ge0rg

93 ms·

421.
by ge0rg 13y ago
To clarify the issue: I performed the following steps: 1. created a CA key+cert (selfsigned) 2. created a keypair K 3. signed the public key of K with the CA 4. uploaded the CA-signed cert and the private key of K --> "Your Certific
422.
by ge0rg 13y ago
I just tested the form with a key+cert pair I created for this sole purpose. It actually performs as advertised - it checks if key and cert belong together.
423.
by ge0rg 13y ago
This is brilliant. Now, instead of using random quotes, please take the IMDB quotes and make anigifs of them :)
424.
by ge0rg 13y ago
With the advent of SDR, such attacks are becoming easier to accomplish and also come into the focus of IT (security) researches. There is already an OSS AIS decoder [1], and I suppose it will not be too hard to make an en coder. Still, we
425.
by ge0rg 13y ago
I wish they stopped forcing touchscreens on their users. I would so buy a Haswell-based follow-up to the Asus Zenbook UX51VZ as a developer machine, but having fingerprints on a glossy display is a showstopper for me.
426.
by ge0rg 13y ago
This is something that striked me as missing in the Lavabit key warrant discussion: was Forward Secrecy merely an option on the server before the shutdown, or was it enforced on all connections, regardless of client support? If not all conn
427.
by ge0rg 13y ago
The N.S.A.'s Sigint Enabling Project is a $250 million-a-year program that works with Internet companies to weaken privacy by inserting back doors into encryption products. From http://www.nytimes.com/interactive&#x2F
428.
by ge0rg 13y ago
You are right, the final choice of the algorithm is with the server. I am not sure though if it is possible to give other ciphers a higher priority on the server without completely disabling RC4 (which is still better than no encryption &#x
429.
by ge0rg 13y ago
Thank you for the insight. It is good to get some more details on how broken it is. I will add a clarification regarding MD5 to the article. Sorry about my alarmist tone - from time to time I need to get rid of my conspiracy theories.
430.
by ge0rg 13y ago
I will be adding advices from the discussion here, so feel free to comment! :)
431.
Why Android SSL was downgraded from AES256-SHA to RC4-MD5 in late 2010(op-co.de)
365 points by ge0rg 13y ago|86 comments
432.
Instagram HTTP API call authentication done wrong(rt-solutions.de)
1 points by ge0rg 13y ago|0 comments
433.
by ge0rg 13y ago
On Android, top-down is used to open the Notifications (where new messages and other pieces of info come in), and starting with some 4.x release, bottom-up opens Google search / Google Now for you.
434.
Researchers develop acoustic based data transfer system for phones(computerworld.com.au)
2 points by ge0rg 13y ago|1 comments
435.
A Material That Could Make Solar Power “Dirt Cheap”(technologyreview.com)
2 points by ge0rg 13y ago|0 comments
436.
by ge0rg 13y ago
If they could shut down all of these niche secure email businesses, what option will people have but to use less private alternatives? I think Ladar Levison answered that question, implicitly, in his shutdown announcement: "I would _
437.
by ge0rg 13y ago
Correct. I created a tcpdump trace on my OpenWrt router and then opened it in Wireshark. The HTTP request was easy to spot from there.
438.
by ge0rg 13y ago
Ok, the app's web service is rather prone to manipulation: You just need to HTTP GET the following URL: http://www.carrotpop.com/smth/php/save_result.php?id=<UID>&nickname=<NICK>&count
439.
by ge0rg 13y ago
The current high score is 43.16m - I wonder if somebody found a way to cheat, or if they really really do not care about the wellbeing of their smartphone.
440.
by ge0rg 13y ago
It's a neat idea, and it exploits human psychology in clever ways. I like how the reward for tweeting increases as the number of views remaining goes down. Interesting, my reaction was the total opposite of yours - I immediately star
441.
Swiftkey (Android keyboard) now with cloud sync - what could possibly go wrong?(swiftkey.net)
1 points by ge0rg 13y ago|0 comments
442.
Will Ubuntu Edge commit to using only free software?(fsf.org)
36 points by ge0rg 13y ago|55 comments
443.
by ge0rg 13y ago
You are right with respect to the Google-sold devices. Unfortunately, these are only a minority - and this step will make it significantly harder to root devices made by Samsung, HTC, Sony and all the others...
444.
by ge0rg 13y ago
Yes, but storing "supports HTTP2" for a given server for a given time after connecting to that server and negotiating the upgrade would also do the job. One of the problems with HTTP 1.x is that it is stateless - every time you wa
445.
by ge0rg 13y ago
I really disliked the following part: A client MAY immediately send HTTP/2.0 frames to a server that is known to support HTTP/2.0, after the connection header. [..] Prior support for HTTP/2.0 is not a strong signal that a gi
446.
by ge0rg 13y ago
There is additional hash checking indeed. Google Play will fail to install an APK you MitM to the app. Edit: the hash checking is done in addition to the APK signature verification, i.e. you can not replace the APK with a different APK si
447.
A 4-Year-Old Android Bug Could Bring Malware to 99% of Devices(gizmodo.com)
1 points by ge0rg 13y ago|0 comments
448.
by ge0rg 13y ago
I consider the memory footprint even more important, though it is hard to find strong relations between APK size and memory use -- except for the "looks like the dev did not care at all" rule. Regarding APK size, you can do miracl
449.
by ge0rg 13y ago
Very impressive work, especially with the mobile integration! I hope this will become the next generation of multi-platform development tools, combining performance and flexibility. However, the Android demo apps are 16MB and 23MB in size,
450.
by ge0rg 13y ago
and the only way to ensure that all hideous perversions are submitted is... total surveillance!

More ›