Light

Episode #925 Quiz

Brave's Brilliant Off the Record Request
Date: 2023-05-30 | Length: 1.25 hrs | Episode page at twit.tv

About this episode

Brave’s Request OTR lets websites send a Request-OTR: 1 header so the browser prompts users to open the site in a temporary, site-scoped storage area. History, cookies, permissions, and caches are discarded on exit, while non-sensitive browsing remains recorded. It mitigates on-device surveillance, unlike generic private browsing.

Your name and email are stored only in your browser local storage for convenience. They are not retained server-side.

NameEmail

Question 1: According to the episode, what specific change did the Python Software Foundation plan to make for PyPI accounts by the end of the year to improve supply-chain security and resist account takeovers?

Question 1

According to the episode, what specific change did the Python Software Foundation plan to make for PyPI accounts by the end of the year to improve supply-chain security and resist account takeovers?

Require all maintainers to rotate their API tokens every thirty days Require all maintainers to verify package names through DNSSEC Require all package uploads to be signed with developer certificates Require all maintainers to choose some two-factor authentication method

Question 2: Why did the Python Software Foundation decide to hash IP addresses in its logs with a single secret salt rather than with a publicly stored per-record salt?

Question 2

Why did the Python Software Foundation decide to hash IP addresses in its logs with a single secret salt rather than with a publicly stored per-record salt?

Because the IPv4 address space is small enough for GPU-based hash reversal Because IPv6 addresses are too large to store with ordinary database indexes Because per-record salts would prevent any later IP comparisons from being possible Because hashes without a secret salt would violate PyPI’s CDN contract

Question 3: In Brave’s Request OTR design, what is the primary mechanism a website uses to ask the browser to treat a visit as off the record?

Question 3

In Brave’s Request OTR design, what is the primary mechanism a website uses to ask the browser to treat a visit as off the record?

Return the Request-OTR: 1 header in the initial navigation response Append an otr=1 query parameter to the site’s canonical URL Register the site in Brave’s DNS blocklist as sensitive by default Embed a meta tag named request-otr in the page’s HTML head

Question 4: What limitation did Brave explicitly note about Request OTR’s protection scope?

Question 4

What limitation did Brave explicitly note about Request OTR’s protection scope?

It cannot prevent cookies from being created during the visit It cannot prevent websites from showing up in browser history at all It cannot protect against browser extensions or device-level spyware It cannot work unless the user first enables a permanent private browsing profile

Question 5: Which class of vulnerabilities did Google include in its Mobile VRP that specifically covers problems leading to arbitrary file writes?

Question 5

Which class of vulnerabilities did Google include in its Mobile VRP that specifically covers problems leading to arbitrary file writes?

Certificate forgery and TLS downgrade Path traversal and zip path traversal Cross-site scripting and template injection SQL injection and stored procedure abuse

Cancel

My Data//Security & Privacy//Clear Local Data

© 2026 Ken ArmstrongSecurity Now™ is a trademark of TWiT LLC. All trademarks and copyrights of the Security Now podcast are respected and reserved to their respective holders.
This is a hobby project made with love and admiration for what Steve Gibson and Leo Laporte have built over 20 years.