vitalipom

I TL;DR-ed it here in the edits of the root post above.

You’re right! Editing.

Again, I haven’t yet tested it. But I’d like to hear what community has to say with relevance to that about my direction with the solution I’d been working on.

Yes, but more smart people that visit a clear phishing website later on understand their mistake and change their password. If you could perform actual actions on a letsencrypt certificate website that perhaps has a slightly different url, you’d most probably would be less sceptic.

A bit loss of context. Angular was mentioned in the context of how servers serve Angular apps: if instead of server index.html server would serve a different whole url.

And my worries are mainly due to the solution I proposed (as a patent(!)) and later on abandoned.

I am wondering whether to invest in this my time and furthermore additional money.

Thank you for the reference! Would you mind to see if you can reflect on my solution idea which I’m questioning myself about? I filed a patent for it and mentioned it in a comment above. Please

The thing is that I claimed to have a solution and I even filed a patent for it. Some time later I understood I need many iterations to even understand if I’m right or wrong. The direction is OK, but I’m still trying to understand if I’m the right person to solve this problem: I am sending a secret via Email (which is a right direction), then to send and receive data to and from “bank.com” I send it to a Frontend JavaScript code that has access to this secret key (user clicks a link in the Email). The JavaScript resides on a subdomain of my service which is whitelisted via CORS.

If anyone would read this, could you please reflect?

Okay, I’ll give it a try by mocking up an attack on a secure app of mine I’m making. Thanks!!!

Not claiming it to be novel or new at all. Just trying to understand. I'll think about CORS. Meanwhile my thought - correct me if I'm wrong, is that CORS would be irrelevant since on behalf of bank.com it is simply controlled by a regular viewer. While the real user is just telling the proxy where to click and what to do.

Isn't CSP controlling what you can fetch FROM your website? The proxy in the example I mentioned can act as a simple web browser behind the scenes. Unless I'm missing something.

I will update when everything will be in the air

I will create a demo how I hijack my own account using session hijecktion and and a simple laptop and it to you to get convinced in the nature of purity of the provided signmeonly.io service I described above.

I will make a demo hijecking myself account and how do I do it and show with example yo you guys how all of us are vulnerable.

I described it: on Tik Tok, on YouTube, on dev.to, here in another posts. But somehow people don’t say anything. As if in the only tech places I know people don’t want to talk about technology now.

It’s not about convincing you to click something it’s about requesting to reflect me where have I fallen in between the chairs.

How did you do the email pretty thing you did there with verification and stuff? MailChimp? Or something else? I struggle with my thing in this stage (signmeonly.io — no website yet, only backend).

Signed up: https://ninjadm.com/@vitalipom

Cool! Usually talanted people hang out in some network they have, this is a cool idea I think.

So apparently I succeeded. Even though you told me it’s too complicated :) And I invite you to read about it, the service is called signmeonly.io

The session key is for autofill, like what autofills during MFA.

Whatever is stolen IS okay, because every request to the server encrypts using that session key which is stored in the cookie, the random string that the server send to the user inside a JWT, which can’t be modified and the server checks that the result of the encryption is what it supposed to be. The browser defends from stealing the cookie, however if SSSL is broken hackers can sniff anything they like. Which in this case will not help them anymore.

And it’s easy to implement (for me) hence I want to offer it to novice users for a small cloud usage fee. Maybe like 5 dollars a month for 1000 requests, 15 dollars for 10,000 requests, 50 for 50,000 and 500 for standalone server.

What do you say?

Do you need such thing?

You know what let me try my iPhone, maybe lowering the volume enough would do the trick indeed.

The issue is the speaker btw not the mic. I want(ed) it to be outside of my ear as in the bluetooth wearable headsets though.

Thank you for the trust though!

My skin really reacts very badly already on any ear/neck/head/tooth touching things :))

16 giant speakers low volume and lights

Skazi is a relative of a friend of mine, not me. I’m another guy :)

I’m DevOps, providing lots of support in between my daily tasks. Not streaming etc.

Yeah aahh the issue with that is that I need to stuck to the table station and not move my head and it feels like paralyzed.

Not a matter of sportsmanship dear, I use it constantly 365 days a week because people have questions and most of the times this 15 seconds talk solves the bottleneck. It’s a part of my job. But constant touch of plastics at the same place caused my skin sort of allergy after 20 years (I was listening to music before I started using the Bluetooth headsets).

Yeah, I see now that it has free starters plan. Consider however OCI, those are real machines that you can use for free. You can not just run backend on them, but for example run Kubernetes on a set of such machines :) They didn't pay me to talk about them hehe but I like them very much. Also what they offer for free of charge are very very powerful machines for unlimited amount of time.

TY! The intention was to deploy a free backend server. The difference is that it executes code whenever you want and can execute lots of code (on the backend) while serving your requests and this one - the script that I provided raises such a server that does it for free, it capable in terms of hardware to serve very high loads.

Free running back end server for on a publicly accessible IP