Light

Episode #825 Quiz

Halfway Through 2021
Date: 2021-06-29 | Length: 1.5 hrs | Episode page at twit.tv

About this episode

Edge’s built-in translation failed to sanitize HTML image tags, enabling malicious JavaScript to execute as the page origin and causing universal cross-site scripting across sites and Facebook/Instagram web apps; Microsoft awarded $20,000 and patched it. The episode also notes FLoC delay, ransomware recovery costs, and risks from unsupported NAS devices.

Your name and email are stored only in your browser local storage for convenience. They are not retained server-side.

NameEmail

Question 1: What specific flaw in Edge's built-in translator allowed the researchers to trigger universal cross-site scripting, according to the episode?

Question 1

What specific flaw in Edge's built-in translator allowed the researchers to trigger universal cross-site scripting, according to the episode?

It failed to properly sanitize HTML image tags. It reused cookies across unrelated origins without isolation. It exposed the page DOM through an unsecured extension API. It allowed script execution only after a user accepted a translation prompt.

Question 2: According to the episode, what did the researchers receive from Microsoft after reporting the Edge translator issue?

Question 2

According to the episode, what did the researchers receive from Microsoft after reporting the Edge translator issue?

A U.S. $10,000 bounty award. A U.S. $20,000 bounty award. A U.S. $100,000 bounty award. A U.S. $50,000 bounty award.

Question 3: What delay did Google announce for FLoC's wider rollout?

Question 3

What delay did Google announce for FLoC's wider rollout?

From late 2023 to sometime in 2024. From early next year to late in 2023. From mid-2021 to early 2023. From early this year to late in 2022.

Question 4: What did Western Digital say the attackers had done on some compromised My Book Live devices?

Question 4

What did Western Digital say the attackers had done on some compromised My Book Live devices?

Replaced the firmware with a signed recovery image. Installed a trojan named .nttpd,1-ppc-be-t1-z. Disabled UPnP on the devices through the management interface. Encrypted the data with a newly deployed ransomware payload.

Question 5: How did Steve characterize the security value of TPM for keeping secrets from the NSA?

Question 5

How did Steve characterize the security value of TPM for keeping secrets from the NSA?

He said it was not something you could trust your life with. He said it could not be decoded even with physical access to the motherboard. He said it was fully trustworthy once BitLocker was enabled. He said it was equivalent to an air-gapped secure enclave.

Cancel

My Data//Security & Privacy//Clear Local Data

© 2026 Ken ArmstrongSecurity Now™ is a trademark of TWiT LLC. All trademarks and copyrights of the Security Now podcast are respected and reserved to their respective holders.
This is a hobby project made with love and admiration for what Steve Gibson and Leo Laporte have built over 20 years.