InformAction Forums

this is a browser capture method, and may trap you at the site if you dont have NoScrpipt active. "I don’t want to keep you any longer. If you’re still stuck here, one way to get out is to go to the Hacker News discussion and upvote this article." "In Chrome for mobile, when the user scrolls down, t...

Duck Duck doesnt fare so well...

https://whotracks.me/blog/adblockers_pe ... study.html

"That all popular content-blockers are very efficient, having sub-millisecond median decision time per request"

"This column uses experiments with pricing algorithms powered by AI in a controlled environment to demonstrate that even relatively simple algorithms systematically learn to play sophisticated collusive strategies. Most worrying is that they learn to collude by trial and error, with no prior knowled...

Learn where the redirects go... http://redirectdetective.com/ Redirect Detective is a free redirect checker that allows you to see the complete path a redirected URL goes through. "Some of the many uses for Redirect Detective are: See where an affiliate link goes to and what affiliate network is bei...

Reverse engineering of a Huawei P20 from China

https://twitter.com/fs0c131y/status/1051568180748013569

In this request, the phone is sending - your country - your province - your city - phone locale - the website you requested

"due to Chrome’s new user-unfriendly forced login policy — I won’t be using it going forward." https://blog.cryptographyengineering.com/2018/09/23/why-im-leaving-chrome/ "ungoogled-chromium is a set of configuration flags, patches, and custom scripts. These components altogether strive to accomplish...

"But this time I had to go further and open the “Debug add-ons” page, and there I saw two add-ons not listed anywhere else — fxmonitor@mozilla.org.xpi and telemetry-coverage-bug1487578@mozilla.org. https://medium.com/@neothefox/firefox-installs-add-ons-into-your-browser-without-consent-again-d3e2c8e...

nice and simple article

https://prdeving.wordpress.com/2018/09/ ... injection/

Is serverless insecure? Let's find out.. "This is a simple AWS lambda function that does a straight exec. Essentially giving you a shell directly in my AWS infrastructure to just run your commands. A security teams worst nightmare. Do whatever you want. Ultimate goal: take over the account, escalate...

CSS exfil this didn't come up in search, so will post https://www.mike-gualtieri.com/posts/stealing-data-with-css-attack-and-defense "By utilizing CSS alone, browser protections like NoScript can't block the egress of data (although NoScript's XSS auditor is more effective than Chrome at blocking so...

In the following, I will outline two bugs that affect 7-Zip before version 18.00 as well as p7zip. The first one (RAR PPMd) is the more critical and the more involved one. The second one (ZIP Shrink) seems to be less critical, but also much easier to understand. https://landave.io/2018/01/7-zip-mult...

ugh, you guys were right.

Here is a DNS lookup over HTTPS that may help

https://github.com/curl/curl/wiki/DNS-over-HTTPS

Do DNS resolves over HTTPS for privacy, performance and security. Also makes it easier to use a name server of your choice instead of the one configured for your system.

live talks on crypto implemention in streaming and cloud Real World Crypto 2018 Real World Crypto Symposium aims to bring together cryptography researchers with developers implementing cryptography in real-world systems. The conference goal is to strengthen the dialogue between these two communities...

pretty good list here for configs

Firefox telemetry and spy removal

https://gist.github.com/MrYar/751e0e5f3 ... c8aa237b72

What Spectre and Meltdown Mean For WebKit https://webkit.org/blog/8048/what-spectre-and-meltdown-mean-for-webkit/ "WebKit relies on branch instructions to enforce what untrusted JavaScript and WebAssembly code can do. Spectre means that an attacker can control branches, so branches alone are no long...