1,430 reputation
719
bio website robwu.nl
location The Netherlands
age 21
visits member for 2 years, 4 months
seen 1 hour ago

I'm a CS student who likes web-related technologies, in particular browser extensions. I'm the creator of Lyrics Here by Rob W and several Stack apps.

I'm quite active on Stack Overflow, the Chromium project, PDF.js, and occasionally put something on Github.

Contact: rob@robwu.nl


1d
comment Is CORS helping in anyway against Cross-Site Forgery?
By the way your answer is phrased, DNS rebinding sounds like a serious vulnerability that is highly relevant to CORS, and somehow relevant to CSRF. In order to carry out an attack that abuses origin whitelists, the attacker has to control one of those origins. DNS rebinding is not going to help over there. If the attacker controls the origin, then the only thing where DNS rebinding could be used is to steal cookies that were set after a CORS-enabled request with credentials via an attacker-controlled host name. That attack sounds a bit far-fetched. Did you have anything else in mind?
1d
comment Is CORS helping in anyway against Cross-Site Forgery?
If you always reply with Access-Control-Allow-Origin: *, then the resource is already public, so DNS rebinding doesn't add any value. Could you give an example (requests & responses) where DNS rebinding and CORS together result in a security issue, which really requires both components in the attack?
1d
comment Is CORS helping in anyway against Cross-Site Forgery?
What is the relevance of DNS rebinding in the context of CORS? If a DNS rebinding attack is successfully being carried out, then information is already being leaked (regardless of CORS headers). If CORS is incorrectly set up, then information can already be accessed without DNS rebinding. In either case, I don't understand why DNS rebinding deserved to be mentioned in your answer. Did I overlook anything?
Aug
6
comment Why do phishing emails have spelling and grammar mistakes?
I've read that sometimes these mistakes are added on purpose. Only a fool would fall for messages full of errors. And scammers are looking for that kind of people.
Jul
24
awarded  Caucus
Jul
24
awarded  Constituent
Apr
8
awarded  Yearling
Apr
1
comment Cannot turn off XSS filter in Chrome
Try --disable-xss-auditor instead.
Mar
26
comment Unexpected/unwanted/unknown participant joined WebRTC session
@joelmaranhao The room name is not a part of the SDP. For a dissection of a typical SDP as used in WebRTC, see e.g. webrtchacks.com/sdp-anatomy. The room name is something application-specific, you have to find and read the source code of the server if you want to get the exact answer. Bottom line is that whenever you send something to a server, it is out of your control, and the server is free to do whatever it want with it, including passing the data (SDP) to other subscribers of the websocket channel.
Mar
26
comment Unexpected/unwanted/unknown participant joined WebRTC session
@joelmaranhao You are not being hacked. You are deliberately (unknowingly?) sending your SDP to signaling.simplewebrtc.com, which in turn sends the SDP to other peers. Since these peers now have your SDP, they know how to set up a connection with your browser and exchange data.
Mar
26
answered Unexpected/unwanted/unknown participant joined WebRTC session
Mar
24
comment Is using “HTTPS everywhere” extension secure?
By switching from http to https, the communication (transport) is encrypted. What's misleading about that?
Mar
17
awarded  Good Answer
Mar
13
comment Firefox vs. Chrome extensions: Which are---ceteris paribus---more secure?
@Ajedi32 The webRequest API can only block requests. It cannot be used to selectively disable inline scripts. I have proposed a patch for Chromium which allows extension developers to get more control over whether to execute a specific script, but it was not well-received.
Mar
13
comment Why would Chrome not display a padlock icon at all on an SSL site?
@BrettCaswell Ah, I see where your confusion comes from. I assumed that you simply misspelled the word (that word is commonly misspelled), but you just misread. My answer, source and all documents that we've been referring to use "deprecate", not "depreciate". Sha-1 certificates are not loosing value (=depreciated), but they are being phased out (=deprecated).
Mar
13
comment Why would Chrome not display a padlock icon at all on an SSL site?
@BrettCaswell And before you continue nitpicking: "to deprecate" is defined as "to criticize or express disapproval of (someone or something)" (source: Merriam-Webster). Something that is "in the process of deprecating" is "deprecated".
Mar
13
comment Why would Chrome not display a padlock icon at all on an SSL site?
@BrettCaswell You're citing an old (2012) version of the document. The current version (1.2.3) states (section 9.4.2) "Effective 16 January 2015, CAs SHOULD NOT issue Subscriber Certificates utilizing the SHA-1 algorithm with an Expiry Date greater than 1 January 2017 because Application Software Providers are in the process of deprecating and/or removing the SHA-1 algorithm from their software, and they have communicated that CAs and Subscribers using such certificates do so at their own risk." So, sha-1 certs are certainly deprecated.
Mar
13
comment Why would Chrome not display a padlock icon at all on an SSL site?
@BrettCaswell "it is, however, not depreciated or obselete as of yet." - wrong, sha1 has already been deprecated since 2011 (see third paragraph of the linked source). And the exact appearance of the non-padlock is indeed version-specific, but the absence of a green padlock is version-independent (i.e. starting from Chrome 39, sha1 certificates are not shown as fully trustworthy any more).
Mar
13
comment Firefox vs. Chrome extensions: Which are---ceteris paribus---more secure?
@Ajedi32 contentSettings.javascript applies to whole tabs only, it cannot be used to selectively disable JavaScript on domains in a (sub)frames.
Mar
13
comment Firefox vs. Chrome extensions: Which are---ceteris paribus---more secure?
@Ajedi32 The part about NoScript is still true. The Chrome APIs are simply not powerful enough to offer all features from Firefox's NoScript.