I couldn't find a link to the ballot initiative itself anywhere on the campaign's website, but this appears to be it: https://sosmt.gov/wp-admin/admin-ajax.php?juwpfisadmin=false... Linked from here if the above URL…
I found a couple of fun tricks you can do with this (for some definition of "fun" anyway). Go's http.Redirect function allows non-3xx statuses, and also renders a trivial page with a status message and link:…
There are a couple of differences: 1. While a password manager should associate a TOTP seed with a domain and only fill codes on that domain, the codes are still visible to you. A convincing phishing attack might trick…
> Sex workers, who have long been censored by moderation systems, refer to themselves on TikTok as “accountants” https://www.washingtonpost.com/technology/2022/04/08/algospe...
Minecraft authentication requires a Microsoft account. People may not want to have one for ideological reasons, or not want to attach a game to the account they use for other purposes. Also, not encouraging it, but…
It's a neat idea, but I hope nobody uses it for anything actually sensitive until the crypto is fixed: The app uses counter mode encryption with no nonce. In counter mode, the encryption process uses a stream of…
I couldn't find a link to the ballot initiative itself anywhere on the campaign's website, but this appears to be it: https://sosmt.gov/wp-admin/admin-ajax.php?juwpfisadmin=false... Linked from here if the above URL…
I found a couple of fun tricks you can do with this (for some definition of "fun" anyway). Go's http.Redirect function allows non-3xx statuses, and also renders a trivial page with a status message and link:…
There are a couple of differences: 1. While a password manager should associate a TOTP seed with a domain and only fill codes on that domain, the codes are still visible to you. A convincing phishing attack might trick…
> Sex workers, who have long been censored by moderation systems, refer to themselves on TikTok as “accountants” https://www.washingtonpost.com/technology/2022/04/08/algospe...
Minecraft authentication requires a Microsoft account. People may not want to have one for ideological reasons, or not want to attach a game to the account they use for other purposes. Also, not encouraging it, but…
It's a neat idea, but I hope nobody uses it for anything actually sensitive until the crypto is fixed: The app uses counter mode encryption with no nonce. In counter mode, the encryption process uses a stream of…