NotPractical
Joined 6 years ago
Karma
1,422
Submissions
447
Member since
May 19
Recent submissions
Comment · 8 days ago
By GrapheneOS, they mean "official builds of GrapheneOS". If you build GrapheneOS yourself, you won't be allowed to use these banking apps due to remote attestation.
Comment · 11 days ago
For example:
Comment · 29 days ago
Comment · 2 months ago
> The thing I admire most about Anglo-American culture is that people will jump off a bridge if you give them a court order that complies with all required procedural formalities.
The president of the United States routinely violates court orders and has little respect for the law or the Constitution. Also, nobody is going to willingly jump off a bridge because a judge told them to. You'll find that the death penalty isn't carried out by asking people politely to kill themselves.
Comment · 2 months ago
Could do with some context on how watermarking works. Objectively speaking it should be impossible to tell.
Comment · 2 months ago
> Apple's internal justification for this is that the iPhone and iPad are consumer devices designed for maximum comfort and safety, whereas the Mac is a device designed for developers and professionals.
Then why did they recently launch a MacBook that costs less than an iPhone and a marketing campaign targeted at existing iPhone users?
> If you love iPhone, you'll love Mac. Mac is designed to be just as easy to learn as iPhone.
Comment · 3 months ago
> Microsoft has a list of IP addresses that has been used by a computer with a certain GDID, but FBI needs to get the GDID in the first place
What they did was the opposite: ask Microsoft for GDIDs used by attacker-associated IPs within several 24-hour time periods during which attack-related activity took place. Windows pings Microsoft regularly with the GDID, establishing links between your GDID and any IP addresses you use. The IP logs from Microsoft and the VPS provider showed at least 10 instances where a single VPN IP accessed the attacker's VPS and also pinged Microsoft with at least one GDID within a 24-hour period. They found a constant GDID that all instances shared. This seems to have been the most damning GDID-related evidence in the DOJ complaint [1] and yet it wasn't mentioned in the article you linked (or any other articles about this I've seen pop up on HN). It includes the diagram from the complaint (page 18) that outlines this, but devoid of context. The ngrok stuff that the article focuses on was just the cherry on top and was discussed later in the complaint.
What also becomes clear when you read the complaint is that the GDID was just one piece of the puzzle and that they had plenty of other evidence. Attacker-associated IPs were used to access the suspect's Apple, Snapchat, and Facebook accounts, at least one of which was his actual residential IP, not a VPN IP. Once they had revealed the identity of the person who owned these accounts, they were able to all-but-confirm that this was in fact the attacker.
What remains unclear even after reading the complaint is how they were so sure that the GDID they obtained visited specific websites, but honestly, at that point, they were already drowning in evidence, so I don't know if it matters that much. It could be as simple as "he was signed into Edge with his Microsoft account and had sync enabled".
[1] https://www.justice.gov/usao-ndil/media/1450651/dl?inline
Comment · 3 months ago
I think the difference is that, on Windows, there are background services that constantly ping Microsoft with the device ID. A device ID on its own is not really harmful if it's not exposed to the internet.
Comment · 3 months ago
I have bad news for you if you think GrapheneOS isn't going to accept this patch from upstream if it lands.
Comment · 3 months ago
There is no information about the author of this article, and it has the "AI smell". It's safer to operate under the assumption that it is AI generated unless and until the author reveals themself or at least anonymously confirms that it is not AI generated. This saves you from having made a fool of yourself by spreading it around, if it later becomes apparent that AI wrote it.
Comment · 4 months ago
> A next version of the Technical Specifications for Age Verification Solutions will include as an experimental feature the Zero-Knowledge Proof (ZKP) solution
From: https://ageverification.dev/av-doc-technical-specification/d...
The EU reference implementation is adding ZKP.
Comment · 4 months ago
Except that within days of this service going live there's going to be a freeageverification.com that instantly generates an attestation proof for anyone for free. I fail to see how this is not untenable. You can compare it to geoblocks that can be circumvented using VPNs, but at least VPNs are costly to run and are usually paid services. With the implementation of verification (ZKP) described in the article, there is no cost to generate attestation proofs nor any limit on the number of proofs nor any way to stop a known-but-anonymous abuser from generating new proofs.
Maybe the EU knows it's untenable and is still moving forward because they will be able to demonstrate to the public that privacy enables abuse, creating pretext to make the system not private anymore after it's already been implemented.
Comment · 4 months ago
Not to mention self-signed custom builds of GrapheneOS.
Comment · 4 months ago
> I think it would be nice if we could run unsigned apps on iOS
Apple enforces those restrictions via the permanently locked bootloader. The main benefit of unlocking the bootloader on an iPhone would be to run a modified version of iOS that allows for the installation of unsigned apps. Apple wouldn't like it and might even get litigious over it, but still.
> (in the US)
Apps intended for release onto alternative app stores in the EU, Japan, and Brazil still need to be approved and signed by Apple. These laws were nearly useless.
Comment · 4 months ago
...it's still large enough to comfortably read without zooming in, which is not the case for Gruber's website.