moloch
Joined 15 years ago
Karma
289
Submissions
72
Member since
Dec 16
[ my public key: https://keybase.io/moloch; my proof: https://keybase.io/moloch/sigs/fTjH7v0drtEtO5GkBwQk1HrndrW69IOMtmaXzdJ8Y0o ]
View on Hacker NewsRecent submissions
Comment · 2 years ago
Say they introduce a bug, that deletes every file on your machine.
Comment · 4 years ago
No, they don't have access to the Wireguard keys and everything is point-to-point. They'd have to push a backdoored software update to gain access (and this is a threat with any vendor product).
Comment · 4 years ago
Yeap, I think the Xbox 360 was the first (or one of the first) to implement this protection back in 2005 - https://www.youtube.com/watch?v=uxjpmc8ZIxM
Comment · 4 years ago
No, unless combined with WebUSB trickery, and such an attack has been possible in the past. However, browsers currently implement blocklists of HIDs and other USB types from working with WebUSB.
Comment · 6 years ago
Python has had named arguments for a long time (since v1.4), which is arguably more widespread than PHP or Swift.
Comment · 6 years ago
None of your cited examples are "secure," they're the very definition of "security by obscurity," which is to say insecure.
Comment · 6 years ago
If anyone is interested in Electron application security, I wrote a guide that explains the methodology behind some of the choices the author here has taken and even goes a bit further in a variety of areas: https://know.bishopfox.com/research/reasonably-secure-electr...
Comment · 7 years ago
I've used nsshell to great effect on multiple projects, highly recommend it (but an encrypted option would be great rook). I've also written a more heavy handed asymmetrically encrypted DNS C2 https://github.com/BishopFox/sliver
Comment · 7 years ago
Always hack with a safety shell!
Comment · 7 years ago
The conference did _not_ accept the talk, they paid the conference so that they could give the talk.
Comment · 7 years ago
Using 2Mb with MSVC instead of 1Kb with MASM. Such a wasteful world.
Comment · 7 years ago
I think their main mistake was requiring a user to change their password to upgrade the hash instead of upgrading the hash on the next user login.