cc (@uint32_t) header
cc (@uint32_t) profile picture

cc

@uint32_t

oop

Joined June 2021
  • Tweets198
  • Following227
  • Followers1K
17Media
Photo by cc (@uint32_t)Photo by cc (@uint32_t)Photo by cc (@uint32_t)Photo by cc (@uint32_t)Photo by cc (@uint32_t)Photo by cc (@uint32_t)Photo by cc (@uint32_t)Photo by cc (@uint32_t)Photo by cc (@uint32_t)Photo by cc (@uint32_t)
Pooky has been spotted on fly.pieter.com
Image from cc (@uint32_t)
1
231
the sec is about as good at protecting investors as it is at protecting its passwords
5
1,535
what does this mean? this means that the same attack that was carried out not long ago would still be entirely possible today with very slight modification. an attacker instead of stealing session tokens and going straight to withdraw, they would instead just request the user's 2fa secret, generate the current token, and use that to submit a withdrawal request for a user.
1
7
5,254
what should you do as a user of thunder terminal? well, if i were you, i would use something else as this demonstrates a crazy level of incompetence, far beyond that of a team that somehow managed to leak a connection string (idk how tf u do that), and then they act as if they have resolved everything but they are too stupid to accomplish a task that would be assigned to a junior dev that has 2 weeks of experience. if you use this service, expect to lose your money. it is that simple.
4
13
4,547
I have received word that this has been resolved.
1
7
2,340
.@semperveritas0 can your team really not even implement 2fa properly?
Image from cc (@uint32_t)
7
6
4
62
43,311
to explain, thunder was recently the victim of a session stealing attack when their database was compromised and session tokens were leaked. in response they added 2fa, great. however, they are so incompetent that they leak the 2fa secret that is used to generate and verify 2fa codes for users through their websocket authenticated with a session token.
1
16
5,819
aint no way honkai telling me to kill myself
Image from cc (@uint32_t)
619
here’s an idea: if you’re going to take shots and have an ego u better be able to back it up and don’t cry about how it’s all for marketing when it comes back to bite u
This quoted post is unavailable.
Try viewing anyway · View on X
1
3
773
>google.com/
37
20
1,015
Has anyone seen any examples of what the rust foundation’s copyright proposal is supposed to prevent? I’m convinced it was created to prevent a lot of hypothetical issues that have never and probably will never occur.
26
23
1,200
There is an XSS vulnerability for Discord.com, do not click any links that go to "discord.com/servers/<server>" until this is fixed. I am contacting Discord about it and will post an explanation once it is patched.
9
59
11
165
UPDATE: This has been patched.
1
1
29
3,823
Now that this has been patched I think it's worth going over why the mere existence of this vulnerability is unforgivable imo and shows a substantial level of negligence by Discord developers.
cc (@uint32_t) profile picturecc@uint32_t15 Dec 2022
There is an XSS vulnerability for Discord.com, do not click any links that go to "discord.com/servers/<server>" until this is fixed. I am contacting Discord about it and will post an explanation once it is patched.
1
8
5
68
12,892
more replies
XSS is a vulnerability that should be all but eradicated today, imo there is no excuse for it to exist on a platform as large as Discord, especially a stored XSS vulnerability (which this was). I hope this will be investigated now that it has been patched and used to learn from.
1
12
2,444
In conclusion, this was a preventable incident and afaik nobody ended up becoming a victim of this vulnerability however I know there were some close calls and that doesn't make it excusable to have existed in the first place.
2
2
14
2,811
Load more