wepple

27 ms·

361.
by wepple 3y ago
The mistake is that many (most?) devices use batteries in series as well as parallel. So as soon as someone builds a 2S battery with nominal 7.4v, mAh is useless as a sole datapoint
362.
by wepple 3y ago
+1 the mobile layout has you believe you’ve gotten to the end of the page by showing “Related projects” so you don’t scroll further. Description should be below photos or even title.
363.
by wepple 3y ago
Whilst it might be in the T&Cs somewhere, it’s the not-good variety of surprise that a company should really try to avoid. I don’t have Alexa devices on my network, and I’m glad. I do have other vendor smart things, and I’d absolutely e
364.
by wepple 3y ago
I disagree. With sufficient buy-in and money, you can make your systems extremely difficult and costly to attack, making the economics of an attack not worth it. I’m willing to bet that a place like MGM has utterly abysmal security. You don
365.
by wepple 3y ago
Sorry definitely not you, but exactly what seritools mentioned. When I first saw this post they had already posted
366.
by wepple 3y ago
[tangental] two accounts created 3 days ago stating how wonderful the bus pirate is? Cmon, surely you know better than this. And the BP is a great tool, it doesn’t need painfully obvious astroturfing
367.
by wepple 3y ago
It can be used as a TTL serial adapter (ex getting a command line on common hardware/IoT devices), JTAG (debug, dump firmware), reading flash memory chips, etc
368.
by wepple 3y ago
There is a near zero chance that being EAL4 or higher certified would’ve prevented these attacks. CC might be better than PCI-DSS, but not by much.
369.
by wepple 3y ago
“Always prove” and “zero ambient trust” are basically the same thing, no? Perhaps “authenticate everything, everywhere” is better, but falls into the trap of trying to define “everywhere” and “everything”: should every single client applica
370.
by wepple 3y ago
Ahh, thanks and apologies for not re-reading before asking. That is indeed interesting; keep the con going a bit longer to get a proper foothold.
371.
by wepple 3y ago
Why did they need to call? They could’ve phished the password and MFA by simply MITMing? Perhaps we need a distinction from phishable MFA and unphishable U2F/WebAuthn style
372.
by wepple 3y ago
What’s this got to do with zero trust?
373.
by wepple 3y ago
This page renders terribly in mobile; am I the only one? It’s unreadable
374.
by wepple 3y ago
Yeah true, that’s a fascinating challenge that I haven’t seen particularly well discussed anywhere in detail. It needs to be really well protected so that the owner, and only the owner can disable the chain of security, but that they can do
375.
by wepple 3y ago
> It's just a matter of implementing a signature verification correctly With rollback protection, a chain of signing keys to allow revocation, time stamping, correct parsing, enough scratch space to hold an entire separate image i
376.
by wepple 3y ago
Yeah, I think I might be too. I mean, I’m headed that way to a degree anyhow. Although arguably most major web players already 100% know who you are - just maybe not your name.
377.
by wepple 3y ago
Yeah, at second glance it actually (as proposed - huge caveat) might even be better for privacy. I’m can’t begin to theorize how the future will play out if you need a PAT to access most web destinations. Do cloudflare or Apple engineers us
378.
by wepple 3y ago
There are the recently announced hardware root of trust solutions[1] that aren’t behavior driven. But they just trade one privacy issue for potentially another, depending on your view It does seem sadly unavoidable. Perhaps the internet has
379.
by wepple 3y ago
> Are non-resident keys less secure? The answer provided by the author (TLDR: you'd have to break AES) is far from satisfying to me. With a resident key, the only thing an attacker on an endpoint could ever get is a challenge &
380.
by wepple 3y ago
how does authn happen here? RP sends ID and I respond with the secret code? that's subject to replay attacks.
381.
by wepple 3y ago
Hmm, yeah I think I grok the argument. But if excess cash flow can go to employees, would you also expect employees to inject their savings when the company has a shortfall? I always considered employment a fairly simple exchange of my se
382.
by wepple 3y ago
Why are share buybacks seen so negatively? Isn't it somewhat to offset the fact that a lot of shares are issued as comp, so dilute the pool?
383.
by wepple 3y ago
Ah superb, now the ML models can make real pretend internet money from their side hustle!
384.
by wepple 3y ago
There are a bunch of bad legacy technologies still baked into windows for which I can’t see a non-windows equivalent For example: credential hashes. They can be used as a bearer-token, and a privileged enough one can log into absolutely any
385.
Ransomware criminals are dumping kids’ private files online after school hacks(apnews.com)
1 points by wepple 3y ago|0 comments
386.
by wepple 3y ago
This is cool, but immediately makes me wonder if blocks are the optimal material for this type of installation. Naturally that’s where you’d start because it’s what is commonly used But pretty quickly you could pivot to better “blocks” that
387.
by wepple 3y ago
NY Transit officially stopped using Twitter. I hope others follows. Google results that require a login to view are cancerous
388.
by wepple 3y ago
I expect that to change over time. I personally expect man-in-the-browser attacks to start targeting SaaS application data. I suspect a secondary reason is that the way windows credentials and file shares are set up, you can really build on
389.
by wepple 3y ago
I often figure that you only need about 25% more knowledge/expertise on a topic than others to seem like an expert, and for them to be incapable of actually judging your knowledge
390.
by wepple 3y ago
Oh yeah, that was the perfect word. I’d never heard of it and figured others maybe hadn’t either. I anticipate I’ll be using that one semi frequently

More ›