* Posts by Charles 9

16605 publicly visible posts • joined 10 Jun 2009

Zero-day hole can pwn millions of LastPass users, all that's needed is a malicious site

Charles 9

That doesn't attack the safe itself (meaning it can still be put in like a Dropbox). It attacks the running process which puts you in the same situation as simply getting pwned, in which case all bets are off anyway.

Anti-theft kill switches in smartphones just got a little less creepy

Charles 9

Re: Simple to turn off tracking

Of course, doing that will disable more and more apps that are becoming root- and custom-aware.

Charles 9

Re: Lower level than OS

But what's to say those hardware protections don't have hidden killswitches?

Charles 9

Re: Effective?

"if google would make Android Device Danager more an requirement for device lock (as at the moment all it can do is ring, lock and erase but no Lost/stolen marker on the device so they can still sell it to another country after factory reset)"

Google can't ensure that because they don't control the hardware channels sufficiently. Apple and Samsung control their own hardware channels so can ensure this. Google could do it for their Nexus line.

But then again, haven't the fences gotten smart and skilled enough to unbrick iPhones by switching out whatever chip does the lockout, which also changes the serial, IMEI, and everything resulting in an untraceable phone?

US standards lab says SMS is no good for authentication

Charles 9

Re: More important is prohibiting biometrics for 2F schemes.

But what about those people who have poor memories for passwords and PINs?

Charles 9

Re: Most uses of 2FA via SMS...

Some people can get by on muscle memory, but brain memory (such as for passwords and PINs on devices that keep changing) is beyond them. They usually have to go to a teller (if one's available) and use signatures.

Charles 9

Re: Fragmentary Technology...

And if the bad guys get you OUTSIDE the envelope?

Charles 9

Re: Network compromise is irrelevant

Because with a significantly-resourced enemy like a State, there is no such thing as "properly encrypted data". Insiders who can purloin data outside the envelope, state control of networks which can block, usurp, maybe even (with insider knowledge of the keys by hook or crook) perfectly impersonate one or the other party. Remember, we're pretty close to a DTA world as it is.

Charles 9

"...and easy-to-lose smartphone."

I don't know about that, given how often I see people actually using them. From where I look at things, more people lose their wallets than their phones, and those can lead to full-fat identity theft...

Charles 9

Re: Good riddance

They raid your mailbox and steal the codes, then...

Charles 9

Re: Most uses of 2FA via SMS...

"I'm glad anyway my bank uses a token for authentication. It's less comfortable to remember to carry it when you need it, but I store it separately from the phone (less chances to lose both at the same time), my bank credentials are not stored in the phone (there are some critical credentials which are best stored in your brain memory only) thereby even the bank app is safe enough."

So what if you have a bad brain, a poor memory, and a tendency to lose things (including your wallet, IN the supermarket)?

Charles 9

Re: Good riddance

"In order to bank at all you have to have some sort of network connection, so you can do the second factor over the network."

The problem is if the NETWORK is compromised. Which is why the second factor MUST be out of band. Otherwise, it's all the eggs in one basket, so to speak.

As for fobs and tokens and so on, wasn't RSA hacked and the algorithm leaked so that the keys could be cloned?

"...and should go back to banking with a teller in person."

And if your bank has NO tellers?

Charles 9

Re: Good riddance

Well then, how DO you do two-factor authentication with no wireless data coverage to speak of?

Charles 9

Because users have a NEED (not a WANT, a NEED) to bank on the go, such as to quickly transfer funds because their bank card is low and it's close to closing time and so on. And given that many people are willing to go without their WALLET but not without their PHONES, and you've got a real issue here because they're going to use it will ne, nil ye. You better find a way to make those apps tight, then.

As for two-factor, there's also the problem that, if you can't use the phone as a second factor, most people DON'T HAVE a second factor at all. Which means two-factor authentication is no longer possible.

It's 2016 and your passwords can still be sniffed from wireless keyboards

Charles 9

Re: Still Happy with Logitech

For me, my personal pet is the K400, a keyboard and touchpad all in one, making it a nice accessory for home theater setups.

Charles 9

Re: There is a reason why I use wired KB's

"...and PCs don't use HDCP between the monitor and computer!"

You mustn't have heard of Protected Media Path. Newer AMD/ATI and nVidia cards with HDMI ports CAN and DO enforce HDCP because of Protected Media Path. Otherwise, BluRay players and other DRM'd content may not allow playback at full resolution.

By 2040, computers will need more electricity than the world can generate

Charles 9

Re: More Information

But protactinium is both high half-life AND radioactive enough to need to be careful around. It's no Plutonium-239, but it's not DU, either.

Charles 9

Re: Moore's Law

Make it worth our while and we will. As of now, the return on tightass code isn't there.

Charles 9

Re: More Information

Well, there's the persnickety issue that atomic reactors as they are now inevitably take you at least part of the way to making weapons-grade material (this is true even of Thorium reactors; they can produce weaponizable Uranium-233 which a determined adversary could isolate). ANY process that can be usurped into a weaponization project is frowned upon by people not wanting World War III. I also recall a potential byproduct of the Thorium cycle is Protactinium, which has a half-life of over 32,000 years.

Charles 9

Re: Let's do the sums.

Yes, doesn't work at night. Not too reliable in the polar latitudes when you need it most (winter solstice during a blizzard--where's the sun when you need the heat). And given geopolitical issues, sharing isn't an option and a satellite just becomes a target.

Charles 9

Re: take any lump of matter doing whatever it is it is doing

"What any lump of matter is doing is being held together by the strong nuclear interaction - no computing needed."

And what does that have to do with the price of tea in China?

"The brain is a much more interesting example - we still don't entirely understand how memory works or thoughts are processed, but progress is being made."

Credits to milos we learn it operates nondeterminisically (at least partially by chance), meaning a 1-to-1 correlation of computer to brain becomes physically impossible (because a deterministic machine cannot accurately emulate, simulate, or otherwise a nondeterministic machine). Also part of our basic store of knowledge will probably be revealed to be genetic since babies show the ability to recognize their parents and even recognize when their environment has subtly changed even before learning to communicate (behaviorists tell by noticing their reactions when they subtly change things around and notice how they fixate on those changes).

Charles 9

Re: MISPWOSO

"Demonstrably, matter can support higher computation densities than we've so far achieved. Much higher densities, in fact."

Exactly what KINDS of densities are we talking about? And isn't die shrinking already raising the density of our chips? What about heat dissipation, which is inevitable with conductors the way they are today?

Charles 9

Re: MISPWOSO

Are you also taking into consideration the physical limitations integrated circuits are already hitting, meaning you can't get much smaller before making things too small for the electrons (which have a fixed size) from working properly? Where would we go beyond that limit?

Alleged skipper of pirate site KickAss Torrents keel-hauled in Poland

Charles 9

Re: Philosophy

ALL of them? Without exception? Then perhaps you can list the message of many of the classics and son on...

Charles 9

Re: What first amendment?

"And a nuclear bomb - however craply implemented - is always going to be the more effective weapon in those terms because the vast bulk of the population has no idea what nuclear weapons really are, and just considers them to be super-scary end-of-the-universe stuff."

But they have to actually SEE the effects to be terrorized. That's why 9/11 was so effective; an airlines crashes into a skyscraper and actually brings it down. In order for atomic terror to work, it has to be a REAL atomic explosion like that seen in the Trinity test (which people have seen on film). Just imagine the kind of terror you could inflict if you could, without warning, nuke the Rio Opening Ceremonies...

Charles 9

Re: Meanwhile other forms of entertainment are readily available

"How a business model that alienates customers can survive is beyond me. I doubt active law enforcement is going to help. Better start by fixing the root cause of the problem first. No?"

The root cause of the problem is that media companies want repeat business (as does anyone, one-and-dones don't cut it long-term), and (at least legally) they have a captive market, so capitalism says they can dictate terms and you're left with a "take it or leave it". Thing is, for every one that leaves, there are ten who will take it, so the money's there.

Charles 9

Re: Big content: 3

"I do agree with you, but the stupid watch less and less new content because they have realised it is all garbage lately."

I don't think so. Garbage is what they WANT to watch, given all the sequels and me-toos you see on the big and small screens all the time. Given the ratings gravitate towards them, this points to a hopeless fight to get truly satisfying content.

Charles 9

Re: What first amendment?

"If I have a directory of local fences* is that illegal even if I never buy or sell stolen goods? Are Yell (is that still a thing) breaking the law by listing gun stores?"

Does the term "aiding and abetting" ring a bell? Or perhaps "enabling"? If you do something to enable or encourage an illegal act, that's illegal in itself. That's why crime-for-hire is ITSELF a crime. They consider it closing loopholes.

Unless Yell lists black market gun sites, they're covered under the First AND Second Amendment.

"When does knowledge, and the dissemination of it, become so dangerous that our betters have to make it illegal?"

What about the knowledge to make an atomic bomb or perhaps the secrets to a plague? What was that saying? "A little knowledge can be dangerous." Or was it, "There are some things man is not meant to know."?

"Government of the people, by the people, for the people."

But then you end up with what we have now: "government of the charismatic, by the stupid, for the affluent". It's the natural human condition to find a way to get a leg up over the neighbors. PLUS stupid people are statistically certain. Put them together, and no government that you describe is destined to survive for very long. Even Greece fell to the Romans eventually.

Charles 9

Re: The end of piracy again!

Half the proxies are poisoned, though. This was true of the KA proxies, too, which was why you always wanted the clear quill which kept the ads to a minimum.

And I'm talking the click-anywhere types of ads that open up full screen and try their damndest to get past the ad blockers by matching domains and so on. Or the clickbait ads. Or the ad walls. Not to mention the fake ones that try to foist "Click to Install" trojans on you (and you can't really block those because most of them run on fast-flux).

Charles 9

Re: The end of piracy again!

Most people avoid TPB these days because it's ad-ridden (meaning potentially malware-ridden.).

Charles 9

Re: Big content: 3

Problem is Big Content has the stupid on their side. As long as the stupid continue to buy movie tickets and so on, they'll have a guaranteed revenue stream, meaning infinite money to attack squeaky nails.

You really do want to use biometrics for payments, beam banks

Charles 9

"Or we can remember a password that we can change by thinking of a new one"

Yes, tough choice, because many people CAN'T remember passwords. Hell, many people can't remember PINs? Why do you think reset exploits are so good? Because people forget them all too easily.

How do you authenticate someone with nothing to KNOW or HAVE?

Smartphones aren't tiny PCs, but that's how we use them in the West

Charles 9

Re: Guess you don't you fly much

"Remember a direct deposit account also enables direct withdrawals."

Oh? Where does it say that? Last I checked, direct deposits and direct debits had to be authorized separately.

Microsoft ordered to fix 'excessively intrusive, insecure' Windows 10

Charles 9

Re: Privacy? How about basic usability?

"And which of these do you use?"

Check out the Steam Library. Compare the size of the Linux one with the Windows one. Most of the newer ones use cutting-edge stuff including DX11. WINE stinks at cutting edge. Fallout 4 happens to be one of the most prominent. We can probably also throw in Metal Gear Solid 5 and the Final Fantasy XIII trilogy.

Put it this way. If Linux gaming really were all that, (A) Valve would be having no difficulty getting mainstream developers to code for Linux to get away from Windows' thumb, yet you have developers like Bethesda Softworks (who made Fallout 4) going on record saying that developing on Linux is too mercurial. And (B), you'd see the professional gaming circuit, who thrives on the cutting edge, and who do it for a living, using Linux gaming boxes to extract the last bit of performance out of their rigs. Yet we don't see that.

"Not forgetting also that updates on doze require a reboot for making really stupidly minor updates to the system."

That's what I meant by monthly. Most of them update system components, which is why they require a reboot. About the same thing happened when I was on Xubuntu (yes, I tried Linux firsthand, and I didn't like it). As for rebooting, consider the target audience (Joe Stupids who don't understand the concept of rebooting). If they don't reboot, they can get pwned and Microsoft gets the blame for it. Sounds like a case of "damned if you do, damned if you don't," only they have more "Joe Stupid" Windows customers than sophisticated ones, and the latter tend to have enterprise contracts with different rules.

"If your machines are really that bad, you really need to get off Windows."

Wish I could, but like most people the software I use everyday has no analogue anywhere else meaning we're kinda stuck here. That's what you don't seem to understand. When someone is stuck in a leaky boat in the middle of the shark-filled ocean, there's really only one option for you. Such as it is for most people: there are no alternatives.

Charles 9

Re: Privacy? How about basic usability?

Many games are Windows-ONLY, WINE-INCOMPATIBLE, and VM-UNFRIENDLY. Plus I don't like rebooting unless I HAVE to, which is usually only about once a month (too many times I've seen machines try to reboot and fail, so it's a real uptime issue here). Show me games like Fallout 4 running on Linux at the same speed as Windows and I'll consider it. Otherwise, call me when the Linux Steam library gets close to the Windows Steam library. Plus there's DX12 coming up, and it has more support than that for Vulkan. SERIOUS PC gamers tend to stay away from Linux. Otherwise, we'd be seeing professional gaming rigs (such as that used for competitions) running on Linux. Until then...

Charles 9

Re: Trust the government...

"Not a hope, they are the primary driver of this slurping in the first place. May wants MORE of it."

Well, that's the price of admission. And you can't exactly leave it because EVERY country wants the same data for the sake of its sovereign security. Any option that ignores that reality is basically asking for anarchy.

Charles 9

Re: What about the US?

Fallout 4, for starters. Bethesda has sworn off Linux, so no port is likely, and it's a near-cutting-edge game so WINE won't hack it and VM's can't do it without a serious performance penalty. And let's not get to incoming DX12 games which require Win10 and which WINE won't even begin to cover for a while yet. There's a very good reason the Linux Steam library is less than half the size of the Windows Steam library.

Charles 9

Re: What about the US?

But what of something you really want (or worse, NEED) is Windows-only, WINE-incompatible, and VM-unfriendly?

Charles 9

Re: Privacy? How about basic usability?

Well, that's what's called a "captive market". If you depend on SharePoint, and support is a legal requirement, then you're kinda stuck with an "all or nothing" situation. So you end up asking yourself what it's going to take you to go nuclear and abandon EVERYTHING, even at expense to your business (or in my case, at expense to my massive game collection, most of which is strictly Windows-ONLY).

Charles 9

Well, SOMEONE has to be entrusted with your personal data: for census, benefits, taxes, and so on if nothing else. Kinda comes with the territory, so they're going to have your data anyway as a matter of course. Anything otherwise and you're talking anarchy. They're the sovereign: the ultimate authority in the country. Given that, might as well limit yourself to the one entity in the country that MUST AND WILL have it.

Charles 9

Re: To think that...

"It's not 'do one thing and do it well' - it's trying to be a swiss army knife."

Well, when you're running in a system where the entire landscape can change on a moment's notice (think dynamic, hotplugging buses like USB and so on, where NOTHING is fixed anymore), you pretty much HAVE to be a jack of all trades to be able to handle that curveball coming out of nowhere.

IETF boffins design a DNS for crypto-currencies

Charles 9

I don't know if I'd be too keen on the concept becoming a reality as of yet, but I would love to at least see the conversation that ensues, to see just what issues and pitfalls could be involved in such a system. I think the biggest issue here is that of trust, but that touches on an issue that affects civilization itself: you NEED a minimum level of trust for civilization to function at all; otherwise it's DTA mode which inevitably leads to anarchy. It's, as they say, an extremely thorny issue which is exactly why I want to see an extended conversation on it. Get everything out in the open.

Your antivirus doesn't like Ammyy. And fraudsters will use that to RAT you out (again)

Charles 9

Re: I dunno if this would work...

I've thought about it, but then you get the "Turtles All the Way Down" problem. How can you be sure the "known good" copy really IS "known good" if the intruders are savvy enough to not only replace the copy but also its hash as well (or worse, if it's a well-resourced enemy like a State, successfully pull off a Preimage Attack and submit a bad copy with the same hash)?

Charles 9

Re: I have fun with the scammers...

But what if the malcontents have a Red Pill that can jailbreak them out of the guest OS into the host?

Charles 9

Re: I have fun with the scammers...

"I wonder if I should let on that I've got sites like TV & Ammyy listed in my HOSTS file & therefore can't access them from this computer at all?"

NO! Don't! Then they'll know what's up and go to Plan B: a relay that WOULDN'T be on your blacklist because you never heard of it until now.

Your next storage will be invisible (for a while)

Charles 9

Re: DIY ad hoc storage is not for production use...period

"There is really no reason to start with junk servers unless you need to prove the concept before you get the funding you need to do it right."

As noted in the article. These things usually get thrown up for third-string stuff that was just handy to have and tend to grow organically into the organization.

FAA's 'drone smash risk to aircraft' is plane crazy

Charles 9

Think Prohibition. Ornerous laws can become unenforceable if enough people balk on them. Think the black market and why AK-47s still come into the country. Demand draws supply through hook or crook. Meaning the law can ring hollow.

For $800 you can buy internet engineers' answer to US government spying

Charles 9

Re: FIPS 140-2 (Was Cheap)

But can you think of one better?

EU Net Neutrality debate heats up as Tim Berners-Lee weighs in

Charles 9

But centralization is NATURAL, part of the human condition, and therefore inevitable. Put it this way. The Gilded Age got that way not because governments coddled big businesses but the other way around, because businesses got SO big they could stand OVER the governments and dictate terms or simply buy the governments out. Same today with transnational businesses like big oil. Why don't governments strip big oil subsidies? Because big oil threatens to pull out and take their revenues with them to other, more "friendly" countries. That brings up a turn of phrase: Better 10% of something than 100% of nothing.

PS. As for regulation that WORKED, what about the US taking over the rail network during World War I and standardizing the rail gauges and so on, such that when World War II came around, they found they didn't have to do anything else to get the rail companies on board the war effort that time around?

Charles 9

Spectrum, however, is a limited resource, with an absolute limit to its utility (Nyquist’s theorem). This puts the onus on the State to regulate it to ensure it's being used to best improve the lot of the people (under capitalism, there can be incentive to hoard, wait out the competition, and then monopolize).