[-] 0v0@sopuli.xyz 16 points 2 months ago

It's used to check for website breaches. From How to stop Firefox from making automatic connections:

Firefox Monitor warns you if your online accounts were involved in a known data breach. For more information, see Firefox Password Manager - Alerts for breached websites.

To get the latest login breach information and more, Firefox connects to firefox.settings.services.mozilla.com

To disable, see here.

[-] 0v0@sopuli.xyz 25 points 4 months ago

The attack worked, the password is cmF0dGEK.

This was obtained by generating 32 possible plaintexts for the first 10 bytes of system.zip (based on the different values in the headers of ~300 zip files on my system), plus three null bytes for the high bytes of compressed size, file name length and extra field length.

[-] 0v0@sopuli.xyz 21 points 4 months ago

The inner zip files are just stored, uncompressed:

Archive: update.zip
Index Encryption Compression CRC32    Uncompressed  Packed size Name
----- ---------- ----------- -------- ------------ ------------ ----------------
    0 ZipCrypto  Store       d1bca061     65761967     65761979 system_lib.zip
    1 ZipCrypto  Deflate     64a3f383         2183          741 config.json
    2 ZipCrypto  Store       3731280f     89300292     89300304 app.zip
    3 ZipCrypto  Store       a2bd64f5    135518964    135518976 app_lib.zip
    4 ZipCrypto  Store       700eb186      5996410      5996422 system.zip

So 12 bytes from the original content.

[-] 0v0@sopuli.xyz 63 points 4 months ago

The entries in update.zip are encrypted using the weak ZipCrypto scheme, which is known to be seriously flawed. If you feel motivated, and can guess at least 12 bytes of plaintext for an entry, it is possible to recover the internal state of the generator, which is enough to decipher the data entirely, as well as other entries which were encrypted with the same password. The bkcrack project implements this attack.

Since some of the entries are zip files themselves, it is within the realm of possibility to guess 12 bytes of plaintext. Parts of the zip local file header are pretty static, and you can use some of the values from the local file header of update.zip itself. Still, this would require a bit of luck / inspired guesswork.

[-] 0v0@sopuli.xyz 18 points 6 months ago

singlelogin.re still worked for me recently.

Source

[-] 0v0@sopuli.xyz 12 points 1 year ago

Yes, for example, syncing on a kernel panic could lead to data corruption (which is why we don't do that). For the same reason REISUB is not recommended anymore: The default advice for a locked-up system should be SysRq B.

[-] 0v0@sopuli.xyz 41 points 2 years ago

https://stackoverflow.com/questions/10602504/how-does-user-js-work-in-firefox-in-detail:

It just looks like a JavaScript file. Once upon a time in Netscape 3 and maybe 4 it actually was, but now it's just a file with a .js extension and a very restricted syntax that's parsed by a separate (non-JS) parser and not executed in any way.

63
submitted 2 years ago* (last edited 2 years ago) by 0v0@sopuli.xyz to c/anarchychess@sopuli.xyz

This is a favourite of mine. White to move. rnbqk1nr/pp1pppbp/6p1/2pt5/3PP3/5N2/PPP2PPP/RNBQKB1R w KQkq - 1 4

(Original posted to !chess@lemmy.ml)

[-] 0v0@sopuli.xyz 36 points 2 years ago

Quad9, a Swiss public benefit, not-for-profit foundation. Main address is 9.9.9.9.

[-] 0v0@sopuli.xyz 13 points 2 years ago

You should not torrent over the tor network, but you can torrent over the I2P network. qBittorrent even has experimental I2P support built in.

[-] 0v0@sopuli.xyz 12 points 2 years ago

Indeed. This works because direct connections to the tor network are easily censored, but WebRTC is not (not without a lot of collateral damage at least).

[-] 0v0@sopuli.xyz 69 points 2 years ago

The snowflake proxy acts as a bridge to the tor network at the entry side. If by repercussions you mean risk of exit-node traffic, there are none. It might cost a little bit of bandwidth.

[-] 0v0@sopuli.xyz 96 points 2 years ago

Memory safety would be the main advantage.

view more: next ›

0v0

joined 2 years ago