aj3

27 ms·

241.
by aj3 6y ago
Many previous ICO hacks (wait for initial coin offering -> change the bitcoin address to your own) have paid millions. Musk's or Buffet's tweets have moved markets multiple times. This sort of access could have been leveraged t
242.
by aj3 6y ago
Or someone bragged about their super awesome access to Twitter on some IRC or Discord channel, posted proofs which unintentionally leaked the session tokens / exploit to others and the whole bunch of kids went crazy due to fear of miss
243.
by aj3 6y ago
> For example, you can crypto-shred an unlimited amount of data just by deleting the key associated with it. Sounds like a great target for ransomware crews!
244.
by aj3 6y ago
Not sure what benefits are there in scheme you described. Which threat exactly is mitigated by using this tech?
245.
by aj3 6y ago
You’re the one that seems to be thinking in absolutes (when it suits you). 1. In cryptographical/philosophical sense that’s a tough problem. But our goal is to improve on existing solution not come up with an absolutely ideal schem
246.
by aj3 6y ago
1. You feel that the process is well understood because that’s the only process you’re familiar with and likely it was taught to you since school. In reality other schemes such as electronic voting could be just as clear and transparent, wh
247.
by aj3 6y ago
> As candidates & parties become more competitive, the difference in their voting shares tends to narrow. This reads like a pure American exceptionalism.
248.
by aj3 6y ago
> Or it's an argument that a voting system should have both hand-counting and digital counting, because rigging both counts is at least twice as difficult as rigging one. Unless the party rigging the counts is the one currently in p
249.
by aj3 6y ago
I watched the video. It's a load of crap. I mean, here are his arguments (feel free to tell me if I missed something): - voting systems inevitably have to be closed source, loaded on easily compromisable USB stick, connected to int
250.
by aj3 6y ago
Tamper protection is really meant for enterprise. Disabling it is exactly as hard as gaining privilege escalation. It is harder to achieve in AD (of course attackers gain lateral movement opportunities instead, but that's a different s
251.
by aj3 6y ago
It's great at what it does. Much more useful than I expected, feels more thought out than some commercial alternatives. XEN Virtualization with their custom X-passthrough driver is super fast as well. No hardware acceleration of course
252.
by aj3 6y ago
I agree, at least an option to have more granularity would be a good thing. Maybe the upcoming changes to Android/iOS permission models will solve the problem of UI/UX and this will finally become fashionable. However, there is al
253.
by aj3 6y ago
Yes, it's does not give you SELinux/seccomp level of granularity. But then again, there is a slight chance that users might actually understand what it's for and how to use it, unlike SELinux/seccomp. In practice though,
254.
by aj3 6y ago
Here's a tip: the safest way to open sketchy pdf is through PDF.js that's used in browsers as it relies on the same JS sandbox you use to browse net all day. Other than that - open documents in a VM (with reverting to the previous
255.
by aj3 6y ago
There are so many ways to escape Firejail, that no one should seriously rely (solely) on it for security. Please, just use proper virtualization for trying shady software/suspected malware.
256.
by aj3 6y ago
Sure: https://www.virtualbox.org/wiki/Downloads
257.
by aj3 6y ago
> I tell all my clients that when in doubt, drop that bad (?) boy in VT and let it scan it. Who are your clients? Are you aware that everything that's uploaded to VT becomes public? As in full file contents, not just metadata &
258.
by aj3 6y ago
There are two problems with that approach: 1) while this might stop ransomware as we know it, it does not fix the underlying problem, e.g. usually all the important files are in the "regular folder" anyway, so even if adversar
259.
by aj3 6y ago
Windows 10 has just what you describe: https://www.bleepingcomputer.com/news/microsoft/how-to-enabl... Of course, bad guys still can 1) create encrypted copy and delete originals instead of modifying files in plac
260.
by aj3 6y ago
It's not necessarily malice. Experts rarely have time to review some bullshit for free and the tight timelines don't help.
261.
by aj3 6y ago
Professionally relevant information - insider sources, other information that is important for you for whatever reason - from original sources. If there aren't any original sources (e.g. politics, history etc) - cross reference multipl
262.
by aj3 6y ago
It makes sense if you consider modern news a form of entertainment which is arguably is.
263.
by aj3 6y ago
But living in a bubble doesn't sound that great either. I prefer the Economist - they clearly have a very strong bias in some political & economical stories, but that bias is predictable and consistent. At least their factual repor
264.
by aj3 6y ago
You can always agree for an interview on a condition of receiving final draft before it gets published and having a say on it. Whether they agree or not depends on how many other sources they have for that story.
265.
by aj3 6y ago
Would it be worthwhile to create an index where people that are experts in something could vouch for the journalists that seem to know what they're talking about? E.g. I can verify that on the information security topic Joseph Cox from
266.
by aj3 6y ago
If they current pcs cant run electron, they likely can't run latest office either. It's probably still the age of win7 there, might be 32bit as well. With ancient Acrobat reader as well. This has everything to do with security. Th
267.
by aj3 6y ago
If previous incidents have taught us anything, it's that taxpayers should buy free credit monitoring to everyone affected by the leak and be done with it. Maybe throw in $10 to anyone that can prove they suffered losses as a direct res
268.
by aj3 6y ago
> To clarify, I am literally asking for a simplified threat model. That's a simplification beyond any usefulness. You wouldn't be able to do as much damage with $100k budget in a few months as a well-staffed national agency in
269.
by aj3 6y ago
> Using that reading, which may be mistaken, I concluded that it is non-targeted. That's a wrong reading. The attackers were specifically targeting Coinbase employees although there were some instances where people with the same nam
270.
by aj3 6y ago
> I disagree that any particular infosec organization is equipped to deal with problems of this class in any meaningful way. FAANGs are bigger targets and yet none of them suffered anything remotely similar. > An attack, able to do $3

More ›