Register a SA Forums Account here!
JOINING THE SA FORUMS WILL REMOVE THIS BIG AD, THE ANNOYING UNDERLINED ADS, AND STUPID INTERSTITIAL ADS!!!

You can: log in, read the tech support FAQ, or request your lost password. This dumb message (and those ads) will appear on every screen until you register! Get rid of this crap by registering your own SA Forums Account and joining roughly 150,000 Goons, for the one-time price of $9.95! We charge money because it costs us money per month for bills, and since we don't believe in showing ads to our users, we try to make the money back through forum registrations.
 
  • Locked thread
El Mero Mero
Oct 13, 2001

negromancer posted:

In Mother Russia, you run in the background towards a check

El Mero Mero fucked around with this message at 05:37 on Jan 8, 2017

Adbot
ADBOT LOVES YOU

El Mero Mero
Oct 13, 2001

ate all the Oreos posted:

she wasn't pardoned, her sentence was commuted. she's still guilty.

technically a pardon implies guilt if you accept it as well (at least this is what Ford told himself so he could sleep at night)

El Mero Mero
Oct 13, 2001

pctD posted:

320 accounts for me in 1Password. gently caress.

482 :/

I feel like that number actually went up rapidly after I started using a manager since I no longer give a gently caress if I have an account somewhere or not because all of the passwords are unique.

El Mero Mero
Oct 13, 2001

What do people think of dashlane? Or is 100% of the game split between KeepAss, 1pass, and LastPass these days?

El Mero Mero
Oct 13, 2001

Google's tossing all of the Symantec certs

El Mero Mero
Oct 13, 2001

Subjunctive posted:

no they aren't. keep reading

Yes they are:

quote:

To restore confidence and security of our users, we propose the following steps:

A reduction in the accepted validity period of newly issued Symantec-issued certificates to nine months or less, in order to minimize any impact to Google Chrome users from any further misissuances that may arise.

An incremental distrust, spanning a series of Google Chrome releases, of all currently-trusted Symantec-issued certificates, requiring they be revalidated and replaced.


Removal of recognition of the Extended Validation status of Symantec issued certificates, until such a time as the community can be assured in the policies and practices of Symantec, but no sooner than one


They'll all have to be reissued and replaced. I mean, people can still use them, but they won't be trusted.

El Mero Mero fucked around with this message at 17:25 on Mar 24, 2017

El Mero Mero
Oct 13, 2001

God bless the tagger crews who would make short work of that internet of poo poo POS idea

El Mero Mero
Oct 13, 2001

I ended up paying for a 5 year membership to dashlane when they had a deal sometime ago. Here's hoping that the gaze of Tavis doesn't implode them anytime between now and 2021 :ohdear:

El Mero Mero
Oct 13, 2001

theflyingexecutive posted:

just for fun question: can a stingray remotely update your iPhone radio firmware, kick you off wifi, and tunnel all your info through the fake cell tower?

I asked Siri a (not-innocuous) question and moments later:
-all my authentications (apple and email) started failing
-I couldn't connect to my wifi (working for everyone else in the room)
-browser speed was throttled to almost nothing
-going to cell settings spat out a message that my cell radio settings had been updated, apropos of nothing
-resetting my radio did nothing, I had to do a full restore

siri allahu akbar?



edit: some security content:

https://www.wired.com/2017/04/hackers-hijacked-banks-entire-online-operation/amp/ tl;dr brazilian bank lets someone steal their domain name, who then set up a phony copy with valid https certs from lets encrypt.

El Mero Mero fucked around with this message at 04:14 on Apr 11, 2017

El Mero Mero
Oct 13, 2001

Tweet broke for some reason. Here's a direct link to the write-up: https://bugs.chromium.org/p/project-zero/issues/detail?id=1252&desc=5


quote:

On workstations, attackers can access mpengine by sending emails to users (reading the email or opening attachments is not necessary), visiting links in a web browser, instant messaging and so on. This level of accessibility is possible because MsMpEng uses a filesystem minifilter to intercept and inspect all system filesystem activity, so writing controlled contents to anywhere on disk (e.g. caches, temporary internet files, downloads (even unconfirmed downloads), attachments, etc) is enough to access functionality in mpengine. MIME types and file extensions are not relevant to this vulnerability, as MsMpEng uses it's own content identification system.


quote:

Before executing JavaScript, mpengine uses a number of heuristics to decide if evaluation is necessary. One such heuristic estimates file entropy before deciding whether to evaluate any javascript, but we've found that appending some complex comments is enough to trigger this.

The attached proof of concept demonstrates this, but please be aware that downloading it will immediately crash MsMpEng in it's default configuration and possibly destabilize your system. Extra care should be taken sharing this report with other Windows users via Exchange, or web services based on IIS, and so on.


:laffo:

El Mero Mero
Oct 13, 2001

surebet posted:

security fuckup: the poop is trying to touch me edition

pretty sure i previously mentioned the lady that has a similar first name/same last name as me before that keeps using my x.yyyyyy@gmail.com address

what's the best practice here?

Just ignore it/archive it/trash it. If she keeps doing it create a filter to stop her stuff from showing up. You can't stop people from idiotically sending you their stuff, but please don't take advantage of that idiocy. :shrug:


A long time ago I picked up a very generic gmail address, something as common as help@gmail.com (and similar to that). Every time I check that address these days it's a dumpster fire of folks willingly dumping sensitive information to it and convincing every single idiot to stop sending things to it would take up too much time. Hell. I had a visa processing office in Iran cc'ing that address on every passport and visa they processed for months with full color scans of passports attached to every application.

El Mero Mero
Oct 13, 2001

I feel like the wheel has yet to stop on dashlane, but so long as it hasn't yet I'm going to feel like a superior decision maker wrt butt-managers

LET ME HAVE THIS OKAY

El Mero Mero
Oct 13, 2001


god damnit :sigh:

El Mero Mero
Oct 13, 2001

Thought this was kind interesting today: pASSWORD tYPOS and How to Correct Them Securely

Adbot
ADBOT LOVES YOU

El Mero Mero
Oct 13, 2001

Shaggar posted:

I occasionally get PHI faxed to me.

When gmail was in beta I got a bunch of very generic gmail addresses. One of them consistently gets accidental email, and for a while there was an Iranian travel agency automatically cc'ing me on every visa application submitted with full copy scans of people's passports and resumes. Most of the resumes were engineers


im probably on a list

  • Locked thread