not_that_noob

9 ms·

31.
by not_that_noob 8y ago
The flaw stems from the fact that an attacker can thru social engineeung acquire that root crendential (password or biometric or token). Once they have it, they can clean out all your banking, stock and home equity line accounts in one swee
32.
by not_that_noob 8y ago
That’s really the flaw of single sign-on and Webauthn - that one key now unlocks the kingdom.
33.
by not_that_noob 8y ago
A PIN is really a numeric password. It has all the same flaws - compromise risk (say via social engineering) and the risk of forgetting and needing it reset. So the ‘passwordless’ option here is either rename the password to PIN or eliminat
34.
by not_that_noob 8y ago
If anyone has doubts about UBI, consider the great A/B (or rather B/W?) experiment the government ran as part of the New Deal. One group was provided subsidies for housing (analogous to UBI) and another was not - decades later, th
35.
by not_that_noob 8y ago
So if a worker wanted a day off, all they had to do was think bad thoughts?
36.
by not_that_noob 8y ago
There is a potentially disastrous blow to FB's business model in the GDPR that relates to this sort of profiling. It is forbidden under GDPR, unless the user grants explicit consent (opt-in). See [1]. Without this, FB's targetin
37.
by not_that_noob 9y ago
This already happens - it's called spear phishing. Instead of wasting time with multiple users, the attacker picks a high-value target. For example, if you can get one admin, it's game over.
38.
by not_that_noob 9y ago
Not disagreeing. Note however that I'm talking about the authenticator. If that is compromised, then the attacker now has access to all keys.
39.
by not_that_noob 9y ago
It's the weakness of single-sign on - if the authenticator is compromised, then the attacker now has the key that controls access to all the keys.
40.
by not_that_noob 9y ago
If one link of the chain is broken, it's game over. While this is a good effort, my point is that not considering the entire system as a whole simply transfers problems from one part of the domain to another.
41.
by not_that_noob 9y ago
It doesn't actually. If the authenticator expects passwords, then this simply moves the problems you cite to another part of the system. These are the sources of compromises on the modern web. It's a neat system - but it doesn&#x2
42.
by not_that_noob 9y ago
That's a misconception - I don't see where this helps with phishing.
43.
by not_that_noob 9y ago
Attackers don't bother stealing physical tokens - way too hard. It's much easier to ask for token re-issue using compromised info. See for example https://www.techlicious.com/blog/phone-porting-scam-can-empt..
44.
by not_that_noob 9y ago
While I applaud the hard work the W3C group has put into this, and the excellent spec, I can't help but think that they are solving a problem that doesn't exist. Attackers are much more likely to assume a user's identity and
45.
Facebook may stop the data leaks, but it’s too late: CA’s models live on(technologyreview.com)
8 points by not_that_noob 9y ago|1 comments
46.
Mercer backed group worked with FB, Google to target anti-Muslim ads(opensecrets.org)
2 points by not_that_noob 9y ago|0 comments
47.
by not_that_noob 9y ago
Certainly. If it's an opinion, then that's fine. This issue is different - it's about manipulation, the willful presentation of known fake information as real news. That is not allowed in the print media by law (libel/sl
48.
by not_that_noob 9y ago
Not quite. No one is asking for personal content to be judged. But if there is a one-to-many pattern of information sharing (e.g. an organized attempt to share content) to unrelated parties, then that content should be vetted for veracity.
49.
by not_that_noob 9y ago
FB never revealed the content of these ads, so no one other than FB knows.
50.
by not_that_noob 9y ago
Quite true and an interesting proposition. Especially with regard to transparency - if we all can see the data FB sees on what ads were targeted to whom - then that might help as well, as outsiders can watch for dark patterns. In addition,
51.
by not_that_noob 9y ago
What's interesting is there have been more than the usual number of downvotes for this thread. I wonder if using IP info admins can determine if these downvotes are clustering from within an org?
52.
by not_that_noob 9y ago
Yes, if they knew about it and didn't do anything, then that's willful negligence. They are not helping their image - the latest is a rejection of GDPR for non-European customers. Seriously? Way to demonstrate commitment to user d
53.
by not_that_noob 9y ago
Someone can still write an app to distribute on FB, and can use its platform's ability to foster virality to make it take off. That's a core feature of FB. The change you're talking about, if indeed it was made, may reduce th
54.
by not_that_noob 9y ago
What's not being said is that the Russians likely had the data too for use in the 2016 elections. See https://www.theguardian.com/uk-news/2018/mar/21/facebook-row... and the testimony Christopher Wy
55.
by not_that_noob 9y ago
Can you point to the particular new limitation that will have this effect? I can't find anything in the announced changes that do this. The key attraction of FB - viral marketing for an app - is something that FB wouldn't touch I
56.
by not_that_noob 9y ago
None of these changes will do anything to fix the basic issue. All the following aspects were derived from watching the testimony Christopher Wylie gave before the UK House of Commons Select Committee. He's the CA whistleblower. It&#x2
57.
by not_that_noob 9y ago
The Dalai Lama represents Vajrayana Buddhism, which has tended to be more peaceable. Myanmar and Sri Lanka - two Buddhist countries that have persecuted minorities within - are of the Theravada school. https://en.wikipedia.org&#x
58.
by not_that_noob 9y ago
You can see Wells’ genius even in such a short clip. To think he was only 20!
59.
by not_that_noob 9y ago
Those are for Bitfunder and the like, where the issues are more about fraud than about the correct classification of coin offerings. There is no enforcement action against Coinbase for example. If the SEC was that confident in its position,
60.
by not_that_noob 9y ago
This is a press release - nothing more. A CYA from the SEC in case something blows up tomorrow. It's not a cease and desist letter to the exchange operators - so on balance, this is good news for them. I think the SEC is not confident

More ›