Top all-time · #3472
discrete blogarithm
Personal blog · zyan.scripts.mit.edu/blogsecurityprogramming
discrete blogarithm is a personal blog at zyan.scripts.mit.edu about security and programming. Since 2013, 22 different Hacker News readers have linked it 27 times, most often “Backdooring JavaScript using minifier bugs”. The last post was in 2022, but the archive is still widely read.
Too few sampled comments (11) to say how often HN recommends it.?
Why HN links it
HN readers link this blog for browser privacy and security research: history sniffing via HSTS timing and visited-link styling (Sniffly), and how minified JavaScript can hide backdoors. Also talk slides and related presentations.
Summarised by Claude from a sample of 11 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Most-linked posts?
- Backdooring JavaScript using minifier bugs5 people · 5 mentions · first linked 2015-08-24
- New Tricks for Browser Fingerprinting [pdf]4 people · 4 mentions · first linked 2015-10-26
- Lessons from the ad blocker trenches3 people · 3 mentions · first linked 2015-07-17
- /blog/sniffly/2 people · 2 mentions · first linked 2015-10-28
- Thoughts on Cypherpunks 2.02 people · 2 mentions · first linked 2013-10-13
What Hacker News says?
Do browsers still leak history info (eg http://zyan.scripts.mit.edu/sniffly/ ) is it possible to have a page show visitors if they are likely to be affected?
Comment linking /sniffly/
on “List of Sites Affected by Cloudflare's HTTPS Traffic Leak”Submitted Visiting Chelsea Manning in prison as a story · 344 points
HN discussionIn addition to Egor's stuff, I'd recommend just reading the "Privacy and Security Considerations" sections of various RFC's and W3C specs. Lots of theoretical attacks in there that people simply haven't built demos for! In case anyone's interested, slides are up at https://zyan.scripts.mit.edu/presentations/toorcon2015.pdf and talk recording at https://www.youtube.com/watch?v=kk2GkZv6Wjs
Comment linking /presentations/toorcon2015.pdf
on “Timing attack against HSTS to sniff browser history in Chrome and Firefox”Submitted Timing attack against HSTS to sniff browser history in Chrome and Firefox as a story · 257 points
HN discussionIn any case, I didn't minify or remove comments, so you can just view-source: http://zyan.scripts.mit.edu/sniffly/index.js
Comment linking /sniffly/index.js
on “Timing attack against HSTS to sniff browser history in Chrome and Firefox”Submitted Backdooring JavaScript using minifier bugs as a story · 211 points
HN discussionA slide discussing HSTS+CSP attack (this one) and also HPKP attack: https://zyan.scripts.mit.edu/presentations/toorcon2015.pdf
Comment linking /presentations/toorcon2015.pdf
on “Timing attack against HSTS to sniff browser history in Chrome and Firefox”Submitted New Tricks for Browser Fingerprinting [pdf] as a story · 81 points
HN discussionI went to this talk last night and wrote a blog post in response to it: http://zyan.scripts.mit.edu/blog/thoughts-on-cypherpunks-2-0... The gist of it is that although the Cypherpunks 2.0 movement is doing fantastic pro-privacy work, it will eventually be constrained by the apathy of the average person who uses technology (aka, surveillance victim). I don't know how we can fight this, but we should try.
Comment linking /blog/thoughts-on-cypherpunks-2-0/
on “Cypherpunks 2.0”Submitted RSA conference site sends an ajax request per keystroke when entering password as a story · 11 points
HN discussionThat defends you from a different type of attack. That can't fix bugs in your compiler or minifier. See https://zyan.scripts.mit.edu/blog/backdooring-js/
Comment linking /blog/backdooring-js/
on “Security concerns with minified JavaScript code”Submitted A boring xss dissection as a story · 4 points
HN discussionRead the linked article: https://zyan.scripts.mit.edu/blog/backdooring-js/ It has the answer to your question. Namely, you can write bugs that are exploitable that aren't present in the original source , that only appear in the minified output. Which means that a) it is a whole lot harder for someone to find (especially if it's something that is "obviously" correct), and b) it's plausibly deniable.
Comment linking /blog/backdooring-js/
on “Security concerns with minified JavaScript code”Submitted Happy Birthday Chelsea as a story · 2 points
HN discussionNo, you want the minified source to do something different but predictable so that nobody reading the source could spot the backdoor without knowledge of the bug. Here's an example: https://zyan.scripts.mit.edu/blog/backdooring-js/
Comment linking /blog/backdooring-js/
on “Security concerns with minified JavaScript code”Submitted Lessons from the ad blocker trenches as a story · 2 points
HN discussionAll of the interesting content is in the link provided in the list[1], and otherwise this is just a post about how debian should handle the security issues presented there. This might be a good candidate for having the link updated. [1]: https://zyan.scripts.mit.edu/blog/backdooring-js/
Comment linking /blog/backdooring-js/
on “Security concerns with minified JavaScript code”Submitted Certificate Transparency for PGP? as a story · 2 points
HN discussionThere are a number of ways (some patched) for sites to guess at your browsing history, such as the color of visited links or HSTS cache timing. https://zyan.scripts.mit.edu/blog/sniffly/
Comment linking /blog/sniffly/
on “Non-obvious indicators that a transaction might be fraudulent”Submitted Thoughts on Cypherpunks 2.0 as a story · 2 points
HN discussionSorry to TL;DR but 50 page PDFs can be opaque for discussion. The presentation takes a while to get around to it, but it's a way to see your browser history using cert pinning/redirection. Specifically (ab)using features in the browser that even the paranoid don't disable. And then using that information to fingerprint you. Demo: http://zyan.scripts.mit.edu/sniffly Code: https://github.com/diracdeltas/sniffly It's a…
Comment linking /sniffly
on “New Tricks for Browser Fingerprinting [pdf]”Submitted New Tricks for Browser Fingerprinting [pdf] as a story · 1 points
HN discussionMore Related Resources: GitHub: https://github.com/diracdeltas/sniffly Sniffly: http://zyan.scripts.mit.edu/sniffly/ Blog Post: https://zyan.scripts.mit.edu/blog/sniffly/
Comment linking /blog/sniffly/
on “Unpatched browser weaknesses can be exploited to track millions of Web users”Submitted Lessons from the ad blocker trenches as a story · 1 points
HN discussionSubmitted Lessons from the ad blocker trenches as a story · 1 points
HN discussionSubmitted Tips on Heartbleed recovery (other than "Change your password") as a story · 1 points
HN discussion
