Top all-time · #7756
Michele Spagnuolo
Personal blog · miki.it/blogsecurityprogramming
Michele Spagnuolo writes Miki's Blog, a personal blog at miki.it about security and programming. Since 2013, 10 different Hacker News readers have linked it 17 times, most often “The power of DNS rebinding: stealing WiFi passwords with a website”. The last post was in 2015, but the archive is still widely read.
Too few sampled comments (5) to say how often HN recommends it.?
Why HN links it
HN readers link Michele Spagnuolo's security posts, such as the Rosetta Flash JSONP abuse writeup and DNS rebinding, as technical references. One commenter calls the JSONP source interesting.
Summarised by Claude from a sample of 5 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Michele Spagnuolo, Staff Information Security Engineer at Google.
Most-linked posts?
- The power of DNS rebinding: stealing WiFi passwords with a website3 people · 3 mentions · first linked 2015-04-20
- BitIodine: Extracting Intelligence from the Bitcoin Network3 people · 3 mentions · first linked 2013-12-13
- Abusing JSONP with Rosetta Flash2 people · 2 mentions · first linked 2014-07-08
- /blog/2014/7/8/abusing-jsonp-with-rosetta-flash/2 people · 2 mentions · first linked 2015-06-15
What Hacker News says?
Please consider corresponding with the author of the Github repo to see if they can figure out why that address was included in the list. Based on the page for that tool ( http://miki.it/articles/papers/#bitiodine ), it looks like they would be interested to know of the failure.
Comment linking /articles/papers/
on “Snapchat Phone Number Database Leaked”Submitted XSS in Google Finance as a story · 110 points
HN discussionSome notes: 1) Never blacklist. Seriously, unless you are in the business of writing and securing browser parsers, you are never going to catch everything. There are many vectors not listed on OWASP's XSS Filter Evasion Cheat Sheet. See https://www.w3.org/TR/html5/scripting-1.html#restrictions-fo... for an idea of what you're up against. Because of the incredible number of ways you can cause security vulnerabilities…
Comment linking /blog/2014/7/8/abusing-jsonp-with-rosetta-flash/
on “The Basics of Web Application Security”Submitted Abusing JSONP with Rosetta Flash as a story · 77 points
HN discussionIt makes DNS rebinding attacks simpler, for example: https://miki.it/blog/2015/4/20/the-power-of-dns-rebinding-st...
Comment linking /blog/2015/4/20/the-power-of-dns-rebinding-stealing-wifi-passwords-with-a-website/
on ““We are considering adding an extension to restrict the use of WebRTC””Submitted Put.io API design issues as a story · 66 points
HN discussionI'm going to assume that the "JSONP vulnerability" is actually Rosetta Flash: https://miki.it/blog/2014/7/8/abusing-jsonp-with-rosetta-fla...
Comment linking /blog/2014/7/8/abusing-jsonp-with-rosetta-flash/
on “Chinese Hackers Circumvent Popular Web Privacy Tools”Submitted Mailbox.app Javascript execution as a story · 9 points
HN discussionThis writeup is poorly done, hard to follow, and ad-infested. The source ( http://miki.it/blog/2014/7/8/abusing-jsonp-with-rosetta-flas... ) is actually interesting though.
Comment linking /blog/2014/7/8/abusing-jsonp-with-rosetta-flash/
on “An Adobe Flash Exploit Leveraging JSONP Callback”Submitted The power of DNS rebinding: stealing WiFi passwords with a website as a story · 8 points
HN discussionSubmitted It’s just a game: a handful of scenarios in the Bitcoin world as a story · 3 points
HN discussionSubmitted Adobe fixed Rosetta Flash today as a story · 3 points
HN discussionSubmitted XSRF and Cookie manipulation on Google.com as a story · 3 points
HN discussionSubmitted The power of DNS rebinding: stealing WiFi passwords with a website (2015) as a story · 2 points
HN discussionSubmitted BitIodine: Extracting Intelligence from the Bitcoin Network as a story · 1 points
HN discussionSubmitted XSS in Zagat, exploiting a XOR-based obfuscation algorithm as a story · 1 points
HN discussionSubmitted BitIodine: Extracting Intelligence from the Bitcoin Network as a story · 1 points
HN discussion
