• 67 Posts
  • 717 Comments
Joined 1 year ago
cake
Cake day: July 23rd, 2023

help-circle


  • Well I’m sure they have very good reason and I’m not questioning them. I’m just talking from a user’s standpoint (and I’m a very poor Windows users): whenever I try to port any of our tools to Windows, wham the damn antivirus kicks in and puts my stuff in quarantine. If I use an engineering application that talks to some device on an unusual port - and I’m talking outgoing traffic, not incoming, wham it’s blocked. And unblocking it requires making a formal request to IT, that whitelists the application, until WithSecure updates itself and forgets about it, and here we go again.

    It’s just a complete PITA. You constantly feel like you’re fighting an algorithm with stupidity built in just to get normal, honest-to-goodness work done.



  • The DoJ will never touch EMV. They’re much, MUCH more entrenched and powerful than even Google. They literally control payments worldwide - the very fabric of society. No government in the world wants to touch that rat’s nest with a 10-foot pool, because if payments start to show even a hint of added friction, it can literally bring down a country’s GDP.

    That’s why EMV has been allowed to operate virtually unchecked, and dictates who gets to be on their network with zero pushback - especially since the people EMV strikes off their network are usually people the government would like to get rid of too, like Wikileaks. So the powers that be are very happy to maintain the status quo.

    A true case of fascist-style collusion between the state and the private sector. This cartel will never be broken.











  • 2FA is great. It’s the best tool there is against impersonation and account takeovers.

    But it’s only great PROVIDED

    1. It’s a real, proper second factor like a hardware token or - less great but okay - a “secure” cellphone app. When it’s a totally insecure factor like SMS, 1FA is preferable.
    2. It’s not such a PITA that you hate using it.
    3. When it’s a proprietary app from one of the big data sonsabitches, it’s also an app to spy on you and your activities.




  • The TOR network itself is safe - at least assuming the TLAs don’t control at least half of the nodes, which is far from impossible. But let’s assume…

    The weak point comes from the browser: that’s how the fuzz deanonymizes users. The only safe browser to use on TOR is the TOR browser, and that’s the problem: it disables so many unsafe functionalities that it’s essentially unusable on a lot of websites. So people use regular browsers over TOR, the browser leaks identifying data and that’s how they get caught.