Top all-time · #5512
blog.innerht.ml
Personal blog · blog.innerht.mlsecurityweb
blog.innerht.ml is a personal blog at blog.innerht.ml about security and web. Since 2015, 14 different Hacker News readers have linked it 17 times, most often “Google YOLO clickjacking”. No feed was found, so read it on the site itself.
Too few sampled comments (4) to say how often HN recommends it.?
Why HN links it
HN commenters link this blog for security write-ups: VPN browser extensions leaking IP addresses, public Wi-Fi risks, embedded sign-in widgets, and Google's one-tap login ("YOLO").
Summarised by Claude from a sample of 4 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Most-linked posts?
- Google YOLO clickjacking8 people · 8 mentions · first linked 2018-05-08
- VPN Extensions are not for privacy2 people · 4 mentions · first linked 2018-10-29
What Hacker News says?
VPN browser extensions are merely proxies and most likely will leak you IP/privacy. I've written a blog post on this topic: https://blog.innerht.ml/vpn-extensions-are-not-for-privacy/
Comment linking /vpn-extensions-are-not-for-privacy/
on “Mozilla VPN Completes Independent Security Audit by Cure53”Submitted Google YOLO clickjacking as a story · 1304 points
HN discussiontl:dr; "You would be safe in active war-zone (eg. syria) because you are civillian and do not carry any weapons with you" No, you are not safe at all. Lets assume public wifi requires acceptance of terms and conditions. - Redirects all pages (from your Mac/Ip address) to their server - There is checkbox on the page for ToS/ToC approval and 'Continue' button - Behind the scenes clickjacking/framebusting happens [0] -…
Comment linking /google-yolo/
on “Advice to avoid public Wi-Fi is mostly out of date”Submitted Google YOLO clickjacking (2018) as a story · 142 points
HN discussion(Disclaimer: not a security expert, opinions could be wrong.) > You shouldn't enter your username and password for one website into another. A stronger version of this is you shouldn't embed any kind of authentication/authorization widget of one website into another, even if the widget is supposedly under complete control of the auth provider (i.e. an iframe). For instance, is an embedded SSO widget without password…
Comment linking /google-yolo/
on “Sign in with Matrix”Submitted VPN Extensions are not for privacy as a story · 94 points
HN discussionIt’s insecure too :) https://blog.innerht.ml/google-yolo/
Comment linking /google-yolo/
on “What Do You Think about This Seamless “Registering/Login” User Experience?”Submitted Overflow Trilogy as a story · 7 points
HN discussionSubmitted Clickjacking Google as a story · 5 points
HN discussionSubmitted Google YOLO as a story · 4 points
HN discussionSubmitted The misunderstood X-XSS-Protection as a story · 4 points
HN discussionSubmitted Internet Explorer has a URL problem as a story · 3 points
HN discussionSubmitted Clickjacking Google YOLO as a story · 2 points
HN discussionSubmitted VPN Extensions are not for privacy as a story · 1 points
HN discussionSubmitted VPN Extensions are not for privacy as a story · 1 points
HN discussionSubmitted The misunderstood X-XSS-Protection (2016) as a story · 1 points
HN discussionSubmitted Cross-Origin CSS Attacks Revisited(feat. UTF-16) CVE-2015-1287 and CVE-2015-5826 as a story · 1 points
HN discussion
