached the stage where we got the "Lorem ipsum" page. We first noticed that a bunch of the lines did not directly follow the "Lorem ipsum" format exactly and had strange capitalization. So we thought that the difference between the expected "Lorem ipsum" text and this text was the clue... We eventually figured out if you pasted the entire block into Google translate something strange would pop out (that was relevant to another hint - https://www.defcon.org/1057/SarangHae/ and then was useful again with what that email address returned ).
Looks like Google updated their latin translator to completely break the puzzle :)
page in question: https://www.defcon.org/1057/FissilingualElucidation/
Comment · 12 years ago
Nice work, sorry to be that guy, but it should IIII, not IV on the second clock face - http://www.ubr.com/clocks/frequently-asked-questions-faq/faq... ( via https://en.wikipedia.org/wiki/Roman_numerals )
Comment · 13 years ago
Yup it's possible. It doesn't appear to be here though, especially if the files have any sort of lifespan not dependant on the users browser staying open. Anyhow, I built something similar over at rtccopy.com which does use webrtc
Comment · 13 years ago
No, I currently just manually keep the site in sync with the repository. Not exactly the most professional system but it got the job done. I'm going to look into that(not sure exactly how it works, but I do need to keep a node.js server running as well for webrtc negotiation) , as well as potentially just installing git on the server and have it sync up to the repository.
Comment · 13 years ago
Chrome Canary is the only Chrome version that has working SCTP (reliable) datachannel support at the moment. It's broken(undetectable also) in every version before that (you can try, the website won't stop any version, just display warnings).
I did have unreliable datachannel support initially, but as both Firefox & Chrome now support reliable, I see no reason to keep that overhead/extra code around. Hopefully working reliable datachannels in Chrome will reach the primary version soon!
Comment · 13 years ago
Comment · 13 years ago
It looks like this is leaking the room name to Google Analytics. After thinking about this more, I'm going to go ahead and remove that. I should be able to monitor the server itself to make sure it isn't getting overloaded.
Comment · 13 years ago
Thanks for the feedback.
In defense of this implementation -
- The only external JS loaded on this site is google analytics. Feel free to block this using something like noscript :)
- WebRTC datachannel connections on this site don't use just (optionally) OTR. They have DTLS enabled within the browser. OTR just adds an authentication layer that DLTS currently lacks. So that even if the OTR implementation here was completely compromised, the only possible attack would still be a MiTM on the DTLS channel.
- It's open source (https://github.com/erbbysam/webRTCCopy), so it's available to be hosted elsewhere and all of the libraries used could be re-downloaded.
-Sam
You can then use idb.filesystem.js to add api support for firefox etc. Search the file above for "is_chrome" for a few idb.filesystem.js-specific quirks.
Looking at that page, it looks like firefox will ship with support in version 50?