B
Bishop Fox Labs
labs.bishopfox.com · Company blog · on HN since 2020
Bishop Fox, a security consulting firm, publishes research on web vulnerabilities, fuzzing, request smuggling, SSRF and pen testing tools.
What HN saysHN links it for its security explainers, such as JSON interoperability bugs, email spoofing defences and password rotation, which commenters cite as a bad practice.
15HN people shared it
4linked it in comments
38stories submitted
118story points
5 years agolast shared
2020people per year2026
Most-shared posts
- 1An Exploration of JSON Interoperability Vulnerabilities2 people · 46 points · first shared 2021 · 14 comments on HN
- 2H2c Smuggling: Request Smuggling via HTTP/2 Cleartext (H2c)2 people · 4 points · first shared 2020 · discussion on HN
- 3Zamzar API – High-Risk SSRF Vulnerability2 people · 3 points · first shared 2020 · discussion on HN
- 4Lexss: Bypassing Lexical Parsing Security Controls1 people · 16 points · first shared 2021 · 2 comments on HN
- 5An Intro to Fuzzing (a.k.a. Fuzz Testing)1 people · 4 points · first shared 2021 · discussion on HN
- 6The Pen Testing Tools We’re Thankful for in 20201 people · 3 points · first shared 2020 · discussion on HN
- 7You're Doing IoT RNG1 people · 3 points · first shared 2021 · 1 comments on HN
- 8Recommended Talks from DEF Con 281 people · 3 points · first shared 2020 · discussion on HN
- 9How to Keep Your Organization Safe from Social Engineering1 people · 2 points · first shared 2020 · discussion on HN
- 10LibreHealth Version 2.0.0 – High-Risk Vulnerabilities1 people · 2 points · first shared 2020 · discussion on HN
- 11Design Considerations for Secure GraphQL APIs1 people · 2 points · first shared 2020 · discussion on HN
- 12Accidentally Secure Is Not Secure: A Case of Three Stooges Syndrome1 people · 2 points · first shared 2020 · discussion on HN
- 13More Important Than a TPS Designing a Realistic CTF for DEF Con Safe Mode1 people · 2 points · first shared 2020 · discussion on HN
- 14Cheating at Online Video Games and What It Can Teach Us About AppSec (Part 2)1 people · 2 points · first shared 2020 · discussion on HN
- 15Is This IoT App Safe to Drink?1 people · 2 points · first shared 2020 · discussion on HN
What HN people wrote when they linked it
artful-hacker · 2021-04-19
The guy who first recommended rotation "has since come out and apologized about the first iteration of the NIST guidelines"[1]
Password rotation has always been a bad idea.
https://labs.bishopfox.com/industry-blog/2018/08/password-security-the…
angry_octet · 2021-01-13
I understand where Moxie it coming from: user friendlyness (and candy) increases the user base in a demonstrable way. At the same time, adding code like this pretty clearly increases the attack surface unnecessarily. So there is a tradeoff they are making for everyone. I would much rather be able to disable that additional state space, even if I can't strip it out of the build entirely.
I also find it a bit crazy that the 'desktop' app is Electron, and they don't hint anywhere what a house of cards Electron is. I wouldn't run it except inside a VM, and even then I would have to accept that all the messages could be extracted remotely. They give no indication of their compliance with best practices (e.g. https://labs.bishopfox.com/tech-blog/reasonably-secure-electron) with is disturbing.
ramimac · 2021-06-07
https://labs.bishopfox.com/tech-blog/2017/05/how-we-can-stop-email-spo… is a pretty good primer on spoofing (SPF, DKIM, DMARC)
kstenerud · 2021-04-21
If you squint at it the right way, sure ;-)
It's basically a binary format that has a 1:1 compatible text format. The idea is that everything stays in binary format (which is faster to process, more efficient, and smaller), and then convert the document to text only if/when a human needs to see it or edit the document.
It could still be further compressed using a general purpose compressor like gzip, but the main purpose of the data format is to be easy for a machine to process compared to JSON/XML/etc, and tight in specification so that you don't end up with exploitable security holes due to implementation differences like you do with JSON/XML: https://labs.bishopfox.com/tech-blog/an-exploration-of-json-interopera…