Top all-time · #6654
E
Personal blog · ejj.io · on HN as steakejjssecurityweb
E is a personal blog at ejj.io about security and web. Since 2014, 12 different Hacker News readers have linked it 25 times, most often “Keybase.io Vulnerability (2014)”. No feed was found, so read it on the site itself.
Too few sampled comments (5) to say how often HN recommends it.?
Why HN links it
Personal security blog linked for write-ups on the Capital One breach (SSRF and EC2 metadata access), a Keybase vulnerability and an Android bug. Commenters cite it as a source for those incidents.
Summarised by Claude from a sample of 5 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Most-linked posts?
- Keybase.io Vulnerability (2014)3 people · 3 mentions · first linked 2014-03-28
- Preventing the Capital One Breach3 people · 3 mentions · first linked 2019-07-31
- Fixing the Capital One Breach2 people · 2 mentions · first linked 2019-11-25
What Hacker News says?
Downloaded it. Hopefully being a new browser it might be minimal on power gobbling? Interesting to note. I downloaded it and checked it for SRI, sub-resource integrity, and it isn't supported. I used my tester https://ejj.io/sri . It's interesting because no mobile browsers support it yet.. Mobile browsers drag far behind their desktop friends when it comes to security features.
Comment linking /sri
on “Firefox for iOS now available”Submitted Abusing Your Browser: Infinitely Large Favicons as a story · 92 points
HN discussionClickable: http://ejj.io/SOP.php
Comment linking /SOP.php
on “Major Android Bug Is a Privacy Disaster (CVE-2014-6041)”Submitted Keybase.io Vulnerability (2014) as a story · 48 points
HN discussionMight have been an SSRF exploit if the WAF was accepting parameter values that were then used to expose IAM credentials via the EC2 metadata service. See https://ejj.io/blog/capital-one for a good write-up.
Comment linking /blog/capital-one
on “Capital One Says Breach Hit 100M Individuals in U.S”Submitted The Web Is Dangerous: Phishing and Browser Extensions as a story · 25 points
HN discussionThere was a keybase security vulnerability reported last week as well. I'm not sure if it is 100% relevant because it had nothing to do with js crypto, but it could have allowed someone to impersonate 'liz' as 'iiz' github report: https://github.com/keybase/keybase-issues/issues/397 blog: http://ejj.io/keybase-io-vulnerability/
Comment linking /keybase-io-vulnerability/
on “Refusing to verify myself: I am liz on Keybase.io”Submitted Breaking Same Origin Policy (for the alexa top 1m) as a story · 13 points
HN discussionBy the way. I have an SRI tester to determine if your browser supports SRI. It's still very new and doesn't have a lot of support https://ejj.io/sri/
Comment linking /sri/
on “Subresource Integrity”Submitted Misconfigured CORS, Stealing User Data from the Alexa 1m as a story · 9 points
HN discussion> AKA: Capital One left customer data in a publically available s3 bucket That’s not what happened, that’s uninformed forums speculation that you’ve seen repeated often enough you assume it’s true. Krebs and one of Cloudflare’s PMs have both gone into some depth about this - it involved an SSRF attack against a non-public S3 bucket among other things. Krebs’ article is particularly interesting as it has screenshots…
Comment linking /blog/capital-one
on “Paige Thompson convicted over data theft from AWS user accounts”Submitted Misconfigured CORS, Stealing User Data From The Alexa 1m as a story · 8 points
HN discussionThere's an update blog post on this from Cloudflare's product security manager: https://ejj.io/blog/fixing-capital-one The linked Wyden letter makes for interesting reading too: > "While it is likely that Amazon has known that its AWS product was vulnerable to SSRF attacks since the first high-profile demonstration by a security researcher in 2014, the company has certainly known since mid-2018 at the latest. In Aug…
Comment linking /blog/fixing-capital-one
on “Paige Thompson convicted over data theft from AWS user accounts”Submitted Handling Go: Authentication The Right Way as a story · 6 points
HN discussionI'm an appsec person and security person. I'm surprised about the hundreds of people talking about CSP, HSTS, HPKP and it feels like I'm the only one talking about insecurity headers. Within the Alexa Top 1MM I discovered about ~1000 sites that had turned SAMEORIGIN policy off with their CORS configs [ https://ejj.io/cost-of-security-headers/ ] (including Atlassian/Bitbucket, Zulily, and several other big ones). I a…
Comment linking /cost-of-security-headers/
on “Analysis of the Alexa Top 1M sites”Submitted Breaking SameOrigin Policy due to server misconfigurations as a story · 5 points
HN discussionTo be fair SRI is brand new and doesn't exist yet in most browsers (just went live in chrome in the last..month?). It isn't realistic to expect most people to already be using it.. You can check a particular browser for SRI support using https://ejj.io/sri/
Comment linking /sri/
on “What Experts Love and Hate About CDNs”Submitted Preventing the Capital One Breach as a story · 3 points
HN discussionI've got a lot of practice breaking things. CSRF can be identified really fast by checking for unique tokens. Some unguessable token should be submitted with each state changing request. If not, attackers can steal authenticated accounts by making a request to the "change PW" or "change email" URLs. It's a little confusing at first. XSS I just set JavaScript as something that shows up in a field on a different page.…
Comment linking /csrf-password-bruteforce/
on “Show HN: DeathSwitch”Submitted Stealing User Data From The Alexa 1m as a story · 3 points
HN discussionSubmitted CrashSafari.com Analysis as a story · 3 points
HN discussionSubmitted Fixing the Capital One Breach as a story · 2 points
HN discussionSubmitted The Cost of Security Headers as a story · 2 points
HN discussionSubmitted Misconfigured CORS, Stealing User Data from the Alexa 1M as a story · 1 points
HN discussionSubmitted How a simple font choice can effect site security problems for users as a story · 1 points
HN discussion