HN user

penagwin

2,802 karma

[ my public key: https://keybase.io/penagwin; my proof: https://keybase.io/penagwin/sigs/bhcyDKI7gf-jC0q0KWEg0jl9qdejoftHLWUddp5tnmM ]

Posts2
Comments1,121
View on HN

Yes, as well as applying for jobs (or at minimum when hired), renting an apartment, and lots of financial things including any type of KYC crypto exchange or investment accounts. I've also had utility companies ask for it.

These are in no way secret, I have no idea how people are okay with this. You can easily social engineer so many critical services if you know somebody's SSN.

Apparently 3G is being phased out by AT&T (and I think most other providers have already left 3G) in the US.

Which sucks because I can get a 3G module for my iot projects for 5$ and I think 4G modules start at 50$?

Are we just at the mercy of 4G now for services that need large coverage but low throughput? I know 5G technically has a spec for IOT type stuff but I haven't seen anything about it, and I haven't seen modules for it.

To me it's fair to say it's not a likely scenerio, it's just that they continously say "this would be difficult" at every step. I appreciate the breakdown, but it comes off as trying to convince you it was a near-complete impossibility. I understand it was unlikely, but it was possible, and that makes it severe either way.

I live in the US and have had comcast inject into http requests. I noticed because of a pop-up in csgo's menu (it loads html for their blog)

He is talking about government level threats, DO provides no benefit.

I'll add that rolling your own means you're the only one exiting that IP address, so if your threat model involves websites profiling you and/or alternative accounts that won't help.

Yeah it's a tricky one isn't it? On one hand many of the best security researches are ex-state employees, and many of them go from that into the private sector. On the other hand it makes it sound like they are friendly with potential adversaries.

I don't think crypto would solve this particular issue. Stripe needs the ability to back out of moving money, so there's several settlement periods for different parts of the transaction and ways to appeal transfers retroactively.

I suspect fraudster's are able to wait out this period without detection so they can cash out. If this is the case, then even time locking smart contracts won't help, as the fraudsters just wait out the time period. At that point Stripe would have even less recourse to recover money, as retroactive transfers are not possible at that point.

I could see services such as their debit card offering being abusable too.

They also likely have to worry about things such as predatory recurring payments as those will result in chargebacks which could ultimately fall on Stripe to foot.

From my understanding it depends on how naughty your current exit node has been. Most tor exits in my experience allow creation and you just need to verify another email (just use a random burner- they only block a few. Supposedly some well behaved exits require just a captcha but I've never seen it.

Because like 90% of the traffic is malicious. VPNs and proxies obviously change your exit IP, and people rotate through these as they do things like spam, make accounts, credential stuff, etc. This means they're burning through the IP ranges and getting them flagged.

If you're on a VPN with a fresh ASN and IP range you won't have any issues (until people start using it for other reasons).

If you wanted to "fix it" the dirty method, there's extensions for chrome/firefox/etc that will automatically submit your captcha to a captcha solving service and it costs some tiny amount.

tldr; Mischievous basically has to go through VPNs, and they rotate through IPs getting them flagged. You can join the dark side with a captcha solving service and extension, and there's some "solutions" like privacy pass you can try.

V and it's creator get a lot of flack here on HN and the criticisms are probably warranted.

Hi fellow Penguin :D!

I'm impressed by the creator's dedication here too, but he's clearly biting off more then he can chew - he's been saying that he's making a

* Web framework * GUI framework * SQL ORM * A language that has a lot of promises - seriously checkout their list. * Github alternative * VIM alternative

This stuff is awesome as a project, but each one of these have teams of dedicated engineers sponsored by many companies to hammer out issues and make them as robust as possible. And while he certainly has working demo's of each, they're demos. There's a huge difference between a POC and a robust framework.

A half baked framework is useless sadly, I think he's spreading himself too thin while have a roadmap that looks like a programmer's christmas list.

I highly doubt you could use something more injurious legally at least. Maybe pepper spray or something, but defense must be proportional (including booby traps) - you cannot for example setup a shotgun to shoot their legs (see Katko v. Britney).

As a person who both knows how easy cheats are to make, and what anticheat entails - There's no way I'd play without it.

In CSGO for example, many players _want_ a more invasive anticheat solution, and are literally asking or even paying for it through third parties like ESEA and Faceit.

Valve Steam Deck 5 years ago

You _must_ have server-side anticheat if you have any at all because client side can (eventually) be bypassed - however client side anticheat is better at catching subtle but low effort/obvious cheats.

Also some types of cheats such as wall hacks can only be detected client side.