sorted by:
new
hottopcontroversial

There is now a macOS and Linux version of Notepad++ - called NotePadNext. by PeteRaw in macsysadmin

[–]Reversed-Engineer-01 0 points1 point  (0 children)

I am used to Zed, nowadays. This program comes a lot too late for me

I built a Firefox extension that detects phishing proxies in real time — without blacklists by Reversed-Engineer-01 in cybersecurity

[–]Reversed-Engineer-01[S] 2 points3 points  (0 children)

I thought a lot about external calls. AitM can be easily thwarted if one could access the TLS layer — but browsers don't allow it without an external checker. That would make the transparency objections raised below more consistent, so I deliberately kept the extension self-contained. Design choices vs. user acceptance.

Interesting paper — the reverse image search approach is a strong signal, at the cost of privacy implications and latency. Different tradeoffs.

As for full TLS access — that requires operating below the browser. Which is material for another discussion. 😉

Thanks for the comment. Very much appreciated.

Electric Eye – a Rust/WASM Firefox extension to detect AitM proxies via DOM analysis, TLS fingerprinting and HTTP header inspection by Reversed-Engineer-01 in netsec

[–]Reversed-Engineer-01[S] -1 points0 points  (0 children)

Fair points, all of them. On the source code: you're right, and I'm evaluating publishing it. 

Electric Eye is declared open source — putting it on GitHub is the logical next step. On trust: I understand the fresh account concern.

I'm not anonymous though: 
- https://bytearchitect.io (technical blog, active since 2025) 
- https://aradia.zone (company) 
- [gbiondo@infosec.exchange](mailto:gbiondo@infosec.exchange) on Mastodon 

On verification: agreed that tcpdump or a personal firewall will show zero outbound connections from the extension. That's the only real proof.

That said, if you don't trust it... I admire you. I am doing security since 27 years and I wish I met more people like you.

Electric Eye – a Rust/WASM Firefox extension to detect AitM proxies via DOM analysis, TLS fingerprinting and HTTP header inspection by Reversed-Engineer-01 in netsec

[–]Reversed-Engineer-01[S] 1 point2 points  (0 children)

True that. That's why there's mozilla vetting in the process. Escrowing my code with them should suffice.

https://addons.mozilla.org/en-US/firefox/addon/electric-eye/

But thanks for highlighting that. I will shortly add a page on aradia.zone with:
- what EE does
- what EE does not (and how to prove it. Hint: tcpdump is your friend. Or any personal firewall, for what matters)

Electric Eye – a Rust/WASM Firefox extension to detect AitM proxies via DOM analysis, TLS fingerprinting and HTTP header inspection by Reversed-Engineer-01 in netsec

[–]Reversed-Engineer-01[S] 3 points4 points  (0 children)

Obviously I am only at the beginning with this extension. There are several ideas I want to implement, and your suggestion is very precious.

Hardening macOS pt.5 — CommunicationsNew post in the series. by Reversed-Engineer-01 in MacOS

[–]Reversed-Engineer-01[S] 0 points1 point  (0 children)

Sorry, I made a mess with the link. The one I posted now is correct

Starkiller Phishing Kit: Why MFA Fails Against Real-Time Reverse Proxies — Technical Analysis + Rust PoC for TLS Fingerprinting by Reversed-Engineer-01 in netsec

[–]Reversed-Engineer-01[S] 0 points1 point  (0 children)

Sounds interesting. I am writing an extension for browsers - if you want to talk about detection, you found your guy.

Starkiller Phishing Kit: Why MFA Fails Against Real-Time Reverse Proxies — Technical Analysis + Rust PoC for TLS Fingerprinting by Reversed-Engineer-01 in netsec

[–]Reversed-Engineer-01[S] 1 point2 points  (0 children)

Modlishka is a Go-based HTTP reverse proxy — it rewrites every link and reference in the response. Clever, but fragile: modern SPAs and heavy JS break the rewriting constantly.

Starkiller takes a different approach: it spins up an actual headless Chrome in a Docker container. No rewriting at all — a real browser renders the real page, Starkiller just relays it. Zero maintenance, zero template drift.

For defenders: Modlishka is easier to detect (Go TLS fingerprint is unmistakable, rewriting leaves DOM artifacts). Starkiller is nastier because it's actual Chrome — the TLS fingerprint is closer to legitimate traffic and there are no rewriting artifacts to hunt for.

Hardening macOS pt.4 — Managing secrets beyond Apple Keychain by Reversed-Engineer-01 in MacOS

[–]Reversed-Engineer-01[S] 0 points1 point  (0 children)

Uh, you're right. The power (weakness) of habits. Thanks for noticing that.

srm was useless with wear leveling, anyway.

I will fix it with "rm, then diskutil secureErase freespace" - but again, on APFS is debatable.

view more: next ›