patcheudor

15 ms·

91.
by patcheudor 9y ago
Many Android devices of that age and even newer had flaws resulting in the failure to properly validate HTTPS connections as they would accept invalid certificates. As a result, every time I fire up an off the shelf WiFi Pineapple in publi
92.
by patcheudor 9y ago
I saw John Sotos, Chief Medical Officer of Intel talk at DEF CON 25 about bio-hacking. This guy is at the top of his field and whip-smart. He's without a doubt an expert in this field and it was one of the most terrifying talks I&#x2
93.
by patcheudor 9y ago
In the US and if through USPS, if a package is shipped and delivered, the person receiving the package now owns it and is under no obligation whatsoever to return it. It's literally 'finders keepers': "By law, unsolicit
94.
by patcheudor 9y ago
>There other benefits to exercise, including stretching and loosening joints and ligaments. There's some debate that stretching is actually a problem. https://well.blogs.nytimes.com/2013/04/03/reasons-
95.
by patcheudor 9y ago
>It's more effective to block what you want on your host firewall and not rely on the the network to keep you safe. I agree and am a big fan of host firewalls and host intrusion prevention systems, however, they must of course cover
96.
by patcheudor 9y ago
That's how I do VPN. I have my ISP connected router, then a DMZ network with my test servers & three routers: 1) guest, 2) main, 3) VPN. I then use a virtual LAN from (2) to (3) over a virtual interface on (2) to connect to (3) w
97.
by patcheudor 9y ago
>So what is the downside to using a VPN if you're aware that they aren't foolproof vs not using a VPN at all? Rarely addressed: VPN CLIENT ISOLATION. The majority of us sit behind a NAT'd address range provided by our phys
98.
by patcheudor 9y ago
Server has an issued cert. Client has an issued cert. The publics are exchanged and authenticated. Each can then be chained up to an issuer to prove identity. That's nonrepudiation.
99.
by patcheudor 9y ago
"TLS-N is the first TLS extension that provides non-repudiation and thereby enables parties to verify each others TLS connections and its contents." Is it the first? X.509 client authentication provides a mutually authenticated T
100.
Hack the Gibson – Proving a tech conference is a fraud(waset.org)
1 points by patcheudor 9y ago|0 comments
101.
by patcheudor 9y ago
In some states like mine it's required you store ammunition under your pillow, loaded in your handgun. I'm only half joking.
102.
by patcheudor 9y ago
"More than half of Americans that overweight and obesity can increase their risk for cancer." Sorry to be 'that guy', but I'd expect official statements from the CDC to be better proof-read as this sort of thing rea
103.
GM executive claims Elon Musks self driving claims are 'full of crap'(smh.com.au)
1 points by patcheudor 9y ago|0 comments
104.
by patcheudor 9y ago
I think they've mostly been developed and sold in the US but given the creativity of the Cuban people when it comes to reuse, it's not hard to imagine a few have converted old microwaves. It's also not hard to imagine that h
105.
by patcheudor 9y ago
This talk (Rage against the weaponized AI propaganda machine) at DEF CON I attended showed research indicating that it doesn't take much to sway an election one way or the other - just a couple percentage points and that tactics which
106.
by patcheudor 9y ago
Ha! In this case make no mistake, the product is also the customer. At some point they will switch from free to charge for their monitoring service.
107.
by patcheudor 9y ago
Here's a more in-depth analysis from the perspective of trying to figure out if the e-mail and site are legit which covers all the various things Equifax did wrong: https://www.linkedin.com/pulse/equifax-how-can-yo
108.
by patcheudor 9y ago
Part of me is now wondering if this was even nefarious as I'm picturing over zealous Cuban pest control specialists, without strong regulation or laws, simply using termite microwaves with people around. http://pests.guru&#x
109.
by patcheudor 9y ago
If you could get to it quick enough that is. I assume police departments these days have a procedure for cutting off wireless access to devices they confiscate by using radio frequency blocking bags. This of course brings up an interestin
110.
by patcheudor 9y ago
Indeed! There's mounting evidence that Equifax simply didn't "get" application development in addition to operations and patching. I doubt the developers of their vulnerable mobile app were responsible for patching. A
111.
by patcheudor 9y ago
From the actual law: "1. Unlimited liability applies. The standard of unlimited liability applies if unauthorized transfers appear on a periodic statement, and may apply in conjunction with the first two tiers of liability. If a perio
112.
by patcheudor 9y ago
I'm amazed what banks will re-enable with a simple phone call as long as you have a name, current address, SSN, and birthdate. But yes, it's a good step to take and makes it just that much harder to compromise an account so it&#x
113.
by patcheudor 9y ago
I prefer two separate institutions for one reason: things like the Equifax breach. If someone attempts to impersonate you at your bank they could gain access to both accounts. If you have a 'silent' account somewhere else, they&
114.
by patcheudor 9y ago
Dangerous is relative. In the US you have roughly 60 days after a statement is received to escalate fraudulent transfers out of your account. If you file a complaint within this timeframe, your money will be returned. The problem of cour
115.
by patcheudor 9y ago
I've got two and three year old vulnerabilities I've disclosed which have CVE's which are still not populated. This is very common. No one waits for the CVE to be populated before going public.
116.
by patcheudor 9y ago
API creds maybe could have been excusable as a mistake which got overlooked or even permissions which changed. In the context of a credit monitoring app, the use of HTTP is really, really, really bad and can't really be excused. It w
117.
by patcheudor 9y ago
Latency, speed, and not wanting to impact people over the wider WAN on reviews which may generate large amounts of traffic.
118.
by patcheudor 9y ago
Security reviews. Powerful enough to run multiple VMs to simulate caching server, web server, app server, and database tier while simultaneously recording and as necessary tampering with all network communications while running static and
119.
by patcheudor 9y ago
"the system is architecturally wrongly designed" Like: https://www.fastcompany.com/40468811/heres-why-equifax-yanke...
120.
by patcheudor 9y ago
Exactly! This is so bad. Way worse IMHO than a failed patch or default admin/admin password in terms of showing a lack of competence. Those are ops issues. This showed core issues in their ability to architect and develop secure co

More ›