32032141

Right. The first CVE gets you for example, cross window access. The second gets you system access outside of the sandbox.

What an absolutely worthless website.

"Your browser does not support WebGL"

They're basically all exactly this though, no matter what you're paying this is generally what is underneath. Competent encryption in hardware is difficult, so everybody is doing it in software, and then why id the software hardware specific to begin with?

http://spritesmods.com/?art=bioslimdisk

http://spritesmods.com/?art=diskgenie

http://spritesmods.com/?art=biostick

http://spritesmods.com/?art=securehd

http://spritesmods.com/?art=secustick

There's some patterns with 'secure USB storage', notably that none of them are anything besides a toy.

This isn't for personal use, so no calls. The data rate is probably around 2-5c/MB for Canada (though its not on the pricing list, that seems to be average), which puts it above even Rogers consumer plans. Google Fi is intended for consumer use and is 1c/MB in Canada (up to a cap, and then unlimited).

This is for Internet of Thing usage, the customer is a company who is making Internet Widgets with some need to be able to communicate no matter where their Internet Widget is operating, without necessarily having to configure or prepare for the destination.

I've been wondering for a while what the purpose of all the NB band LTE stuff is even for. The going rate is often around 40c/MB in most countries (lower on Twilio by the looks of it, but the same order of magnitude), which seems like there's some very specific high value-per-byte application intended. Some of the technologies people are touting for very long battery life have transmission latencies of 10+ seconds as a trade off, which makes the applications for it even more restricted.

It feels like the result is going to be that literally every device you can purchase will have a always connected LTE lojack attached. Imagine trying to firewall or restrict the network in your business when literally everything has its own backbone, it'll be a complete nightmare.

Just use ProxyJump. You basically should never be using agent forwarding.

This is an explicit tool in adwords, believe it or not.

The feature is intended so that you can have a link "to" http://trackersRus.com/ which forwards to http://ebay.com/, without the user seeing that bit of ugly.

It's been used in campaigns for years, I've reported probably hundreds of these distributing malware.

I didn't realise Firefox came with that sort of backdoor.

I don't really see a situation in which someone has local file read access on your machine, but doesn't otherwise have you completely owned.

I genuinely don't understand downvoting a series of very realistic comments about what using a Yubikey is actually achieving in these situations.

I personally don't see the point in them at all, in implementation and reality you get basically zero use out of the things.

Services that support them either have them locked down so hard that if you lose a single Yubikey (there's often no backup second key option), you're very screwed. Others go the other option, and have too easy to reset systems, SMS fallbacks, or other total bypasses of the security tokens.

For SSH and GPG, authentication keys are generally the least of your concern. The content you're controlling are much more valuable than the authentication itself. Can an attacker just wait until you SSH somewhere, and leverage that access? Can they wait until you'd press the button for another benign purpose and use that authentication in a malicious way? The answer is almost always yes, which reduces the value of these sort of devices substantially. They don't protect against local compromise, in which case a keyfile sitting on your local host is just as secure and a lot more convenient.

2^32 milliseconds.

" I've only gotten a handful of viruses or malware "

This is a variation of the bad toupee fallacy. You won't notice viruses and malware, almost by definition.

report.pdf 21.12M 1.84MB/s eta 2m 18s

Seems to be handling it.

This isn't uncommon. There's hundreds or thousands of companies that combine [blockchain x thing], in some vague hope of getting people in the [thing] industry will give them money. There's never a technical reason for this to happen, other than someone thought it was an attractive sounding idea. Generally speaking there's very few things which could be conceivably solved by a block chain, it's not a solution which can be pasted over any interesting sounding problem, and manages to create a multitude of problems when it is.

Indeed. My point was that taking claims about effects from people is effectively worthless in a situation where the "threat" is invisible, effects are subjective, and there's a lot of political motivation for belief in them. In a small city nearby people claimed these sorts of effects in an attempt to prevent a cellphone tower being built and "ruining" their view.

https://mybroadband.co.za/news/wireless/11099-massive-revela...

This sort of thing happens quite a bit actually. In this case, a huge number of residents complained ofvarious illnesses that were supposed to have been caused by a new tower being built in their vicinity. That the symptoms were presented when the tower was not operational is fairly telling that nocebo effect dominates here over any rational or explainable occurrence.

What you're saying has quite literally no basis in fact.

Counter to it significantly, there's a heap more powerful non-ionizing transmission than things you have locally in very similar bands, like hundreds of kilowatt TV and FM radio transmitters. Any "effect" you would be seeing is placebo or nocebo depending on the state of your "airplane mode" switch.

It checks a bloom filter.

Why not do it deterministically then? 600 hashes of MAC addresses suggests that it's a very targeted group of machines, it's the size of a moderately large company, for example.

A notable reason for this sort of thing happening is that the price increased. Solutions which are obviously just toys very quickly grow into problems without you having to do anything.

I don't think my threat model encompasses the safety of other people's money.

Hi, I've written bootloaders before.I know that blacklisting addresses doesn't work, as many memory locations will be mapped multiple times. Strangely, most people that have worked with microcontrollers is aware of this, except for the people who wrote the closed source bootloader at ledger.

A "secure", closed source processor. Given the Ledger bootloader had a rather nasty and bluntly obvious bug in it that allowed you to bypass all of the write protection and boot any firmware, I'd give them nearly zero chance of having got anything else right.

The way they operate, I expect that there's HTTP logs of all activity. They do not operate in a way which is conductive to privacy.

Note that this doesn't actually do anything to attest the safety of the device, as has been pointed out in a CCC talk recently. It attempts to confirm that the code running on another processor is legitimate by asking it to read its entire flash to a "HSM" chip, which is obviously simple to deceive by reading back something that is not the processors flash. I personally think that this is deceptive and counter productive.

Yep.

Either they are so incompetent that they released software out of their git tree from someone's work environment, and had absolutely no process to catch a ridiculous and obvious failure. Otherwise they got popped and are lying about it. Neither is anything but a disaster.

It's not the researchers responsibly that a vendor is incompetent, frankly. The vendor released something broken, that's their burden to bear, it's not wise to assume that you're the first to find a bug, with that in mind expedient full disclosure is acting with the customers best interests.