HackinOut
Joined 12 years ago
Karma
140
Submissions
101
Member since
May 5
Recent submissions
Comment · 10 years ago
That is either by using the "connected version" or loosing the multi devices ability. BTW shouldn't the "connected version" be the one detailed on the home page? Sure sounds more attractive to me.
Comment · 10 years ago
I wouldn't use a password manager system that doesn't have the ability to change the master password.
EDIT: You can't change any password really, without changing all of them (or having a separate master password). Seems unpractical as soon as, for example, site X gets its database hacked.
Comment · 10 years ago
I can't believe Nigel Farage and a lot of pro Brexit campaigners have been calling it UK's "Independence day". Apart from being a very bad (purposeful?) analogy, it's seems to me pretty disrespectful to their own and to US history. I'm not from USA (or UK) but would love to hear how US and UK people feel about it?
Comment · 11 years ago
Not aware of anything from Apple about this issue. It was just an assumption, sorry. What I did is test up to date devices (i think i even tested an up to date iOS 6) and couldn't get any specific SSID. The probe requests were still there, but SSID parameter was always set to Broadcast.
However I did see a lots of probe requests WITH a SSID parameter set but those were not coming from my devices :). I assumed they were not up to date.
I am very interested to know if the probe requests you're seeing are also coming from unknown devices: if they aren't, could you provide us with the iOS version you're using/testing with?
Comment · 11 years ago
It doesn't seems to be iOS 8 only. Recent versions of iOS 7 seem to be fixed as well. (Tested my phone earlier this week)
Comment · 11 years ago
My iPhone do connect auto-magically to FreeWifi_secure networks which is the preloaded SSID for the other french operator listed by Skycure.
However it's supposed to connect with EAP-SIM [1]. Skycure mentions that "some of [those] bundles include SSID passwords". Do they mean that only those would make devices vulnerable? Could you let us know if SFR uses EAP-SIM or a basic PSK?
It could be that iPhones connect automatically only to EAP-SIM preloaded networks.
Comment · 11 years ago
> (because iOS devices broadcast this when scanning for networks IIRC?)
Not anymore, Apple fixed that in recent iOS versions. Probe requests are not divulging SSIDs anymore. However WifiGate uses common SSIDs and network operators preloaded ones as honeypots.
Comment · 11 years ago
Good point for Apple. But I wouldn't call having your computer fixed 4 times in ~2 months lucky... Every brand seems to be having reliability problems with their products nowadays (in software as well as hardware). More than in the past. Or maybe it's just me, unlucky as you are... I really have no idea what my next laptop will be...
Comment · 11 years ago
Double standards are also seen in their "Removal Instructions" post on their forum. When uninstalling SuperFish, it seems suddenly important to remove the root certificate...
"It is very important to delete the certificate even though the application itself has been removed."
http://forums.lenovo.com/t5/Lenovo-P-Y-and-Z-series/Removal-...
Didn't seem that important earlier today: https://web.archive.org/web/20150219151726/http://forums.len...
"files in user directory will stay intact for the privacy reason. Registry entry and root certificate will remain as well. "
Comment · 11 years ago
Komodia, the company behind the tech contracted by the maker of SuperFish, actually (tries) to makes sure invalid and self-signed certificate do generates a warning in the browser. And then they password protect the private key with... the name of their company?!?
http://www.komodia.com/wiki/index.php?title=SSL_Digestor#Cer...
"Also the module tries to verify that the certificate is indeed signed by an approved signer, it will use the CA store of the browser used to verify that (for Internet Explorer the Windows store will be used, and for Firefox the NSS store will be used), if the certificate isn't legit, the created certificate will be created in a way it would raise an alert to protect the user."
A huge ugly hack...
Comment · 11 years ago
"We have thoroughly investigated this technology and do not find any evidence to substantiate security concerns."
http://forums.lenovo.com/t5/Lenovo-P-Y-and-Z-series/Removal-...
"This article will be updated with additional instructions on clean up of deactivated files and removal of certificate shortly."
This was just edited in, here is the post before that: https://web.archive.org/web/20150219151726/http://forums.len...
So, Lenovo, why should we remove this certificate after all? Any security concerns perhaps?
Comment · 11 years ago
Wow...
Now Lenovo is "soon" going to explain how to remove this certificate after the "uninstall" in a buried forum post...
http://forums.lenovo.com/t5/Lenovo-P-Y-and-Z-series/Removal-...
Comment · 11 years ago
"This article will be updated with additional instructions on clean up of deactivated files and removal of certificate shortly."
This was just edited, here is the post before that: https://web.archive.org/web/20150219151726/http://forums.len...
Comment · 11 years ago
Not if the proxy checks the certificate of the site it's connecting to and doesn't trust it's own self-signed cert (there is no point in doing so if it's pure adware). But yeah... I have no idea what it does...
Comment · 11 years ago
Except if the adware just modify OS proxy settings, like madeofpalk mentioned. Firefox does not take those into account.
Twitter: @HackinOut