bobedybobbob

I was under the impression Google (or Google Ventures) owned part of Uber - surely this will make things complicated?

Is that global or just the employees in California?

I'm all for the Non-Proliferation of Nuclear Weapons but also find it amazing what their scientists can do working with such limited resources.

Phishing is generally 1. run a command or 2. give me your credentials. To prevent these you need good solid technical controls like U2F for password based authentication (which is origin bound). Similarly binary whitelisting will prevent most users from running rogue executables.

With time, creativity and motivation a good offensive security team will always win. All we can do as defenders is to find ways to raise the cost of such an attack.

A bit disappointed they seem to have started on the internal network rather then coming in from the outside :)

It'd be nice to see support for U2F

Nearly all door controllers are broken. I hope someone comes out with a secure alternative soon but fear that the cost of installation that comes with these devices will prevent many people from upgrading.

Do we really need CVE numbers assigned for all of these? More or less every application out there is vulnerable to some form of timing attack

The core issue is the same that leads to cross domain search timing attacks [1] (which can be prevented with CSRF tokens)

With timing HTTP->HTTPS redirections maybe the issue is not that the response can be timed but that HTTP exists in the first place? There are other similar timing attacks that can easily be used to identify if a user is logged in to a specific website [2].

[1] https://news.ycombinator.com/item?id=10211306 [2] http://crypto.stanford.edu/~dabo/papers/webtiming.pdf