kyboren

46 ms·

451.
by kyboren 12y ago
@xnull: interesting, my download of that file has slightly different text: The device’s unique ID (UID) and a device group ID (GID) are AES 256-bit keys *fused* into the application processor during manufacturing. No software or firmw
452.
by kyboren 12y ago
Well, again, I can't be sure, and you can't verify without reverse engineering the chip. But that's not how PUFs work. The whole point of a "physical unclonable function" is that it's not just a set of bits
453.
by kyboren 12y ago
My impression of Apple's UID is that it's a physical unclonable function[1] whose output is directly connected to the key derivation circuitry. This means that there is, absent physically destructive attacks or side-channel vulne
454.
by kyboren 12y ago
Except in this case, it wouldn't be hard to stop people with angle grinders. The lock-maker just did a shitty job making the lock.
455.
by kyboren 12y ago
DNA tests are done by cotton swab of your 'live' cheek. Should they only be done on 'dead' dandruff? In any case, it should be pretty easy to recreate a sufficiently-convincing fake finger given an ink fingerprint. But
456.
by kyboren 12y ago
I can't attest to the security, but "NFC Passport Reader" (nl.novay.nfcpassportreader) worked for me. I might have an old version, but my apk is 1595338 bytes and has SHA256 274f77b0d3da9280c1e728cc53c9348d9454e7f255dcf37e6df
457.
by kyboren 12y ago
You can cryptographically verify any biometric passport (all Visa Waiver Program countries have them) and most European ID cards with any NFC-capable Android smartphone. They include the holder's name and picture and are signed by the
458.
by kyboren 12y ago
...and with access to your contacts, precise (GPS) location, nearby WiFi access points, camera, phone number, the ability to silently install packages (!) and prevent sleep, and with full network access[1]. Yup, just what the world needs. [
459.
by kyboren 12y ago
It seems they decided to skimp on hiring a web design firm and their marketing department thought they could spin it to seem 'hip'. Idiots.
460.
by kyboren 12y ago
Sure, but it only takes one avoidable mistake to bring it all crashing down. Want to bet the rest of your life on being perfect? In any case, it was a (half) joke. But yes, it reminds me of the hilarity of FBI's characterization of P
461.
by kyboren 12y ago
While this is certainly better than not doing so, if one is going to run such a hidden service in flagrant violation of the law, it seems prudent to take all feasible precautions--and maybe some unfeasible ones, too. 1) Run the HTTP server
462.
by kyboren 12y ago
http://www.theregister.co.uk/2013/07/08/snowden_us_israel_st...
463.
by kyboren 12y ago
IME the most reliable way to do this is with a udev rule. Here's my setup (Fedora, so YMMV). /etc/udev/rules.d/51-macchanger.sh: SUBSYSTEM=="net", ACTION=="add", DRIVERS=="iwlwifi&quot
464.
by kyboren 12y ago
http://imgur.com/ZvdGn60
465.
by kyboren 12y ago
Perhaps it's because the people of Oman deserve to know what secret endeavors their government allows in their name. Perhaps it's because the people of the UK deserve to know what secret endeavors their government embarks on in th
466.
by kyboren 12y ago
I think most of us understand the motivation. The problem isn't really that they're inconveniencing "expert" users with a 'one size fits all' approach. The problem is that they recognize a possible security con
467.
by kyboren 13y ago
15:44 - I love the irony of watching Willy say that on YouTube.
468.
by kyboren 13y ago
I don't see why not in theory, but in practice GRUB2 is the only available option out-of-the-box. I'm curious why you're so interested in this, though. Care to explain your ostensible desire for an alternative bootloader?
469.
by kyboren 13y ago
That's a neat idea; I'd like to have that. Please really consider contributing some code, or at least an initial proposal on the qubes-devel list :).
470.
by kyboren 13y ago
GRUB2, and optionally tboot for "anti evil-maid" ( http://theinvisiblethings.blogspot.com/2011/09/anti-evil-mai... ).
471.
by kyboren 13y ago
I've been using Qubes every day for well over a year now, and I know enough about the architecture to dispel a few of these assumptions. 1. By default, there is no need for an attacker to find a local exploit to get root--the user acco
472.
by kyboren 13y ago
Some day, people will wake up and realize that all aggregation of data on citizens and consumers–including implicit aggregation, where information is only transiently collected–by governments, data brokers, retailers, or anyone else only
473.
by kyboren 13y ago
That's fair, but it is still possible to find something closer. And a 1hr commute is a lot different stuck in traffic on the 680 or 101 than working on your laptop in a train.
474.
by kyboren 13y ago
I moved from California to Lausanne and I highly recommend it. Quality of life is truly outstanding, and the high level of infrastructure development makes living here very convenient. The biggest problem is, as the article gently suggests
475.
by kyboren 13y ago
> I felt left out because my little country did not matter. The truth is that you really don't matter to American politicians, and American politicians are (ostensibly) the only ones who wield power over the NSA. Our politicians do
476.
by kyboren 13y ago
Mass surveillance creates a chilling effect on free speech; it causes people to self-censor. It's just as effective at censorship as requiring a license to print a newspaper--something our Bill of Rights was explicitly designed to avoi
477.
by kyboren 13y ago
I do not know about a FAQ, but this document describes what I mentioned: https://gitweb.torproject.org/torspec.git?a=blob_plain;hb=HE... (read the section "1. Outline"). There is a small set (say, around 5-1
478.
by kyboren 13y ago
But an observer who can see traffic between most Tor nodes doesn't need to run Tor relays to do attack scenario 2). I'm not sure how far that gets you, though. Maybe 2) in combination with just a few honeypot nodes would be most
479.
by kyboren 13y ago
Agreed. As I wrote in another thread: > I also do not think their claims of Tor subversion hold water. From what I understand of Tor, directory information (including nodes' key fingerprints) is ultimately verified by the hard-code
480.
by kyboren 13y ago
I also have my concerns with this. Even if BT or GCHQ/NSA were altering routing tables, it doesn't really change the threat model of "assume Internet connections will be MITM'd". It does concern me that it appear

More ›