Stefan-H

Not quite - a malicious server would receive the plaintext password in the current status quo.

My coment is not at all talking about what the OP was doing. I think that he went beyond what he ought to have. I am specifically referring to the mentality of "employees should trust their coworkers and can therefore leave their computers unlocked".

This mentality is patently wrong to me. You have to realize that maintenance, house keeping, and any manner of other people may enter your area(either legitimate people, or people in disguise). Additionaly, if I were to "go rogue" you better believe I would take advantage of being able to frame someone else and remove attributation from my shoulders. The in-office risk asside, you are also training terrible habits. These habits could lead to your employees leaving their computers unlocked in coffeee shops, at conferences, in their hotel rooms, etc. You have to instill the habit of if you are leaving your computer, you lock you computer into people and make sure they understand why that is.

The censorship is not happening by the community, it is coming from the admins that are on the reddit payroll. There are some posts that are auto-deleted based off of keywords during some of the more turbulent times in reddit.

Bug bounty programs seem to be more and more necessary for a mature security program. I feel like this can span the gamut from resources for responsible disclosure all the way to robust bug bounty programs that offer pay outs. The barrier to entry for the former should be low and something that every organization with security personnel can arguably support, but once you start doing pay outs, the need to run a tight ship in regards to how bugs are evaluated becomes far greater.

I am a big fan of the Nope that had a kickstarted a little while ago. It is small and still allows your macbook to close: http://erlibird.com/go/nope

I could understand this being a tough position from google's perspective. When talking about how secure something is, one has to consider the threat model - there is not absolute. If the goal is to keep naughty pictures confidential from one's mother - this may indeed be "secure" enough for that situation. Keeping blackmail photos safe from a nation state on the other hand, likely not.

I do not think that we currently have a good way as product creators to specify what secure actually means - and what is more - our customers won't understand the nuance either.

This is in no way trying to excuse passing this "encryption" scheme off as secure.

It is interesting to consider if this was bred from sloppy ethics or ignorance. It would not shock me to find that someone really thought that this is good enough "security".

That being said, those that do not have the skills to realize that this is not sufficient need to reach out to those that do. If you organization does not have security staff, then a contracted audit is necessary. If someone is producing a product and are trying to claim it is secure, ignorance of what secure actually is, is not an excuse.

I actually went the other direction. I have no problem charging my phone every night, and charging a watch at the same time would be a non-issue. Upon hearing that the apple watch will hit a battery life closer to 18 hours rather than the rumored12, I actually cancelled my backing for pebble time in favor of planning to buy the apple watch.

If you live in a state that has concealed-carry laws, then you are likely wrong about your comment that "the only time" you interact with people with guns.

If you are using corporate hardware it should not really be secret that your traffic is being man in the middled, this should be assumed. I think it makes sense for a corporation to be able to whitelist their certificate to make intermediate network devices appear as trusted, because they are. I do agree that having a little asterisk or something for the lock ice to indicate that you are using a certificate that falls outside of the default trust store could be beneficial.

All of the reasons that benefit the company. Data Loss Prevention, web filtering, malware detection, take your pick.

Trustwave is still in the Mozilla CA bundle: https://wiki.mozilla.org/CA:IncludedCAs

At this point I feel like we need to simply remove Chinese root CAs from trust stores and have user's opt-in to allowing certificates issued from china. I realize that any CA can be mismanaged, but the risk of Chinese government hands in things like this seem too high to me.

Edit: I have no delusions that this is not happening in the US, it is simply that as someone in the US, I don't have any options to lop off CAs that the US could influence. I can however make the decision to not trust some foreign CAs entirelly.

Now is the time to ensure you know what your surface area is for OpenSSL. Do you terminate SSL on your hosts? Do you have a loadbalancer that terminates SSL for you? Do you distribute OpenSSL to clients? Do you have network devices that have OpenSSL on them? These things are all important for you to know to be able to handle the response to whatever drops on the 19th correctly. Good luck!

With babies we know the shape. It is not as if we are likely to get a 2d slice of just an arm to estimate the age. With tumors we do not have an idea of the shape, and therefore could accidentally take a slice of the narrowest portion the first time, then the largest portion the second and assume it grew.

So this only applies to those that use doorkeeper to act as oauth providers, not to those that allow logins through other oauth providers, right?

Am I missing something? While there does not seem to be a reason to allow CSRF here, doesn't the fact that you need to have a client Id and client secret for the oath endpoint make it so that this is a non-issue?

https://github.com/doorkeeper-gem/doorkeeper/wiki/authorizat...

I don't see a way to get the access token without having the client ID and client secret.

In events like this it is a good idea to avoid sites that have apparently been compromised in case they start serving up malware.

"only sensitive to gluten in American products" I have a hard time believing that the nationality of the gluten has anything to do with her reactions. Perhaps you are confusing correlation with causation? I think the more likely cause of her reactions is something else in the products in the US that are causing her reactions. An interesting study for you to take a look at as well: http://www.businessinsider.com/gluten-sensitivity-and-study-...

I believe this is because the angle of attack shifts as well. A plane that is generating lift away from the force of gravity, if turned 180 degrees on it's forward facing axis, will generate lift facing towards the force of gravity. The angle of attack needs to change so that the top side (when the plane is upright) of the wing is again at an appropriate angle of attack to generate lift. So the nose ends up pointing more skyward to get the appropriate angle.

The author specifically mentions he is still under his parent's health insurance.