Security Fuckup Megathread - v14.1 - Hello, is this a delivery order?

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > YOSPOS > Security Fuckup Megathread - v14.1 - Hello, is this a delivery order?

«‹›242 »

anthonypants: May 6, 2007; by Nyc_Tattoo; Dinosaur Gum

Amethyst posted:

the firmware of apple's secure enclave processor has been decrypted

https://hackaday.com/2017/08/18/apples-secure-enclave-processor-sep-firmware-decyrpted/

does this mean people will be able to pull out stored credentials?

this news is from august so you tell me

# ? Nov 27, 2017 06:38

Adbot: ADBOT LOVES YOU

# ? May 22, 2024 18:31

Amethyst: Mar 28, 2004; I CANNOT HELP BUT MAKE THE DCSS THREAD A FETID SWAMP OF UNFUN POSTING
plz notice me trunk-senpai

anthonypants posted:

this news is from august so you tell me

# ? Nov 27, 2017 06:41

haveblue: Aug 15, 2005; Toilet Rascal

maybe, eventually? having the firmware and api deets alone won't instantly unlock it because the enclave doesn't implement credential export at all, someone's going to have to find an exploitable bug in it

# ? Nov 27, 2017 06:43

Subjunctive: Sep 12, 2006; ✨sparkle and shine✨

not yet, but it might accelerate development of such exploits

# ? Nov 27, 2017 11:09

Potato Salad: Oct 23, 2014; nobody cares

It's no less secure than open source software. Now it's time to look for logical errors.

# ? Nov 27, 2017 14:55

BangersInMyKnickers: Nov 3, 2004; I have a thing for courageous dongles

spankmeister posted:

Stop engaging fishmech.

like anyone would propose in the first place

# ? Nov 27, 2017 14:58

Jewel: May 2, 2009

egh.. everything makes me depressed

https://twitter.com/nxthompson/status/934256826237046785

# ? Nov 27, 2017 15:07

Volmarias: Dec 31, 2002; EMAIL... THE INTERNET... SEARCH ENGINES...

Jewel posted:

egh.. everything makes me depressed

https://twitter.com/nxthompson/status/934256826237046785

Not new, and ultimately wonderful ammo for the inevitable lawsuit, until it reaches the supreme court which rules that the poor don't have human rights in a 5-4 decision.

# ? Nov 27, 2017 15:13

Shame Boy: Mar 2, 2010

Volmarias posted:

Not new, and ultimately wonderful ammo for the inevitable lawsuit, until it reaches the supreme court which rules that the poor don't have human rights in a 5-4 decision.

alternatively they rule that bots have human rights if owned by large enough corporations

# ? Nov 27, 2017 15:51

flakeloaf: Feb 26, 2003; Still better than android clock

we hold that the free market is a juridical person and therefore that its rights cannot be infringed by oppressive regulations, therefore poors can get hosed

# ? Nov 27, 2017 15:59

a witch: Jan 12, 2017

idgi. Americans are mad that the government they elected is following through on its campaign promises?

# ? Nov 27, 2017 16:04

Just-In-Timeberlake: Aug 18, 2003

a witch posted:

idgi. Americans are mad that the government they elected is following through on its campaign promises?

we prefer that lube be used

# ? Nov 27, 2017 16:09

Workaday Wizard: Oct 23, 2009; by Pragmatica

Just-In-Timeberlake posted:

we prefer that lube be used

# ? Nov 27, 2017 16:14

geonetix: Mar 6, 2011

Was this posted yet? https://blog.imgur.com/2017/11/24/notice-of-data-breach/

Because, of course.

# ? Nov 27, 2017 16:16

Workaday Wizard: Oct 23, 2009; by Pragmatica

let he without breach cast the first lol

# ? Nov 27, 2017 16:27

susan b buffering: Nov 14, 2016

a witch posted:

idgi. Americans are mad that the government they elected is following through on its campaign promises?

the majority of Americans that voted didn't vote for this government

# ? Nov 27, 2017 17:08

Farmer Crack-Ass: Jan 2, 2001; this is me posting irl

a witch posted:

idgi. Americans are mad that the government they elected is following through on its campaign promises?

yeah if you didn't vote for the government that was elected it's pretty common to be angry at following through on the things they promised to do, especially when a big motivator for voting for someone else was because those campaign promises were things you explicitly did not want to happen

# ? Nov 27, 2017 17:41

MrMoo: Sep 14, 2000

skull mask mcgee posted:

the majority of Americans that voted didn't vote for this government

but the majority of the United States of America did 🇺🇸

The States are a weird anachronism for the most part, it's certainly not conducive to a secure government network which is why it is nice to see AWS GovCloud :yaycloud:

# ? Nov 27, 2017 17:50

Zil: Jun 4, 2011; Satanically Summoned Citrus

Just-In-Timeberlake posted:

we prefer that lube be used

Also being taken out to drinks or dinner first.

# ? Nov 27, 2017 17:55

spankmeister: Jun 15, 2008

BangersInMyKnickers posted:

like anyone would propose in the first place

Do you, Fishmech, vow to only argue in bad faith, and to move goalposts constantly, till death do these forums part?

spankmeister fucked around with this message at 18:19 on Nov 27, 2017

# ? Nov 27, 2017 18:16

Crime on a Dime: Nov 28, 2006

well, this thread is hosed again

# ? Nov 27, 2017 18:18

flakeloaf: Feb 26, 2003; Still better than android clock

Shinku ABOOKEN posted:

let he without breach cast the first lol

Hello, is this a deliverance order? REEEEEEEE

# ? Nov 27, 2017 18:36

post hole digger: Mar 21, 2011

https://www.thedailybeast.com/nbas-golden-state-warriors-spied-on-fans-via-smartphone-app-lawsuit-alleges

Insane terrible app idea is even more terrible than a normal person would expect

quote:

The Warriors� app bills itself as a way for fans to keep track of scores and stats. But while fans were watching the game, the app was watching them, fan LaTisha Satchell claims in a lawsuit. One of the app�s promotional tools allegedly turns a user�s phone microphone on and keeps it on, recording everything within earshot and relaying data back to the Warriors and a tech company, possibly in violation of wiretap laws.

�[The Warriors] gained access to tens of thousands of microphones belonging to consumers who downloaded the Warriors App and turned their mobile devices into bugged listening devices,� the suit alleges.

The unlikely snooping program started as an effort to sell merchandise and ticket upgrades, the suit contends. The Warriors wanted to know when fans were on Warrior-owned property, and how long they stayed there. The app tracked this through audio �beacons� that played through special transmitters in their arena and stores, the suit alleges. The app listened for those beacons and sent customized advertisements to a user�s phone.

An app user sitting in the nosebleed seats at a Warriors game might get a notification suggesting they upgrade to tickets with a better view. A fan in the gift shop might get an alert about a special promotion on merchandise.

The Warriors� technology partners said fans were fine with the notifications.

�You�re not going to get mad at the Golden State Warriors and go to some other arena instead,� the CEO of the company that installed the beacons told Bloomberg earlier this year.

But the app allegedly didn�t stop when fans left the arena. Instead, it constantly listened in and recorded conversations, even when fans weren�t directly using the app.

Satchell first filed her suit last year, accusing the Warriors of snooping on fans� conversations. But a judge slapped down the suit, claiming Satchell didn�t provide enough information about the conversations the Warriors allegedly recorded.

In an amended complaint filed earlier this year, Satchell described the personal information the app could have intercepted, including conversations with her husband in their bedroom, private business meetings, and discussions with a loan officer.

During all these conversations, Satchell had her phone within earshot, which means the app was recording through her microphone she says.

The app funneled data back to computer program, which let analysts monitor users� actions, the suit claims. The suit includes a screenshot from the Warriors� data-tracking platform, which shows a graph of how long 2,178 app users stood in a single location in or near the Warriors� arena. (The average user stood in that spot for one minute and 25 seconds.) The data-scraping program could be tailored to track a user�s �in-location customer path,� the suit claims.

Users likely didn�t know the app was monitoring their locations and listening in through their microphones, the suit alleges. When Satchell downloaded the app last spring, it asked users for permission to use their microphones, but did not suggest that the microphones would be running in the background, or used to track location, she says.

And even if users didn�t want the app to use their microphone, they would have to turn off the app�s suggested settings.

# ? Nov 27, 2017 20:08

flakeloaf: Feb 26, 2003; Still better than android clock

quote:

The Warriors wanted to know when fans were on Warrior-owned property

if only there were some system that you could use to find the position of something on the globe

# ? Nov 27, 2017 20:14

pseudorandom name: May 6, 2007

people know enough not to give apps location privileges

# ? Nov 27, 2017 20:17

Cocoa Crispies: Jul 20, 2001; Vehicular Manslaughter!; Pillbug

pseudorandom name posted:

people know enough not to give apps location privileges

and they're learning to not give them mic privs either

# ? Nov 27, 2017 20:27

Just-In-Timeberlake: Aug 18, 2003

my bitter bi rival posted:

https://www.thedailybeast.com/nbas-golden-state-warriors-spied-on-fans-via-smartphone-app-lawsuit-alleges

Insane terrible app idea is even more terrible than a normal person would expect

quote:

But a judge slapped down the suit, claiming Satchell didn�t provide enough information about the conversations the Warriors allegedly recorded.

look i need this stuff spelled out for me, don't expect me to imagine what it could have recorded

# ? Nov 27, 2017 20:42

Shame Boy: Mar 2, 2010

was it in this thread or somewhere else where i saw that app that encourages you to "be more confident!!!" where you tell it some goal (through voice commands obviously) like "i want to talk at least once in this meeting" and then let it sit on the desk listening to everything around it while you're in your important business meeting and then it gives you helpful ~~marketing~~ critiques after analyzing the meeting

# ? Nov 27, 2017 20:44

infernal machines: Oct 11, 2012; we monitor many frequencies. we listen always. came a voice, out of the babel of tongues, speaking to us. it played us a mighty dub.

lol, no loving way.

that's just too much.

what if corporate espionage, but an app?

# ? Nov 27, 2017 20:47

Shame Boy: Mar 2, 2010

here it is, excuse the lovely mashable link it's the first google result: http://mashable.com/2017/10/18/allai-app-speak-up-in-meetings/#B8xmWO6_DOqx

quote:

When men and women collaborate to solve a problem�say, in a meeting�women speak at least 25 percent less than men do.

That's why a team at BBC's 100 Women Challenge developed an app called All.ai to help women boost themselves at work�and to help everyone else quiet down and listen. The iOS and Android app isn't available to download quite yet, but should be coming to the App Store soon.

...

If you open All.ai before stepping into a meeting, the app will tell you during what portion of the meeting your voice was heard. Users can elect to use the app to help themselves speak up more, or for the allies referenced to in the app's name, to try to talk less and support anyone who's often ignored when they speak during meetings.

...

Along with recording how much of the meeting you spent talking, the app will offer helpful tips to be a better ally in the workplace, like "Shift your body language toward a speaker to signal their authority."

You can also record yourself setting a goal before a meeting, like "recognize someone else in this meeting" or "speak for at least one minute during this meeting."

After the meeting is over, All.ai analyzes your voice to tell you what you sounded like. Was your voice positive or negative? Did you sound authoritative or nervous?

...

The app uses AI to do all of this. Specifically, it relies on IBM Watson's voice recognition tools to translate voice to text and then analyzes the text. The app says it doesn't store any information about what's happening in your meeting�only following voices and interpreting the feelings behind them.

Shame Boy fucked around with this message at 21:00 on Nov 27, 2017

# ? Nov 27, 2017 20:58

flakeloaf: Feb 26, 2003; Still better than android clock

it's the self-help book, but in app form

resolving to take less poo poo and speak up in meetings is the hard part; once you've done that, what can an app do that a sticky note or a piece of string on your pen can't? just say the words and if todd talks across you, tell todd to not talk while you're speaking and keep right on truckin

gently caress you todd

# ? Nov 27, 2017 21:00

hobbesmaster: Jan 28, 2008

Just-In-Timeberlake posted:

look i need this stuff spelled out for me, don't expect me to imagine what it could have recorded

that�s literally how lawsuits work, yes

# ? Nov 27, 2017 21:03

Bunni-kat: May 25, 2010; Service Desk B-b-bunny...
How can-ca-caaaaan I
help-p-p-p you?

hobbesmaster posted:

that�s literally how lawsuits work, yes

Plaintiff: It recorded private conversations.

Judge: I�ll need the content of those private conversations.

Seems counterproductive.

# ? Nov 27, 2017 21:44

hobbesmaster: Jan 28, 2008

Avenging_Mikon posted:

Plaintiff: It recorded private conversations.

Judge: I�ll need the content of those private conversations.

Seems counterproductive.

Judge: which private conversations, when?

# ? Nov 27, 2017 22:08

flakeloaf: Feb 26, 2003; Still better than android clock

defendant: "is it possible the conversations weren't private?"

witness: "errrrrrr ummmm"

judge: "dismissed, get out"

# ? Nov 27, 2017 22:10

RFC2324: Jun 7, 2012; http 418

Avenging_Mikon posted:

Plaintiff: It recorded private conversations.

Judge: I�ll need the content of those private conversations.

Seems counterproductive.

Thats when you let the judge listen to 30 recording hours of you loving

# ? Nov 27, 2017 22:21

flakeloaf: Feb 26, 2003; Still better than android clock

RFC2324 posted:

Thats when you let the judge listen to 30 recording hours of you loving

who has hosed 11000 times

# ? Nov 27, 2017 22:24

RISCy Business: Jun 17, 2015; bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork bork; Fun Shoe

flakeloaf posted:

who has hosed 11000 times

you're mom!!!!!!

# ? Nov 27, 2017 22:30

Bunni-kat: May 25, 2010; Service Desk B-b-bunny...
How can-ca-caaaaan I
help-p-p-p you?

hobbesmaster posted:

Judge: which private conversations, when?

It just seems like the fact recording happened should be more important than what was recorded. If I went and downloaded this on Friday and had a quiet weekend alone, then Monday morning find out it�s recorded me I�m less deserving of legal protection?

# ? Nov 27, 2017 22:33

Adbot: ADBOT LOVES YOU

# ? May 22, 2024 18:31

Just-In-Timeberlake: Aug 18, 2003

Avenging_Mikon posted:

It just seems like the fact recording happened should be more important than what was recorded. If I went and downloaded this on Friday and had a quiet weekend alone, then Monday morning find out it�s recorded me I�m less deserving of legal protection?

depends, what's your net worth?

# ? Nov 27, 2017 22:34

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > YOSPOS > Security Fuckup Megathread - v14.1 - Hello, is this a delivery order?

«‹›242 »