iancarroll

8 ms·

61.
by iancarroll 3y ago
This exists but isn’t really documented, we pay ~$1k/mo for a “light” enterprise version of Cloudflare.
62.
by iancarroll 3y ago
They have been taking it seriously although they didn’t have any sort of formal bug bounty / security disclosure method at the time. The disclosure timeline is in our article as well!
63.
by iancarroll 3y ago
Our understanding is that the magnetic stripe version of Saflok (which indeed predates MIFARE Classic) is vulnerable to the same issues, just in a different card format.
64.
by iancarroll 3y ago
Our disclosure mentions how to try and detect a vulnerable hotel, but it’s not possible to patch the lock yourself.
65.
by iancarroll 3y ago
I worked on this research along with many others, happy to answer any questions! Our disclosure is also available at https://unsaflok.com .
66.
by iancarroll 3y ago
I believe the flow in the diagram is what Steam calls Session Tickets and is a bit more nuanced. The game client requests session tickets from Steam's server, then it provides the game server with a ticket proving they are a given Stea
67.
by iancarroll 3y ago
Half of the point of these scripts is to detect headless browsers. Most of them are fairly obvious, and even when they’re hidden, it’s things like what the article mentions that gives them away. For example, headless browsers can’t respond
68.
by iancarroll 3y ago
Payment cards aren’t transferred to Apple Watch automatically. The enrollment process occurs again and the watch receives its own unique card number. The iPhone does allow you to initiate the enrollment for your Apple Watch without entering
69.
by iancarroll 3y ago
One of the main reasons I pay for AppleCare is to use the Express Replacement Service[0]. They will overnight a new iPhone to you while you keep the old one, then you can transfer your data to the new one and safely wipe the old one before
70.
by iancarroll 3y ago
> Note: Currently, all Cloud HSM devices are manufactured by Marvell (formerly Cavium). "Cavium" and "HSM manufacturer" are currently interchangeable in this topic. https://cloud.google.com/kms/do
71.
by iancarroll 3y ago
Interestingly it’s $599 USD or 699 EUR, wonder why it’s more expensive in Europe.
72.
by iancarroll 3y ago
Fly bandwidth pricing is pretty competitive; if bandwidth is an issue your bill will be cheaper on Fly than most other providers.
73.
by iancarroll 3y ago
I have seen companies pass audits with just XProtect, but I think it highly depends on your auditor and the wording you use to justify it.
74.
by iancarroll 3y ago
I’m pretty sure FedNow launched with RFP support.
75.
by iancarroll 3y ago
The scooter company was well aware of it as I told them about that + several other issues immediately. :)
76.
by iancarroll 3y ago
This is unfortunately a very common issue with Firebase apps. Since the client is writing directly to the database, usually authorization is forgotten and the client is trusted to only write to their own objects. A long time ago I was able
77.
by iancarroll 3y ago
What’s weird is it sounds like this is really Revolut’s problem, or at least the cash is being withdrawn from Revolut accounts. Instant access to bank transfers, where i.e. a brokerage loans you money while ACH clears, is a pretty common fe
78.
by iancarroll 3y ago
The article mentions at least 2 million Ethereum, which is certainly liquid enough to be a couple orders of magnitude above $10 million.
79.
by iancarroll 3y ago
It is a pretty well-documented strategy that has been done several times: https://en.m.wikipedia.org/wiki/Texas_two-step_bankruptcy Not sure why you are treating it as an absurd concept.
80.
Hacking root EPP servers to take control of zones(hackcompute.com)
159 points by iancarroll 3y ago|26 comments
81.
by iancarroll 3y ago
PACE authenticates that the reader knows the MRZ data and derives a key for communication, but (AFAIK) does not prove the passport is real or original. A cloned passport would also know the MRZ data to complete BAC/PACE. There is a fur
82.
by iancarroll 3y ago
For a while, 34% of legitimate passports were issued with invalid signatures due to various mistakes during manufacturing. This made signature verification practically useless at the border as many legitimate passports would fail validation
83.
by iancarroll 3y ago
You will not get the same level of support from Google as you will from a vendor dedicated to this. Ironically, HBO Max is the main case study on reCAPTCHA Enterprise's landing page, which I guess did not work out for exactly this reas
84.
by iancarroll 3y ago
Unfortunately, Arkose is one of the only viable products for stopping credential stuffing and other similar attacks. It has been implemented at several companies I've worked at because there are just not enough alternatives. The main v
85.
by iancarroll 3y ago
> Casinos are required to display the current payout rate on any and all slot machines. No, they aren’t, at least in Nevada. Some states make the whole casino disclose its average “return to player” metric though.
86.
by iancarroll 3y ago
When the betting and cash in/out process is handled entirely digitally... surely the dice roll is about the only thing the dealer is even handling? I just don't understand how they don't notice the lack of them rolling.
87.
by iancarroll 3y ago
It seems strange that it wasn't noticed? The mentioned game is meant to have fewer dealers operating it, but it says pretty explicitly that it should be supervised and have >=1 dealer. https://aruzegaming.com/table-g
88.
by iancarroll 3y ago
Yeah, this "contact sales" threshold is pretty absurd. Presumably this is targeting B2C apps but who is going to bother with such a low number?
89.
by iancarroll 3y ago
Sounds like the original commenter had a reasonable case, but I just don’t think it’s likely to save anything for small sites on traditional stacks. If you are running on i.e. EC2 and RDS instances, you’re not saving anything by using 40% l
90.
by iancarroll 3y ago
How do you have costs that are directly attributable to scraping? Unless you are using a serverless platform that bills per request or your pages are large enough that egress bandwidth is expensive enough, I’m not convinced most sites would

More ›