1,249 results for Token · 2.820s

News for “Token”
19 results • 2815 ms server time
Moozonian News
bing.com• Oct 20, 2024• 1 min read
Internet Archive breached again through stolen access tokensThe Internet Archive was breached again, this time on their Zendesk email support platform after repeated warnings that threat actors stole exposed GitLab authentication tokens. Since last night, ...
Moozonian News
news.ycombinator.com• Aug 8, 2022• 1 min read
Is-it-even-legal startup culture by LATOKEN CEOThis story is widely discussed in the Russian-speaking tech community over the past few days.It started with a video of LATOKEN zoom meetings where the CEO is shouting, cursing at and publicly humiliating company employees [1]. The video is mostly in Russian but auto-subtitles in English provide a good representation with all expletives replaced with "[__]".The video also alleges that the CEO takes away employee stock options for things like missing meetings or deadlines and provides a screenshot from company Slack for proof, because allegedly all of this is done in public.In the last day or two CEO wrote public posts to defend his approach. Here is a translation of the beginning of one of the posts [2]:BE PARANOIC - YOUR BUSINESS IS STEALING RIGHT NOW ON ZOOM Or how to survive in crypto and create a scalable product with an effective team of 100-300 people remotely?Upd. The video can be compared to a torture tape from someone's bedroom. Well, ok, this is "bdsm" with the rules that eve
Advertisement
Moozonian News
news.ycombinator.com• Aug 28, 2020• 1 min read
Launch HN: SuperTokens (YC S20) – Securely manage session tokensHi everyone! My name is Advait and I co-founded SuperTokens along with @rishabhpoddar (https://supertokens.io/). SuperTokens helps companies securely manage their session tokens, saving developer time and preventing identity theft.We started SuperTokens 1.5 years ago when we were building a consumer app and wanted our users to be logged in for a long time in a secure way. When it came to managing user sessions, there was a lot of ambiguity. We read many forums (Reddit, Stackoverflow) and blogs, and found that developers were arguing about best practices, such as using local storage vs cookies, implementing JWTs, etc. We had to do a lot of the first principles thinking ourselves to understand the tradeoffs. Around the same time, Facebook, Docker, Gitlab, Youtube, Uber were in the news for session vulnerabilities.Stealing a user’s session allows you to access their account as if you had their username and password. Hence being able to mitigate against this is important. We’ve audited com
Moozonian News
news.ycombinator.com• Sep 11, 2018• 1 min read
Show HN: Tok'n'talk – Conversations using your ERC20/ERC71 tokensHi, we've created an app https://tokntalk.club/ to experiment with using tokens ERC20 and ERC721 in slightly different way than monetary use cases you're familiar with.ERC20 - They are treated as memberships in 'token clubs'. If you have given ERC20 token you can write messages in its dedicated club. eg. Maker MRK club https://tokntalk.club/clubs/MKR or in Berlin Coin BRLN club https://tokntalk.club/clubs/ethereum:0x80046305aaab08f6033b5...ERC721 - Those tokens can be used as avatars. To give you ability to change 'personalities', create their history and grow them as recognizable characters. We are supporting ~40 different kinds of ERC721s and we're always looking to integrate new ones.Now, you might be asking: Why?The reason is simple. We believe that this is the only way for blockchain community to go forward. Communication based on signed messages is crucial for progress but it's not enough. We need filters rooted in the very base of our beliefs. Filters that will help guard our at
Moozonian News
news.ycombinator.com• Nov 13, 2017• 1 min read
Can “Cookie to header token” CSRF prevention be beaten with permissive CORS?The CSRF Wikipedia article https://en.wikipedia.org/wiki/Cross-site_request_forgery#Cookie-to-header_token describes Cookie-to-header_token as sending a CSRF token to users in a cookie, and then using JavaScript to read the cookie and set it as a custom header (I think a post param would work too) when making ajax calls. It also adds:The protection provided by this technique can be thwarted if the target website disables its same-origin policy using one of the following techniques: Permissive Access-Control-Allow-Origin Cross-origin resource sharing header (with asterisk argument)The article https://en.wikipedia.org/wiki/Same-origin_policy#Security_Applications also says:The user visiting the malicious site would expect that the site he or she is visiting has no access to the banking session cookie. While it is true that the JavaScript has no direct access to the banking session cookie, it could still send and receive requests to the banking site with the banking site's session cookie.
Advertisement
Advertisement