lxgr

5 ms·

61.
by lxgr 1mo ago
It also sounds pretty useful for anyone involved in a lawsuit to be able to present photographic evidence again. I’m sure GenAI is already a big headache for forensics, and enforcing AI watermarks will clearly not be bulletproof.
62.
by lxgr 1mo ago
Yes, if your adversary can generate a high-fidelity 3D moving replica of a scene, they can deceive you that it’s real. But can they really?
63.
by lxgr 1mo ago
Then take and sign a one-second video and you’re adding a few orders of magnitude of complexity again.
64.
by lxgr 1mo ago
How would the server know that the request is coming from a real iPhone? This is a pretty standard application of trusted computing and can be done entirely on the iPhone. A server would only possibly be needed for anonymization (while reta
65.
by lxgr 1mo ago
I can definitely see that it would look like that – if stakeholders wanted to. On that, I’m not convinced at all, for these reasons: Banks earn money on card payments and pay (or potentially even lose, due to fraud liability) money on ACH a
66.
by lxgr 1mo ago
That’s a list of news articles (notably none about SEPA Instant, the closest analogy to FedNow!), not a response to my point. It actually supports my point: FedNow could be SEPA Instant (if it were to be widely supported and available to re
67.
by lxgr 1mo ago
FedNow is a payments rail, which is a long shot away from being a full retail payments scheme. The latter needs a disputes story, customer knowledge, merchant acceptance… Take SEPA Instant, for example. It’s great for many things, but effec
68.
by lxgr 1mo ago
> So the article shows how visa and mastercard are, by far, not the ones taking the largest fee But they set the interchange rates and disallow (or at least have until recently, in the US) merchants to discriminate against cards based on
69.
by lxgr 1mo ago
Many more restaurants and grocery stores don’t, and then it’s 2-5% of cashback vs. 0% cash discount. Doesn’t sound like a rounding error to me. There are a lot of good reasons to dislike the market structure and game theory of card payments
70.
by lxgr 1mo ago
Cards have supported strong, positive cardholder authentication at the POS (chip and PIN) and online (3DS) since the 90s. It’s entirely the US credit card industry and its regulating bodies’ fault that it has made neither mandatory in the w
71.
by lxgr 1mo ago
Except that you have strong statutory rights and commercial agreements between your bank and the card networks making it very likely that you’ll be made whole.
72.
by lxgr 1mo ago
I don’t thing Regulation E allows banks to require a police report before processing an unauthorized payment, nor can they outright refuse to do so. Practically, Reg E is essentially as strong as Reg Z.
73.
by lxgr 1mo ago
What even is an “eCheck”? I keep hearing that word but haven’t found a sane definition. Is it just a weird term for an ACH debit transfer?
74.
by lxgr 1mo ago
It’s not just community banks or credit unions. The cap is $10 billion in assets. There’s a whole industry of mid-sized banks just below that which are offering their services as sponsor banks to fintechs that want to earn the orders of mag
75.
by lxgr 1mo ago
Being unethical is, for better or worse, not automatically illegal. Saying that your product provides end-to-end encryption and you can't access message content and then intentionally shipping a backdoor (for your own benefit and not,
76.
by lxgr 1mo ago
This is indeed a common vector of privacy leaks on either the recipient side (to the sender, in this case, if they operate the target of the link for which a preview is being rendered) or to the platform provider (if the preview is rendered
77.
by lxgr 1mo ago
Publicly stating to not have access to message contents yet doing otherwise, i.e. outright deception, doesn't seem like something you can EULA your way out of in most jurisdictions. Beyond that, the GDPR and similar laws also impose li
78.
by lxgr 1mo ago
> Most security researchers lack Meta's history: [...] Why would you assume that security researchers don't know about these? If anything, wouldn't all the bad press and scandals make WhatsApp a more likely target of scrut
79.
by lxgr 1mo ago
Sure, but so is every security researcher in the world if they want to be, and they only need to get caught shipping exfiltration logic once.
80.
by lxgr 1mo ago
They currently go on iCloud on iOS and Google Drive on Android. There are rumors about a first-party backup service, which would obviously change that calculus, but nothing concrete yet.
81.
by lxgr 1mo ago
They only need to get caught doing it once to have a gigantic lawsuit on their hands. They could possibly pull it off very selectively, but doing it in a dragnet fashion seems incredibly risky.
82.
by lxgr 1mo ago
> - backups are not encrypted by default so plaintext of your private chats can be obtained Yes, but importantly not by Meta themselves. > - Meta data of your messages is not encrypted so meta can make a graph of who you talk to and w
83.
by lxgr 1mo ago
And has a verdict been reached? Otherwise, people are pursuing all kinds of outlandish claims legally.
84.
by lxgr 1mo ago
Slightly different lens, same outcome: It's there, it lets people do what they want to do with acceptable effort/other negative consequences, so they use it.
85.
by lxgr 1mo ago
WhatsApp is end-to-end encrypted, so I'm not trusting Meta with much, and it's the only way I can reach quite a lot of people. A lot of people I know trust them begrudgingly (primarily with Instagram, because all of their friends
86.
by lxgr 1mo ago
Also to do DDoS mitigation. Being able to see the HTTP request, at least headers and path, greatly helps with distinguishing attackers from legitimate traffic. It's a tragedy that there's no standard to allow partial decryption&#x
87.
by lxgr 1mo ago
I don't have any personal experience with them, but Amazon and Google are full of options going up to 30m. I don't see why they shouldn't work; all the translation logic is in the active circuitry at each end, and the low-lev
88.
by lxgr 1mo ago
USB 4/Thunderbolt explicitly supports fiberoptics-based USB-C cables and can carry 4K video, regular USB, and more.
89.
by lxgr 1mo ago
If you're working with agents that severely misaligned you'll probably have issues way beyond fake tests.
90.
by lxgr 1mo ago
They could also use something like Amazon Sidewalk or ATSC 3.0's dedicated return channel.

More ›