Readit News logoReadit News
hackideiomat commented on Domain Spoofing Vuln in Status Android Wallet   github.com/status-im/stat... · Posted by u/hackideiomat
hackideiomat · 2 years ago
This android wallet has an internal browser and it incorrectly strips www. from hosts. This also affects their permission system, meaning this is the perfect bug to phish users.

They didn't answer multiple mails in 30 days, so it's being disclosed.

hackideiomat commented on Kagi Changelog 2/13: Faster and more accurate instant answers and Wikipedia page   kagi.com/changelog#3179... · Posted by u/goplayoutside
rcMgD2BwE72F · 2 years ago
Still far better than all the alternatives, no?
hackideiomat · 2 years ago
Don't get me wrong, I do use kagi. but it's not nearly what I wish it'd be.
hackideiomat commented on Kagi Changelog 2/13: Faster and more accurate instant answers and Wikipedia page   kagi.com/changelog#3179... · Posted by u/goplayoutside
eitland · 2 years ago
So which search engine do you recommend that takes privacy seriously and that actually works (i.e. doesn't block me and return correct results) in Norway?
hackideiomat · 2 years ago
Maybe MetaGer if you can live with their quality
hackideiomat commented on Kagi Changelog 2/13: Faster and more accurate instant answers and Wikipedia page   kagi.com/changelog#3179... · Posted by u/goplayoutside
tmikaeld · 2 years ago
While it doesn't look good, it doesn't inject or execute scripts.

Still, would have liked an official take on this. I was about to re-signup but now I'll hold off on that.

hackideiomat · 2 years ago
Oh yes because of the CSP. The CSP that allows forms that can change your settings... you could easily use the above bug to get some impact with an additional click on a form's submit button.

Admittedly, no full XSS anymore, but still dangerous and shows their lack of understanding and caring about security.

It's not the only place you can inject HTML and not every page has a CSP...

hackideiomat commented on Kagi Changelog 2/13: Faster and more accurate instant answers and Wikipedia page   kagi.com/changelog#3179... · Posted by u/goplayoutside
Erratic6576 · 2 years ago
For me, it’s not only the price you pay. Having a username attached to each your searches is the opposite of privacy, no matter how much you trust their legalese wording
hackideiomat · 2 years ago
Go look at MetaGer, they solved that issue
hackideiomat commented on Kagi Changelog 2/13: Faster and more accurate instant answers and Wikipedia page   kagi.com/changelog#3179... · Posted by u/goplayoutside
elaus · 2 years ago
Could you elaborate? I didn't find anything in the change log that made this obvious to me.
hackideiomat · 2 years ago
Ha, exactly! They rarely fix bugs.

E.g., XSS / HTML injection in summarizer or discuss document. Or their broken CSP which allows injecting forms to e.g., change settings.

They haven't fixed many reported issues in a while, and just to prove I'm not lying: https://kagi.com/discussdoc?url=https%3A%2F%2Fkagi.com%2Fcha...

hackideiomat commented on Kagi Changelog 2/13: Faster and more accurate instant answers and Wikipedia page   kagi.com/changelog#3179... · Posted by u/goplayoutside
hackideiomat · 2 years ago
They do not take security and privacy seriously
hackideiomat commented on The FCC wants to criminalize AI robocall spam   theregister.com/2024/02/0... · Posted by u/mikece
teeray · 2 years ago
If a carrier delivers a spam text or call, if they can’t definitively prove who sent it, it should be treated as though the carrier themselves sent it (and fined accordingly). Watch how fast telcos mandate authentication and other KYC measures after that.
hackideiomat · 2 years ago
I don't want that?
hackideiomat commented on 'Stupid,' 'shameful:' Tech workers on Y Combinator CEO Garry Tan's rant   missionlocal.org/2024/01/... · Posted by u/Stratoscope
timmytokyo · 2 years ago
Your comment seems to suggest that you're viewing this event from outside the US. If so, perhaps you're unaware of the dangerous and recent rise in violent political rhetoric here. Garry Tan is a prominent and powerful person in the tech industry, and his words carry weight. When he rips violent lyrics out of a hip-hop song and refashions them into a political rant, he's pouring more fuel on a fire that's starting to burn out of control.

Garry Tan should know better. As an earlier article mentioned [1], he was previously quoted as saying "this kind of stuff should have zero place in San Francisco politics," referring to an activist's taunt that millionaires and landlords should be guillotined.

[1] https://missionlocal.org/2024/01/garry-tan-death-wish-sf-sup...

hackideiomat · 2 years ago
Well if you attack his friends, it's not okay, but if you go which death upon 'the leftists' he wouldn't say a thing, I bet

u/hackideiomat

KarmaCake day124September 20, 2023View Original