Security Fuckup Megathread - v13.69 - plugins may violate privacy

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > YOSPOS > Security Fuckup Megathread - v13.69 - plugins may violate privacy

«‹›2 »

30 TO 50 FERAL HOG: Mar 2, 2005

# ¿ Jan 5, 2017 17:05

Adbot: ADBOT LOVES YOU

# ¿ May 2, 2024 07:34

30 TO 50 FERAL HOG: Mar 2, 2005

OSI bean dip posted:

https://bugcrowd.com/netgear

ahahahaha

# ¿ Jan 5, 2017 21:50

30 TO 50 FERAL HOG: Mar 2, 2005

Winkle-Daddy posted:

maybe, but you'd have to have your browser set to auto fill that (please don't do this)

safari does this in a good way, it is totally separate than auto filling name/email/whatever and also has Visa/Mastercard/Amex logos in the autofill drop down to make it super obvious that youre about to put your CC in

itll be nice when more people start doing applepay through their site though

# ¿ Jan 5, 2017 22:00

30 TO 50 FERAL HOG: Mar 2, 2005

ate all the Oreos posted:

not anymore

yeah it is just run the installer and itll still activate just fine lmao

# ¿ Jan 6, 2017 15:56

30 TO 50 FERAL HOG: Mar 2, 2005

hackbunny posted:

I wonder if 1password could use a custom keyboard instead of the clipboard, as an interface between password database and applications

or people could just use icloud keychain like a normal person

# ¿ Jan 6, 2017 18:52

30 TO 50 FERAL HOG: Mar 2, 2005

BobHoward posted:

doesn't apple already have some kind of secure clipboard feature for safely holding sensitive data anyways? i could swear I saw something like that in a wwdc video once

yes. apps cant get data out of the clipboard unless they are the app that put it there (or the user long presses and brings up the copy/paste menu and presses paste)

# ¿ Jan 6, 2017 21:15

30 TO 50 FERAL HOG: Mar 2, 2005

My PIN is 4826 posted:

doesn't facebook encourage you to post URLs from your clipboard on your timeline, or was that shut down du to being incredibly creepy?

yeah they cant do this anymore, who knows if it was the reason why the clipboard was locked down but maybe

# ¿ Jan 6, 2017 22:08

30 TO 50 FERAL HOG: Mar 2, 2005

apple tv is the best, but roku is the next best. they have decent apps and things work well but holy poo poo the UI is the most unoptimized laggy low framerate pos ever

# ¿ Jan 10, 2017 17:37

30 TO 50 FERAL HOG: Mar 2, 2005

working in av consulting is cool because i have a list of all professional displays and can pick and choose what features i do want (RCA audio out) and dont want (no smart features but still control over ip) plus get dealer discounts

# ¿ Jan 10, 2017 17:40

30 TO 50 FERAL HOG: Mar 2, 2005

im sorry i refuse to believe anything but it being piped to an old line printer and lowtax sitting next to it with a dialup credit card machine furiously typing numbers in

# ¿ Jan 10, 2017 23:48

30 TO 50 FERAL HOG: Mar 2, 2005

just use paypal

# ¿ Jan 10, 2017 23:53

30 TO 50 FERAL HOG: Mar 2, 2005

DuckConference posted:

SA got banned from paypal a long time ago, the bittorrent forums or chargebacks or the katrina donation drive or something I don't really remember anymore.

# ¿ Jan 11, 2017 06:09

30 TO 50 FERAL HOG: Mar 2, 2005

Shinku ABOOKEN posted:

how much disk quota do your employees have on the file server?

e: not defending saving files locally btw

the last time i dealt with this was in like 2004, how exactly are roaming profiles handled now that everything is a laptop on the road or in a home office over vpn

# ¿ Jan 11, 2017 17:06

30 TO 50 FERAL HOG: Mar 2, 2005

eBay still lets you embed flash content into your listings apparently, so how about some auto downloading malware that makes it look like the official apple website

http://www.ebay.com/itm/350983607686?_trksid=p2060353.m2749.l2649&ssPageName=STRK%3AMEBIDX%3AIT

# ¿ Jan 18, 2017 23:25

30 TO 50 FERAL HOG: Mar 2, 2005

Jewel posted:

everyone's downloading "Meitu" today, the new craze hit which is a photo app that makes you look like an anime, there's tons of news articles about it and stuff already because of how fast it took off

sadly, uh, the permissions are Not Good

and it sends your IMEI data to china https://twitter.com/FourOctets/status/821987185188478977

aaaand more https://twitter.com/rekrom12/status/822134887226425344

anroid

# ¿ Jan 19, 2017 23:13

30 TO 50 FERAL HOG: Mar 2, 2005

OSI bean dip posted:

https://twitter.com/stevebiddle/status/822190488505589760

lol

# ¿ Jan 20, 2017 02:50

30 TO 50 FERAL HOG: Mar 2, 2005

lol hosting an entire country's worth of people on ms azure ad what would that cost like $1 bil/mo?

# ¿ Jan 23, 2017 16:53

30 TO 50 FERAL HOG: Mar 2, 2005

Subjunctive posted:

https://www.extremetech.com/internet/243202-symantec-caught-improperly-issuing-illegitimate-https-certificates

maybe its time to untrust symantec root?

lol what would that break, like 50% of the internet?

# ¿ Jan 23, 2017 19:46

30 TO 50 FERAL HOG: Mar 2, 2005

flosofl posted:

Most infosec breach legislation as it impacts customers is on the state level IIRC. I imagine (hope) states are going initiate investigations in the wake of the federal investigation

Hahahahahahahahahahahahahahahahahahahahahahahahahahahaha

# ¿ Jan 25, 2017 16:02

30 TO 50 FERAL HOG: Mar 2, 2005

infernal machines posted:

CPB has been detaining foreign nationals at the border and demanding passwords to the social media accounts, among other things

depending on your level of cooperation and melanin, you may be rejected at the border, which is bad if you happen to conduct business in the us of a

loving good. Let international companies straight up abandon the USA. Cob is a straight up white supremacist org and the sooner people learn about it the better

# ¿ Feb 12, 2017 08:43

30 TO 50 FERAL HOG: Mar 2, 2005

Bhodi posted:

imo the weakest part of AD is how easy it lets you shoot yourself in the security foot, like for example making domain-wide admin service accounts that have access to everything, never expire, and never require password changes

there's no fixing stupid, but you could at least give a warning / confirmation popup

to be fair, MSAs didn't exist until like 2012

# ¿ Feb 12, 2017 17:48

30 TO 50 FERAL HOG: Mar 2, 2005

lomarf

code:

/* generated code */
if ( ++p == pe )
    goto _test_eof;

# ¿ Feb 24, 2017 16:00

30 TO 50 FERAL HOG: Mar 2, 2005

just use icloud keychain

# ¿ Feb 24, 2017 16:21

30 TO 50 FERAL HOG: Mar 2, 2005

sharepoint 2016 ladies and gents

# ¿ Mar 17, 2017 19:08

30 TO 50 FERAL HOG: Mar 2, 2005

just use icloud keychain

# ¿ Mar 21, 2017 18:48

30 TO 50 FERAL HOG: Mar 2, 2005

that was an excellent talk

# ¿ Mar 23, 2017 17:32

30 TO 50 FERAL HOG: Mar 2, 2005

CRIP EATIN BREAD posted:

SSL certs are such a loving racket.

on the other hand, if i really thought I needed to shell out $2k for a SSL cert from some company and then find out it's losing its trust i'd flip my poo poo.

we almost bought a cert from startcom and then went with a comodo reseller. it would have only been $350 or so, but still

# ¿ Mar 23, 2017 17:55

30 TO 50 FERAL HOG: Mar 2, 2005

CrazyLittle posted:

there's always starfield too

never heard of them, $8 a year is crazy. im using LE for my home certs but if i wasnt....

# ¿ Mar 23, 2017 18:24

30 TO 50 FERAL HOG: Mar 2, 2005

apseudonym posted:

There's no indication users actually care

this is a user problem, EV is good idea because people trust the green padlock and if they see the padlock on paypa1.com they think they are okay

# ¿ Mar 23, 2017 18:26

30 TO 50 FERAL HOG: Mar 2, 2005

lmbo

https://twitter.com/malwrhunterteam/status/850239122950168576

read the thread, the creator of the malware replies

# ¿ Apr 7, 2017 15:55

30 TO 50 FERAL HOG: Mar 2, 2005

Wiggly Wayne DDS posted:

and symantec's threw up responses on their misissuances:
Symantec Response B

Symantec Response D

Symantec Response E

Symantec Response F

Symantec Response H

Symantec Response J

Symantec Response L

Symantec Response N

Symantec Response P

Symantec Response Q

Symantec Response R

Symantec Response T

Symantec Response V

Symantec Response X

horry poo poo

# ¿ Apr 10, 2017 16:38

30 TO 50 FERAL HOG: Mar 2, 2005

this is a real product? it feels like a tim and eric skit

"here use this oven. its like a regular oven but its huge an ugly and costs 10 times as much in utilities"

# ¿ Apr 14, 2017 04:38

30 TO 50 FERAL HOG: Mar 2, 2005

Jewel posted:

I, uh, uh oh?

https://twitter.com/hackerfantastic/status/852926927514083328

https://twitter.com/Snowden/status/852949485726699520

just server 2008 though, so basically anyone who gets hit by this deserves it

# ¿ Apr 14, 2017 19:46

30 TO 50 FERAL HOG: Mar 2, 2005

Shaggar posted:

also what would be the point of fingerprinting the hardware? So you can try to determine if a user wipes their device and the installs your app under a new user account?

yeah, they would make a new uber account using a free signup code and get 5 free rides or whatever then repeat this over and over to get paid out from uber without putting any money in

# ¿ Apr 24, 2017 21:00

30 TO 50 FERAL HOG: Mar 2, 2005

Chris Knight posted:

oh iframes: https://www.brokenbrowser.com/sop-bypass-uxss-tweeting-like-charles-darwin/

websites opening blank iframes for whatever reason, and they can be exploited

microsoft, bad at security? inconceivable

# ¿ Apr 25, 2017 15:31

30 TO 50 FERAL HOG: Mar 2, 2005

i just use iis crypto

https://www.nartac.com/Products/IISCrypto

# ¿ Apr 25, 2017 19:31

30 TO 50 FERAL HOG: Mar 2, 2005

heres a good one, i was debugging an internal app and noticed weird network behavior for remote users. anyways after doing some research i have found that our ASAs are running 7.2

:discourse:

# ¿ Apr 25, 2017 19:36

30 TO 50 FERAL HOG: Mar 2, 2005

anthonypants posted:

our asas are on 9.something and it was decided to put off patching them while we waiting for rmas to go through

speaking of which has anyone gotten replacement hardware affected by that c2000 hardware bug

we're dropping cisco anyways but jesus christ theres like 5+ 10 score CVEs these are vulnerable to and we have almost 40

# ¿ Apr 25, 2017 19:43

30 TO 50 FERAL HOG: Mar 2, 2005

infernal machines posted:

mainframe of theseus

nice

# ¿ Apr 26, 2017 17:02

Adbot: ADBOT LOVES YOU

# ¿ May 2, 2024 07:34

30 TO 50 FERAL HOG: Mar 2, 2005

spankmeister posted:

Here's some more snake oil bullshit getting brutally owned:

https://scotthelme.co.uk/nomx-the-worlds-most-secure-communications-protocol/

im the hot glue holding the LEDs

# ¿ Apr 27, 2017 20:12

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > YOSPOS > Security Fuckup Megathread - v13.69 - plugins may violate privacy

«‹›2 »