nwh

44 ms·

421.
by nwh 13y ago
No, you can not detect malware working like that. How do you know the data will be sent when you are looking, how do you know what the encoding will be? Maybe it exports your AppleID password by using the unused bit ("evil bit") i
422.
by nwh 13y ago
Restore and wait for an open source jailbreak not compiled by scumbags.
423.
by nwh 13y ago
Entering without my permission (or 2 weeks notice) is grounds for immediate termination of my lease (see the link below). Installing an alarm system and not giving them the code isn't covered, but I would be extremely unwise to do that
424.
by nwh 13y ago
Read the paper. They're using a known input ciphertext to help aid this recovery and get around the limitations you've noted. Recovery also takes an hour, byte by byte with different decryptions.
425.
by nwh 13y ago
That's a literal jawdropper. I'm stunned.
426.
by nwh 13y ago
Australia. "A party to a tenancy agreement who changes any external door or window lock must as soon as practicable give a key to the lock to the other party." "A tenant who wishes to change a lock in a master key system m
427.
by nwh 13y ago
> Since then I alway change the lock in the main door. I'd check your tenancy laws, that's certainly not legal in some countries. I would be evicted if I did that.
428.
by nwh 13y ago
So it is, I've removed that. I need to sleep more.
429.
by nwh 13y ago
Ah! You were mistaken in the functioning of the service (I thought this might happen). You have to specifically ask for a secure chat with a button press, normally everything is effectively plaintext.
430.
by nwh 13y ago
Presumably if you made the prize large enough you wold get to the point where it would be economical and profitable to start fabricating your own hardware like the EFF did for DES. http://en.wikipedia.org/wiki/EFF_DES_c
431.
by nwh 13y ago
From just asking around, most people described the key image to me in terms of the darkest portions and ignored the parts that were lighter. It's easier for the example image to say that there's a dark L and lighter X shape in the
432.
by nwh 13y ago
They don't provide the server-side code, nor a way to ensure that your client is talking to a specific server. The only authentication is via a 5 digit code sent via SMS, so it's presumably very easy to spoof and control messages.
433.
by nwh 13y ago
If they allow man in the middle attacks then the system is completely and demonstrably broken. The out of band public key verification uses deterministic images to confirm that the keys are the same, which can be easy forged given the relat
434.
by nwh 13y ago
The contest is only set up that way to make it look more secure, there's really no reason that you would have to prove yourself in that way. If there's an actual cryptographic break then a researcher can prove it without all of th
435.
by nwh 13y ago
Yeah, they did for mine and tried to charge me for it. The invoice for the charges was a "misprint" was was hastily taken out of my hands and replaced with a blank one when I mentioned that the warranty period was two years.
436.
by nwh 13y ago
https://news.ycombinator.com/item?id=6932053 The key is not shown in hex, so a MITM is quite simple.
437.
by nwh 13y ago
That was a very good read that I wasn't aware of, thanks for the URL.
438.
by nwh 13y ago
https://news.ycombinator.com/item?id=6924866
439.
by nwh 13y ago
The interesting thing with the graphic patterns is that they're lossy. If you assume that a person will just describe the pattern or show a picture of them to one another, it becomes fairly easy to forge them. http://telegra
440.
by nwh 13y ago
That only protects against a MITM between peers who have communicated with a "secret chat" previously, not two fresh peers. As "secret charts" are disabled by default it's not really a defence against infiltration;
441.
by nwh 13y ago
It will allow you to conduct a man-in-the-middle attack on all encrypted traffic though, which would certainly be enough to read messages in plaintext.
442.
by nwh 13y ago
We already know the system is hopelessly vulnerable to server side MITM attacks, it makes no effort to defend against that attack model. It's mentioned in the comments that they might do manual key verification in the future, but that
443.
by nwh 13y ago
One would assume that's the point of paying in Bitcoin rather than any other method.
444.
by nwh 13y ago
It actually makes things worse really "no hackers can break this!" sounds good on paper, but it could just mean your adversary has more to gain by the system not being publicly broken.
445.
by nwh 13y ago
Most of the concerns people had were Telegram's servers acting maliciously or being coerced into acting maliciously, which is obviously not covered by this contest or the protocol they have designed. It's a bit disingenuous that T
446.
by nwh 13y ago
Coinbase use things like font fingerprinting to identify their users. Having multiple accounts is useless.
447.
by nwh 13y ago
I'd completely forgotten the name of it, thanks!
448.
by nwh 13y ago
Wake up your iPhone, go to slide to unlock, the screen times out and goes to black as you're typing your passcode. Happens to me and everybody I know, even after four OS updates. There's a heap of little bugs like that.
449.
by nwh 13y ago
That was Star - http://theiphonewiki.com/wiki/Star It's a completely different process to a restore. Star used a PDF exploit to work it's way up to a kernel exploit allowing for the patching out of various pr
450.
by nwh 13y ago
What you've linked to is a scam. You can't unless you have an A4 device with an exploitable bootrom or SHSH blobs saved. You can't "downgrade" in a browser like that, it's completely impossible.

More ›