mjg59

30 ms·

481.
by mjg59 3y ago
The Play Store has cert pinning, so this all works just fine in the scenario you're describing.
482.
by mjg59 3y ago
Once you've got a 70 day old browser you're just waiting for it to hit one domain you can MITM or serve content from and then you've got arbitrary code execution and who cares whether dnssec is involved or not. Attacking CT i
483.
by mjg59 3y ago
Ok. That's an argument you can make. Now go back and make that in the first place rather than diverting everyone down an incredibly tedious demonstration of you making assertive statements that are just factually wrong. There's sp
484.
by mjg59 3y ago
You're moving the goalposts to a ridiculous degree. Chrome will be incredibly angry at you if you haven't updated in 70 days. How will a smart TV behave? I've no idea. It's probably not paying any attention to dnssec (
485.
by mjg59 3y ago
This is why multiple SCT entries are required. Could you subvert all of this with enough effort? Yes, and the same is true of dnssec. Any form of cryptographic validation is only as secure as the control of its private keys, but modern TLS
486.
by mjg59 3y ago
Because they don't have access to the private key material owned by the CT logs that the browsers trust when validating SCT data in the certificate.
487.
by mjg59 3y ago
Most browsers will reject such a certificate. See https://googlechrome.github.io/CertificateTransparency/ct_po... for the policy Chrome imposes - my understanding is that Safari is broadly similar. Right now I don&#x27
488.
by mjg59 3y ago
No, because the presented certificate won't have any SCT entries (which are embedded in the certificate), and you can't fake the SCT entries without having access to the CT private keys.
489.
by mjg59 3y ago
Wikipedia currently shows me the version with the white disk in the papal tiara, which the article asserts is the correct one. https://commons.wikimedia.org/wiki/File:Flag_of_the_Vatican_... suggests it's been tha
490.
by mjg59 3y ago
Let me preface this by saying that I've had some fairly high profile criticism of patches I've been involved with: https://arstechnica.com/information-technology/2013/02/linus... Having people criti
491.
by mjg59 3y ago
Oh wow - I built something very like this at university so people could run Linux on their Windows systems (this was way before hardware virtualisation support was a thing). It created a file on the Windows filesystem that would be used as
492.
by mjg59 3y ago
The in-kernel loader can't defer loading if, say, a module is loaded before the firmware is available. Instead it can be handled in userland - the kernel generates a request when it wants firmware, and the userland hotplug agent can sa
493.
by mjg59 3y ago
If you're already fitting a kernel on a 1.44MB floppy, you've got enough space to append a tiny cpio with a static binary that makes a few syscalls.
494.
by mjg59 3y ago
The kernel has no idea about /lib (unless you're using the in-kernel firmware loader, which you really shouldn't be) - the rtdl path is present in every ELF object that depends on it, so the "kernel tweak" would be
495.
by mjg59 3y ago
That remains a supported configuration, you just need an initramfs that mounts /usr before transitioning into the real /.
496.
by mjg59 3y ago
Twitter's a terrible choice for that use case, since the metadata isn't encrypted and you can't create an account without tying it to something else.
497.
by mjg59 3y ago
It's an improvement over the status-quo. But given what was communicated before the feature was launched, it's very easy to believe that users might believe that the expectations around privacy and security are stronger than they
498.
by mjg59 3y ago
It's actually plausible to audit the app for backdoor mechanisms, even without access to the source code. Right now there's no indication of one being present. I'm very very much not a fan of Elon, but in terms of the dispari
499.
by mjg59 3y ago
> This is technically wrong or badly worded Could you explain why? > Is it just saying since you run their software on your device they could steal your private key? No. It's saying that because there's no indication of whic
500.
by mjg59 3y ago
For anyone who's interested in a technical writeup of the implementation, I did one here: https://mjg59.dreamwidth.org/66791.html . There's code in the iOS app that would mitigate the MITM issue, but would also re
501.
by mjg59 3y ago
Those are board that MSI OEMed for other vendors.
502.
by mjg59 3y ago
If the target doesn't have BootGuard, you replace the firmware with one that pretends that Secure Boot is enabled even if it isn't and Bitlocker is unaware anything's changed.
503.
by mjg59 3y ago
Secure Boot configuration is usually stored in flash, not battery-backed CMOS, so on most boards won't be wiped if you simply remove the battery. But if you do have physical access you can simply rewrite that variable in flash to disab
504.
by mjg59 3y ago
Then you don't need a jumper - you can trust the firmware to impose any policy you've set (re-flashing firmware is mediated by the firmware, so you can just have a setup option that lets you choose which signing keys are trusted)
505.
by mjg59 3y ago
The freedom to choose which software runs on your computer is also the freedom to choose that certain software shouldn't run on your computer. The freedom to make that decision should be left up to the individuals rather than being i
506.
by mjg59 3y ago
No, because the entire point of this is to be resilient against physical attack - anyone re-flashing your firmware already has your case open and can just move the jumper while they're at it.
507.
by mjg59 3y ago
Nothing's prevented you from reading the firmware - this is a signing key, not an encryption key. Multiple people have spent time reverse engineering the ME firmware, people have found bugs but no evidence of a backdoor.
508.
by mjg59 3y ago
The pervasiveness of secure boot has genuinely made things difficult for attackers - there'd have been no reason for the Black Lotus bootkit to jump through all the hoops it did if it weren't for secure boot, and the implementatio
509.
by mjg59 3y ago
I started digging into this because that's basically the sort of person I am, and hit https://ibcs-us.sourceforge.io/ which implements iBCS2 in userland, including a COFF loader. In theory, with that you should be able
510.
by mjg59 3y ago
iBCS2 - https://www.linuxjournal.com/article/2809 . As another comment indicated, this worked as the syscall layer rather than at the library layer, so the kernel would translate the expected responses - but this meant

More ›