Top all-time · #6302
Stack Exchange Security Blog
Company blog · security.blogoverflow.comsecurityprogramming
Stack Exchange Security Blog is the company blog at security.blogoverflow.com, writing about security and programming. Since 2012, 13 different Hacker News readers have linked it 13 times, most often “Debunking SQRL”. The last post was in 2016, but the archive is still widely read.
Too few sampled comments (8) to say how often HN recommends it.?
Why HN links it
HN readers link the Stack Exchange Security Blog, mainly its 2013 post debunking SQRL, a proposed login scheme, as a source on its flaws, and a post on password storage.
Summarised by Claude from a sample of 8 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Most-linked posts?
- Debunking SQRL4 people · 4 mentions · first linked 2014-07-14
- « Stack Exchange Security Blog2 people · 2 mentions · first linked 2012-09-11
What Hacker News says?
SQRL has been debunked. Google quickly returns https://security.blogoverflow.com/2013/10/debunking-sqrl/ but there are plenty other critical reviews.
Comment linking /2013/10/debunking-sqrl/
on “Web Authentication: Proposed API for accessing Public Key Credentials”Submitted « Stack Exchange Security Blog as a story · 45 points
HN discussionI never heard of SQRL specifically before, so I just spent some time researching it. From what I can find, it has some significant flaws[0], and it doesn't seem these can be addressed without defeating the few advantages this SQRL approuch has. [0]: http://security.blogoverflow.com/2013/10/debunking-sqrl/
Comment linking /2013/10/debunking-sqrl/
on “We Got Phished”Submitted Debunking SQRL as a story · 2 points
HN discussionIt won't. See http://security.blogoverflow.com/2013/10/debunking-sqrl/ for a myriad of reasons. I've also come to realize that one should take everything that SG says with a large table spoon of salt.
Comment linking /2013/10/debunking-sqrl/
on “Ask HN: Current Crypto Best Practices”Submitted Attacking RSA through Sound as a story · 2 points
HN discussionSo for this to work, an attacker needs to be a Man In The Middle, and get the attacked client to execute some malicious Javascript, which in turn crafts requests to a target site which uses TLS and SPDY. The MITM intercepts and compares the encrypted and compressed payload for recurring patterns that result when using DEFLATE. By playing with the crafted requests, he can e.g. guess cookie values that were added by t…
Comment linking /2012/09/how-can-you-protect-yourself-from-crime-beasts-successor/
on “Crack in Internet's foundation of trust allows HTTPS session hijacking”Submitted Lessons learned and misconceptions regarding encryption and cryptology as a story · 2 points
HN discussion> For example, conversations which take place over iMessage and FaceTime are protected by end-to-end encryption so no one but the sender and receiver can see or read them. Apple cannot decrypt that data. I don’t know, then, why when I do an iCloud restore on a brand new device, all existing messages are recovered. Is this a way to recover all past messages that’s not really addressed, if I can still recover all hist…
Comment linking /2012/09/qotw-34-imessage-what-security-features-are-present/
on “Apple’s Commitment to Customer Privacy”Submitted About Secure Password Hashing (2013) as a story · 1 points
HN discussionhttp://security.blogoverflow.com/2013/10/debunking-sqrl/ Sqrl looks to have some pretty bad flaws.
Comment linking /2013/10/debunking-sqrl/
on “Beware Keyloggers at Hotel Business Centers”Thanks. https://security.blogoverflow.com/2013/01/a-brief-introducti...
Comment linking /2013/01/a-brief-introduction-to-auditd/
on “Devuan considers machine IDs”The link at the bottom is the Stack Overflow IT security blog, I will drag out some direct quotes to help you to summarize, editing slightly to make it more readable to people not knowledgeable in the industry. The bad thing about such “cleartext” storage of passwords is that it induces a vulnerability [in a certain type of attack] ... where the attacker could get ... access to the server data. If that data includes…
Comment linking /2011/11/why-passwords-should-be-hashed/
on “Ask HN: Official source stating hash DB password requirement?”
