QualityReboot
Joined 8 years ago
Joined 8 years ago
There aren't many like-minded people here, and that's kind of nice for a change. I still love San Francisco, but it simply priced me out of living there. I'd rather retire in 5 years here than work another 30 there.
1) He's technically correct, the best kind of correct.
2) That's tptacek you're suggesting to ban. He's a fixture here and has been an outstanding contributor to this community since near the beginning.
One thing that I still haven't found a good answer for that's not mentioned in the guide: what's KDF for?
The new yubikey firmware has release notes here: https://support.yubico.com/support/solutions/articles/150000...
This is the bit that has me lost:
> To remove the transmission and on-card storage of OpenPGP PINs in plain text, the YubiKey supports the Key Derived Function (KDF) functionality. With the KDF function enabled, the PIN is stored as a hash on the YubiKey. When entering the PIN to the OpenPGP Smart Card, the OpenPGP client will only pass the hashed value, never passing the PIN directly. KDF functionality is set on the card itself, and communicated to the client; it is transparent to the user. Should the KDF functionality not be enabled, the PIN function will work as previously. The KDF function is listed in section 4.3.2 of the OpenPGP Smart Card 3.4 spec.
Can someone explain to me how KDF matters at all here?
It seems like the keys are encrypted on the yubikey via pin, or at least protected in hardware via pin, and that the pin is stored on the device. KDF seems to take that plain text pin and replace it with a hashed pin. If you steal my yubikey, it looks like KDF would prevent you from... dumping the PIN? But if you could dump the pin, wouldn't you just dump the key instead? I can't seem to figure out the threat model for this feature.
Out of curiosity, why not mastodon? Do you see a path from Twitter to a federated or decentralized service?
I can't stop the data collection, but I can stop ads. If I ever see an ad, I stop what I'm doing and figure out how to remove that ad from my life forever.
So yeah, I'm fully tracked, and I have no privacy, but at least I'm not being influenced by the ads that come from processing all my data.
I also try to block as much data collection as possible, but I realize that's not fully in my control.
It makes me wonder if using 1.1.1.1 on my network is a crime. Sure my ISP is letting my DNS queries through, but think of all the analytics that they're missing about me.
How about if I run sshd on tcp 22 and it's not blocked?
Is it illegal if I just want to see if a dns change I made has propagated and I query an A record?
It seems obvious (to me) that a judge would say "It's not theft if you're giving it away. If you have a problem with how people are using your free service, add restrictions. Case dismissed."
I would hope that the court uses their human brain to make a judgment of my intent and the intent of the service provider. My intent is to have free DNS access to communicate with my server. The service provider intended to provide a public access point with free DNS and no restrictions on its use. The conclusion should be obvious.
There is no circumventing of any access control here. If a service is giving a public access point, on public spectrum, and they let you connect, and they allow you to use DNS, you should be able to use DNS however their access control systems allow you to use it.
Now if you find an exploit in their captive portal that allows you access to their service, then sure, that's illegal, because you're breaking into something.
You can't circumvent access controls if the access control list is wide open.
DNS tunnelling is not fast or convenient. Places deploying captive portals have probably looked at the risk to their business from it and have decided not to worry about it.
I can't believe that using a slow DNS connection, intentionally made public, to tunnel traffic would be considered theft or criminal.
How many free samples do I have to eat before I'm a theif? I don't believe I'm a thief until the offer for free samples is rescinded.