dlenski

12 ms·

151.
by dlenski 8mo ago
> Another related theory I’ve seen online is that Cape is a honeypot for law enforcement. Cape is not a honeypot. It’s so hard to prove a negative, but at least I can say it clearly and out loud: Cape is not a honeypot. I'm sure you
152.
by dlenski 8mo ago
> They built their own mobile core, does that help with resolving your "Big If"? Not really, but I too am uncertain about how to think about it. Here's my long-winded but still limited understanding of the main vulnerabili
153.
by dlenski 8mo ago
> Baseband vulnerabilities are overhyped, imo. On proper phones (eg. pixels), their access to memory is restricted by IOMMU, which protects the rest of the phone from being compromised if there's some sort of an exploit. Doesn'
154.
by dlenski 8mo ago
VoIP.ms works great in both the US and Canada. (I believe it started here in Canada.) Also, many Canadian financial institutions (including the CRA, Wealthsimple, and BMO) work fine with US phone numbers for 2FA… including Google Voice, in
155.
by dlenski 8mo ago
It stymies attempts to track mobile devices over multi-day periods using their IMSIs. Trackability is definitely a vulnerability.
156.
by dlenski 8mo ago
I've used my Google Voice number as my primary number for ~15 years at this point. (I use my "real" phone number so little that I have trouble remembering it.) I've had almost no problems using my GV number for 2FA. Venm
157.
by dlenski 8mo ago
From their "Features" drop-down: > Minimal Data Collection > Identifier Rotation > Secondary Numbers > Disappearing Call Logs > SIM Swap Protection > Network Lock > Encrypted Voicemail > Private Payment &gt
158.
by dlenski 8mo ago
> it's probably a good thing to have domestic advanced manufacturing if only to have real-world testbeds for development of advanced automation technology. Yes, it's a good thing to have domestic advanced manufacturing, but thi
159.
by dlenski 8mo ago
> They will agree to make some high margin simple to assemble thing in the US to appease government They'll also hold a ribbon-cutting ceremony with maximum fanfare , at which they'll be sure to fawn over Donald Trump, let him
160.
by dlenski 8mo ago
It's "socializing the losses and privatizing the gains"… but now alarmingly supercharged well beyond purely financial realms, and into really basic and fundamental matters of individual physical autonomy and liberty.
161.
by dlenski 8mo ago
Quite ironically, they do install a unique TLS cert and key on each thermostat, although it's done on first-wifi-connection of each thermostat, rather than pre-installed at the factory. And then the thermostat uses those keys to mu
162.
by dlenski 8mo ago
> The dishwasher at my office has WiFi. At one of the AWS builds I worked at there was a water dispenser. It had one button to dispense cold still water, one for fizzy, one for hot water, etc. Instead of JUST PRESSING THE BUTTON WITH YOU
163.
by dlenski 8mo ago
> Why can't I pay to express my consumer preferences? Why must I deliberately buy broken stuff and fix it myself? I guess it comes down to "market failure." Many people would probably say that they care about security&#x
164.
by dlenski 8mo ago
> But it just occurred to me reading this that if there's a similar vulnerability in HVAC system controls an attacker could cause one hell of an unanticipated power demand spike. Absolutely. This was one of the things I realized cou
165.
by dlenski 8mo ago
> A 51 straight weeks of 70 degree temperate followed by a week > 70 might imply they're on vacation. People who turn down the heat/ac and turn it back on when they come home from work is also a pattern pretty apparent by th
166.
by dlenski 8mo ago
> he soon discovered that the same credentials that allowed him to see and control his own device also provided access to live camera feeds, microphone audio, maps, and status data from nearly 7,000 other vacuums across 24 countries. Thi
167.
by dlenski 8mo ago
Are they _so much_ cheaper to run that they could be used to initiate thousands of "human-like" interactions at negligible costs compared to what the interlocutors will incur? (I genuinely don't know )
168.
by dlenski 8mo ago
> how about building a tool that doesn't exploit bugs or bypass auth, but behaves like an overly engaged, perfectly valid user? How would this loquacious chatbot interlocutor work, if not by running a chatbot itself? Is there some w
169.
by dlenski 8mo ago
…? TSMC already does make a huge amount of money off of being the indispensable fab for all of Apple's latest-and-greatest chips. Each time TSMC launches a new or incrementally-improved manufacturing process, Apple's latest Ax SoC
170.
by dlenski 8mo ago
> Either they make ISA license fees much higher (risk losing customers to RISCV) If ARM goes down this path, it'll be a classic “innovator's dilemma” cycle leading to disruption. ARM is clearly the superior incumbent technology
171.
by dlenski 8mo ago
Yes. An excerpt from my initial email to Mysa's security contact… > I stumbled upon these vulnerabilities on one of the coldest days of this winter in Vancouver. An attacker using them could have disabled all Mysa-connected heaters
172.
by dlenski 8mo ago
MQTT is a very simple pub/sub messaging protocol. It's used in a enormous number of IoT devices. The "IoT gateway" service from AWS supports MQTT and a whole lot of IoT devices are tethered to this service specifically.
173.
by dlenski 8mo ago
I discovered a very similar vulnerability in Mysa smart thermostats a year ago, also involving MQTT, and also allowing me to view and control anyone's thermostat anywhere in the world: https://news.ycombinator.com/i
174.
by dlenski 9mo ago
> These fake “going out of business ads” have been around for a few years, There was an extremely funny and interesting Canadaland podcast about these, wherein Canadaland's founder Jesse Brown bought an "elegant men's card
175.
by dlenski 9mo ago
> I would highly recommend anyone into bicycles to try building their own wheel using his article. Hear, hear. It's an incredible resource. I got into building and fixing bikes around 2004, and built a couple of fixed-gear bikes on
176.
by dlenski 9mo ago
Thank you!
177.
by dlenski 9mo ago
> OP here Can you clear up the confusion as to whether or not the earlier user named 'gyrovague' is operated by you as well? (There was some suspicion on the earlier thread that it might not be you.) https://news.y
178.
by dlenski 9mo ago
Agreed. I truly don't understand including these researchers on this list. Some of Sweeney's most well-known work in this area is from the LATE 1990s. She was sounding the alarm about problems with anonymized data in medical dat
179.
by dlenski 9mo ago
https://ztechtalk.com/microsoft-teams#:~:text=obviously%2C%2... Add this to the infinite list of reasons why I don't put company-issued spyware on my personal devices. If Slack/Teams/Outlook/whatever wan
180.
by dlenski 10mo ago
How do these tens of thousands of Starlink terminals get smuggled into Iran?

More ›