HTTP Signature Infinite Loop?


A padlock engraved into a circuit board.

I'm trying to get my head round HTTP Signatures as they're used extensively in the Fediverse. Conceptually, they're relatively straightforward. You send me a normal HTTP request. For example, you want to POST something to https://example.com/data You send me these headers: POST /data Host: example.com Date: Sat, 24 Feb 2024 14:43:48 GMT Accept-Encoding: gzip Digest: […]

Continue reading →

A quick look inside the HSTS file


Glowing computer text showing dot com dot info etc.

You type in to your browser's address bar example.com and it automatically redirects you to the https:// version. How does your browser know that it needed to request the more secure version of a website? The answer is... A big list. The HTTP Strict Transport Security (HSTS) list is a list of domain names which […]

Continue reading →

An open(ish) redirect on Mastodon


Cartoon of a tusked mastodon holding a phone.

I've responsibly disclosed a small security issue with Mastodon (GHSA-8982-p7pm-7mqw). It allows a sufficiently determined attacker to use any Mastodon instance to redirect unwary users to a malicious site. What do you think happens if you visit: https://mastodon.social/@PasswordReset/111285045683598517/admin? If you aren't logged in to that instance, it will redirect you to a 3rd party site. […]

Continue reading →

Hiding malicious commands in copy-and-pasted text


The HTML5 Logo.

Quite often websites will encourage you to copy and paste commands into your terminal. There are a variety of reasons why this is bad - not least because someone could hide malicious code. That's usually done with a bit of CSS to make the evil command invisible, or using Javascript to inject something unwanted into […]

Continue reading →

That's not my printer! Accidentally finding unsecured HP printers in the wild


Screenshot of an HP printer's internal setting screen with everything written in Russian.

The other day, my HP M140w printer stopped working. The day before, it printed fine. This time, nothing. I rebooted, reset, updated, and performed all the modern rituals associated with uncooperative hardware. I logged into to the printer's webserver and clicked around the admin panel. On one page, I found an error message. So, like […]

Continue reading →

The limits of General Purpose Computation


A pet cat typing on a computer keyboard.

Should my bank be able to block me from using their Android app, just because my phone is rooted? I'm reluctantly coming to the conclusion that... yeah, it's fair that they get to decide their own risk tolerance. Sage of the Internet, and general Sooth Sayer, Cory Doctorow once gave an impassioned speech on "The […]

Continue reading →

How do you stop people accessing data they shouldn't?


A padlock engraved into a circuit board.

I used to work in a call centre for a Very Big Company. Every week, without exception, we'd get a bunch of new starters to train. And every week, without exception, a newbie would be fired after looking up a famous person's data. This was in the days before GDPR. There was a lot less […]

Continue reading →

Responsible Disclosure: arXiv - redirect on login


A padlock engraved into a circuit board.

Suppose you are sent a link to a website - e.g. https://example.com/page/1234 But, before you can access it, you need to log in. So the website redirects you to: https://example.com/login?on_success=/page/1234 If you get the password right, you go to the original page you requested. Nice! But what happens if someone manipulates that query string? Suppose […]

Continue reading →

How to generate a Base32 TOTP secret string on a Mac


A padlock engraved into a circuit board.

I needed a way to generate a TOTP secret using a fairly locked-down Mac. No Brew. No NPM. No Python. No Prolog, COBOL, or FORTRAN. No Internet connection. Just whatever software is native to MacOS. As I've mentioned before, the TOTP specification is a stagnant wasteland. But it does have this to say about the […]

Continue reading →

Responsible Disclosure: Abandoned Buckets and Billing Emails


Error saying the bucket does not exit.

A few weeks ago, I received a billing email from my phone provider O21. While glancing at it, I noticed all the images were broken. Viewing the source of the email showed that they were all coming from http:// mcsaatchi-email-preview.s3.amazonaws.com/o2/... What happens if we visit that domain? Ah, the dreaded "The specified bucket does not […]

Continue reading →