Register a SA Forums Account here!
JOINING THE SA FORUMS WILL REMOVE THIS BIG AD, THE ANNOYING UNDERLINED ADS, AND STUPID INTERSTITIAL ADS!!!

You can: log in, read the tech support FAQ, or request your lost password. This dumb message (and those ads) will appear on every screen until you register! Get rid of this crap by registering your own SA Forums Account and joining roughly 150,000 Goons, for the one-time price of $9.95! We charge money because it costs us money per month for bills, and since we don't believe in showing ads to our users, we try to make the money back through forum registrations.
 
  • Locked thread
Shaggar
Apr 26, 2006

Wiggly Wayne DDS posted:

even with blood flow analysis there's only so much data you can capture with a camera's ir sensor a foot or two away from the face. it's not high definition and i'd put the number of influencing factors on the verification of a face compared to a fingerprint at several order of magnitudes. there's a ton of leeway that someone will have a proof of concept together pretty quickly. a fingerprint at least has surface contact to grab a lot more measurements with

in other equifax news admin:admin is still effective https://krebsonsecurity.com/2017/09/ayuda-help-equifax-has-my-data/

yeah its likely blood flow detection is one of many factors and is primarily used in determining if this is a human or a mask/photo/etc...

Adbot
ADBOT LOVES YOU

wolrah
May 8, 2006
what?

flakeloaf posted:

yeah whatever happened to that fangled microsoft webcam technology that was supposed to be able to do this

I believe that claim was made about Kinect 2 (the Xbox One version) at one point, and AFAIK some of the FaceID team worked on Kinect in the past. From the little information in the presentation it looks like FaceID works very similarly to Kinect as far as its 3D mapping goes.

surebet
Jan 10, 2013

avatar
specialist


Jewel posted:

there was a lot of equifax talk but i didnt know a db was admin/admin lol

https://twitter.com/briankrebs/status/907932442132172800

jfc at some point you really should just run towards the telecom cabinet and start wailing on stuff with the fire axe

Jewel
May 2, 2009

..oof :sigh:

https://twitter.com/torproject/status/907677742690439171

Babies Getting Rabies
Apr 21, 2007

Sugartime Jones
did we already talk about how comodo ignores caa and just issues certificates despite caa records for those domains not authorizing them to do so?

pseudorandom name
May 6, 2007

I said lol comodo a couple days ago but everybody else was too busy making fun of the equifax CSO's resume

Max Facetime
Apr 18, 2009

Tor project posted:

This is a major human rights breach - thousands in Turkey were arrested for downloading an encrypted messaging app

Encryption is not a human right and neither is downloading apps, in fact both could well be illegal in some places, so where's the human rights violation?

spankmeister
Jun 15, 2008






Max Facetime posted:

Encryption is not a human right and neither is downloading apps, in fact both could well be illegal in some places, so where's the human rights violation?

Saying that downloading an app makes you a Gülen supporter.

hobbesmaster
Jan 28, 2008

Max Facetime posted:

Encryption is not a human right and neither is downloading apps, in fact both could well be illegal in some places, so where's the human rights violation?

turkey is theoretically trying to become an EU member and this would be absurdly illegal in an EU country

spankmeister
Jun 15, 2008






hobbesmaster posted:

turkey is theoretically trying to become an EU member and this would be absurdly illegal in an EU country

They are already signed on to the ECHR

hobbesmaster
Jan 28, 2008

and they've spent over a year trampling all over it

cinci zoo sniper
Mar 15, 2013




hobbesmaster posted:

and they've spent over a year trampling all over it

and merkel has made a public statement that turkey is unfit for eu membership

spankmeister
Jun 15, 2008






Yeah they're not joining any time soon and all the better imo.

fins
May 31, 2011

Floss Finder
just got this error from firefox:

code:
 Reading manifest: Error processing permissions.1: Unknown permission "privacy"
seems about right

endlessmonotony
Nov 4, 2009

by Fritz the Horse

Max Facetime posted:

Encryption is not a human right and neither is downloading apps, in fact both could well be illegal in some places, so where's the human rights violation?

Get the hell out you rear end in a top hat.

dpkg chopra
Jun 9, 2007

Fast Food Fight

Grimey Drawer

Max Facetime posted:

Encryption is not a human right and neither is downloading apps, in fact both could well be illegal in some places, so where's the human rights violation?

Encryption isn't, but Freedom of Speech and Freedom of Thought are, Turkey is a member of the UN, and laws don't exist in a vaccuum. The current political climate in Turkey (and in almost any country, really) pretty much guarantees that a law forbidding encryption is passed with the express purpose of supressing ideas and viewpoints that oppose the government's and thus judges should interpret them accordingly.

Interpretation of the law isn't binary, much less international law.

Mr. Nice!
Oct 13, 2005

c-spam cannot afford



i missed hacking movie talk but goldeneye came out in 1995

hobbesmaster
Jan 28, 2008

more than simple free speech, ECHR has an explicit right to private correspondences. it's blatantly illegal

turkey isn't even pretending to not be a dictatorship now

surebet
Jan 10, 2013

avatar
specialist


Max Facetime posted:

Encryption is not a human right and neither is downloading apps, in fact both could well be illegal in some places, so where's the human rights violation?

in a general sense:
https://en.wikipedia.org/wiki/Arbitrary_arrest_and_detention

ianal, especially not one with a specialty in turkish law, but it's reported that the searches and arrests are being conducted by local police forces on their own authority (presumably after obtaining telemetry from local isps). however, in a case requiring signal intercept or other telecom related work, a warrant can only be issued by a superior court.

the larger issue is that this happened in the wake of last year's failed coup in turkey where some revolutionaries did in fact use bylock, however it's download and use was made illegal retroactively in an effort to root out participants not already detained.

the sad part is that the app was a piece of poo poo:

quote:

“ByLock is an insecure messaging application that is not widely used today,” Tim Strazzere, director of mobile research at US-Israeli security firm SentinelOne told Reuters. “Anyone who wanted to reverse-engineer the app could do so in minutes.”

More than a dozen security and messaging experts contacted by Reuters had never heard of ByLock until it was mentioned in recent days by the Turkish authorities.

According to Matthew Green, a cryptologist and assistant professor of computer science at Johns Hopkins University in the US who examined the app’s code after being contacted by Reuters, the ByLock network generates a private security key for each device, intended to keep users anonymous.

But these keys are sent to a central server along with user passwords in plain, unencrypted text, meaning that anyone who can break into the server can decrypt the message traffic, he said.

“From what I can tell it was either an amateur app (most likely) or something that someone wrote for the purpose,” he said in an email.
https://www.theguardian.com/technology/2016/aug/03/turkey-coup-gulen-movement-bylock-messaging-app

McGlockenshire
Dec 16, 2005

GOLLOCKS!
well it's official now

https://twitter.com/ericgeller/status/908017220919468037

DHS: all Kaspersky product use by the executive branch must be discontinued within 90 days

BangersInMyKnickers
Nov 3, 2004

I have a thing for courageous dongles

lol great more idiotic Russia posturing

BangersInMyKnickers
Nov 3, 2004

I have a thing for courageous dongles

What's funny is that it was even being used in the first place. government procurement 101 is that you go with vendors in the US so you can exercise legal and executive authority over them and it makes sense to use products that you can exercise some level of control over as the state but of course this is going to get blown out of proportion

anthonypants
May 6, 2007

by Nyc_Tattoo
Dinosaur Gum

BangersInMyKnickers posted:

What's funny is that it was even being used in the first place. government procurement 101 is that you go with vendors in the US so you can exercise legal and executive authority over them and it makes sense to use products that you can exercise some level of control over as the state but of course this is going to get blown out of proportion
gonna assume it's because a few people bought laptops from best buy with kaspersky on em

Diva Cupcake
Aug 15, 2005

BangersInMyKnickers posted:

What's funny is that it was even being used in the first place.
i would assume this is strictly a political move and that no dod agencies are actively using it.

leper khan
Dec 28, 2010
Honest to god thinks Half Life 2 is a bad game. But at least he likes Monster Hunter.

Diva Cupcake posted:

i would assume this is strictly a political move and that no dod agencies are actively using it.

not all government agencies are dod though

duTrieux.
Oct 9, 2003

anthonypants posted:

gonna assume it's because a few people bought laptops from best buy with kaspersky on em

yup.

Chris Knight
Jun 5, 2002

me @ ur posts


Fun Shoe

pseudorandom name posted:

I said lol comodo a couple days ago but everybody else was too busy making fun of the equifax CSO's resume

yeah you literally posted "lol comodo" with no further information, so of course everyone ignored you

anthonypants
May 6, 2007

by Nyc_Tattoo
Dinosaur Gum
yeah not even a link or anything. lol

AARP LARPer
Feb 19, 2005

THE DARK SIDE OF SCIENCE BREEDS A WEAPON OF WAR

Buglord
tough crowd today

Shame Boy
Mar 2, 2010

today in 'overheard hot takes from management' i bring you:

"we can always add more security later, but if we add too much security from the beginning it's really inflexible and very hard to remove!"

Truga
May 4, 2014
Lipstick Apathy
layer in the fidelity security

Cocoa Crispies
Jul 20, 2001

Vehicular Manslaughter!

Pillbug

ate all the Oreos posted:

today in 'overheard hot takes from management' i bring you:

"we can always add more security later, but if we add too much security from the beginning it's really inflexible and very hard to remove!"

in some cases this is the correct thing to do

if you're doing like a new workflow and just go h-a-m on security from the start you won't get users or you'll get user resentment and your project will wither on the vine

so think real hard (i.e. take a security enthusiast coworker drinking at lunch) about what security you actually need from the beginning and what you might want to add later and do the initial work in a way that provides the security you need and doesn't make it actively difficult to add later

Shame Boy
Mar 2, 2010

Cocoa Crispies posted:

in some cases this is the correct thing to do

if you're doing like a new workflow and just go h-a-m on security from the start you won't get users or you'll get user resentment and your project will wither on the vine

so think real hard (i.e. take a security enthusiast coworker drinking at lunch) about what security you actually need from the beginning and what you might want to add later and do the initial work in a way that provides the security you need and doesn't make it actively difficult to add later

yeah nah this is pertaining to something much dumber

surebet
Jan 10, 2013

avatar
specialist


ate all the Oreos posted:

today in 'overheard hot takes from management' i bring you:

"we can always add more security later, but if we add too much security from the beginning it's really inflexible and very hard to remove!"

have you ever watched a filthy computing casual try to remove the three bundled avs installed on his $400 staples special laptop?

hobbesmaster
Jan 28, 2008

surebet posted:

have you ever watched a filthy computing casual try to remove the three bundled avs installed on his $400 staples special laptop?

well yeah you generally look at someone when they're asking you to work on their laptop

Subjunctive
Sep 12, 2006

✨sparkle and shine✨

ate all the Oreos posted:

yeah nah this is pertaining to something much dumber

you should tell us the funny part, it'll be funnier

surebet
Jan 10, 2013

avatar
specialist


hobbesmaster posted:

well yeah you generally look at someone when they're asking you to work on their laptop

i fixed the "be the free family computer janitor" issue by making people do the work while i'm there to explain what's up, at least for the easy stuff

that way there's an inbuilt "i'll gladly help but you're going to have to listen to me talk about computers" factor that keeps the most idiotic requests at bay, and now that they're used to it, people come expecting to learn something.

lots of bitching early on, but even if this takes a bit longer i think it's win-win

vOv
Feb 8, 2014

Babies Getting Rabies posted:

did we already talk about how comodo ignores caa and just issues certificates despite caa records for those domains not authorizing them to do so?

quote:

Yesterday morning (Monday 11th), when investigating the Problem Reports, the original developer discovered that as a result of that BIND upgrade all of our calls to `dig` were returning the following response:

`Invalid option: +sigchase
Usage: dig [@global-server] [domain] [q-type] [q-class] {q-opt}
{global-d-opt} host [@local-server] {local-d-opt}
[ host [@local-server] {local-d-opt} [...]]

Use "dig -h" (or "dig -h | more") for complete list of options`

Unfortunately, this `dig` response was being interpreted by our CAA checking code as a CAA response that contained: no "issue" property, no "issuewild" property, no unrecognized critical properties, etc.

Shame Boy
Mar 2, 2010

Subjunctive posted:

you should tell us the funny part, it'll be funnier

but using your imagination is more fun :colbert:

(it's a backend API-type thing we're overhauling, and without getting into too much detail one of the main reasons we're overhauling is "it has basically no security" so uhhh)

Adbot
ADBOT LOVES YOU

anthonypants
May 6, 2007

by Nyc_Tattoo
Dinosaur Gum

quote:

WHAT WENT WRONG
Our ops team upgraded the servers that our CAA checking code was running on. This included a very-long-awaited transition from a 32-bit to 64-bit OS.
lmao

  • Locked thread