dylz

45 ms·

181.
by dylz 6y ago
Is the goal here that you want to encrypt audio pre-device, so that you can run some kind of encryption on any phone you use, without having to trust that phone, and the person on the other end does the same thing?
182.
by dylz 6y ago
This is somewhat nonsensical, what are you trying to go for? Why not just E2E-encapsulate a VoIP packet/connection?
183.
by dylz 6y ago
Yes, but it won't allow GTM to load scripts off OTHER domains. It basically re-adds the requirement of engineering gating off 300 different adtech trackers.
184.
by dylz 6y ago
What do you mean makes no difference? Microsoft runs Yahoo/Bing Ad Network, an Adsense competitor, plus serves ads and telemetry all over.
185.
by dylz 6y ago
It does functionally result in not being able to extract the entirety of the password from the database though (think SQLI SELECT back), correct me if I'm wrong
186.
by dylz 6y ago
yep, I see this type of behaviour constantly - faked prices for Gbot, fake prices on Cache, significantly higher price for end user. It's also infuriating to sort by price and get inflated fake shipping prices to "make up the tota
187.
by dylz 6y ago
The other problem is shipping a crypto library if the entire page and script is not served over HTTPS means that it's no longer useful, because the crypto library is compromised.
188.
by dylz 6y ago
I pretty much refuse to support Samsung for any consumer device at this point. Their TVs are loaded with spyware and push notifications, full screen ads, menu ads, all unremovable. You pay thousands for the privilege of this garbage. All of
189.
by dylz 6y ago
You can no longer do webcrypto because the initial page is compromised. Self signed HTTPS works for this case as long as you know the fingerprint/cert to accept.
190.
by dylz 6y ago
Also responsible for the WoSign CA distrust
191.
by dylz 6y ago
It's completely unbearable without one. I have thousands of manually added domains as malicious ad providers and invasive, abusive scripts try to bypass adblock too.
192.
by dylz 6y ago
They continue to attempt to try to associate your connections/use dns cookies. CtrlF 'pixel' when you are visiting one of their pages (not frontpage) They also attempt to correlate .onion traffic.
193.
by dylz 6y ago
FYI if you block this notification (it requires the script tag to load and you to click an I AGREE TO PAY PER GB bullshit thing), you can no longer do UDP traffic and your TCP connections start getting reset. I found this out the hard way,
194.
by dylz 6y ago
archive.is _intentionally_ is blocking Cloudflare for not letting them track users. See https://news.ycombinator.com/item?id=21308564 and https://news.ycombinator.com/item?id=23316085
195.
by dylz 6y ago
They do quite a bit worse on top of that, ctrl-f pixel.archive.is in view source when you visit any archived page.
196.
by dylz 6y ago
They don't use non-standard records; if your resolver protects your privacy by not sending them your IP, they will intentionally return bad records specifically to fuck with you.
197.
by dylz 6y ago
There's no magic, it's just an A record
198.
by dylz 6y ago
- may be against tos - everything is logged - ALL web traffic, no https - all of it is logged, decrypted and reencrypted - anything you type in is liable to be keylogged
199.
by dylz 6y ago
A large part of the world (China) runs their own app stores for Android.
200.
by dylz 6y ago
I am one of them - Snap is generally not a "browse forever nonstop" engagement tool that's typical and standard behaviour for TikTok/FB/IG, it's actually somewhat used as a messaging tool (not that it precludes
201.
by dylz 6y ago
Snap is not usually something the user scrolls through all day (akin to FB/Insta infinite scroll); it's typically send a message or nude/recieve a message or nude and then backgrounded. There is a rare case where people watch
202.
by dylz 6y ago
> It implies that are entire teams of engineers out there whose sole job it is to play cat&mouse with reverse engineers and nothing more Do you think the same thing of anti-spam teams too? This is pretty much just anti-spam/anti
203.
by dylz 6y ago
I've seen this for _years_ already - it might also be because of a bit of an app usage difference, where the people that typically do these writeups or browse HN don't install the shitware on the app stores that do these things, e
204.
by dylz 6y ago
Because not so clearly fake users still make it through. The server side is also fairly quick on the trigger if you accidentally send anything that doesn't make sense, you're kicked off to "re-verification land"
205.
by dylz 6y ago
It hasn't in the US. Comcast's 1G down is still 10Mbit up
206.
by dylz 6y ago
Do those even matter if the final file destination is S3?
207.
by dylz 6y ago
You have no guarantee that the server won't just "if (ip === companyName) { don't serve CSP + serve infiltrated JS }" in the future.
208.
by dylz 6y ago
You can't be assured that they will send that CSP header or meta tag with every request, either. If your threat model includes this, might as well save the page locally.
209.
by dylz 6y ago
This is almost certainly guaranteed to be either monetization of botnets, or inadvertently installed adware.
210.
by dylz 6y ago
- Sites that do single sign on: your email domain is 'corp.example.com'? -> redirect to your org's sign in page. - Mandatory 2FA/etc

More ›