• 3 Posts
  • 276 Comments
Joined 5 years ago
cake
Cake day: January 21st, 2021

help-circle
  • https://xkcd.com/1200/ comes to mind.

    Games have no sandboxing anyways. They can access most of the data on the systems on which they run. Whether the game, crack or a HV crack makes little difference.

    Sure, running a hypervisor or kernel level does allow them a bit more access, mostly around persistence. But I don’t think it is a huge difference to most people.

    So IMHO you are already putting a lot of trust in any pirated software or crack, hypervisor bypasses are really just a small matter of degree. If you don’t trust the crack don’t run it. Easy as that. Or if you want robust protection run games on dedicated hardware with no personal information or in a dedicated untrusted gaming VM.





  • kevincox@lemmy.mltoPrivacy@lemmy.mlPasskeys
    link
    fedilink
    arrow-up
    17
    ·
    19 days ago

    There are a few main benefits.

    1. For hardware-backed keys they can’t be stolen aside from physically stealing the hardware. So unless your machine has malware there is no way for an attacker to authenticate using them.
    2. Even for software keys the site you authenticate to doesn’t learn enough to impersonate you. For example if for some reason your bank leaked some logs with PW + MFA someone could use that to log in as you (although admittedly short timeouts on MFA validity makes that window very small).
    3. The browser ensures that you only authenticate to the correct domain. So it prevents phishing. (Although a password manager that only fills into the correct domain also accomplishes this.)

    So I think if you are using unique passwords with an automated password manager the effective benefit is quite small. However for the “average computer user” who likely has less than 5 passwords that they use for everything it forces a pretty high base level of security.


  • I doubt Gaussian blur is an accurate model of real-world situations.

    At the end of the day if you are worried about the codes being painted over print a few out and paint over them. Then scan with a variety of scanners.

    If I had to come up with some more digital tests I would guess that a few of these are more representative of real-world situations:

    1. Lower contrast. For example lighten or darken the whole code. This would simulate things like scanning in low light or with glare.
    2. Block out sections of the code. This will test error correction levels and simulate partial damage or pockets of extreme glare.
    3. Skew the code in various ways. This simulates the perspective shift of people scanning the code from an angle.

    Ideally combine them in a bunch of scenarios then try to scan with a variety of scanner implementations.




  • I feel like this is getting at something interesting and revealing but I am not convinced by what it says.

    “There is no limit to the type of WhatsApp message that can be viewed by Meta,” the agent wrote in the email. He added that “Meta can and does view and store all the text messages, photographs, audio and video recordings” in an unencrypted format.

    I highly doubt this is true. This is because there are third party clients such as https://github.com/mautrix/whatsapp that send E2EE encrypted messages on WhatsApp. If literally all messages where available in an unencrypted format it would mean one of the following things.

    • The E2EE protocol is broken and Meta knows the “crack”.
    • That official client does a completely different protocol which uploads all messages in addition to doing the E2EE protocol.

    Security are also reverse-engineering the official client. So if it was regularly doing this I would assume someone has noticed.

    What I suspect is happening is that some features in the client (like Meta AI) are very easy to frequently activate and upload a large amount of messages when Facebook then archives. It would be quite likely that the average user is using these frequently. This could reasonably result in the vast majority of messages being available to Facebook.

    But I think if the reports are exaggerated it doesn’t help sell the case.










  • I’m also not familiar. But my understanding is that the package maintainers should prevent this situation. Because otherwise even if there are package version dependencies (I don’t actually know if pacman does this) it would just block the update which results in a partial update which isn’t supported. For example if your theoretical unmaintained Firefox blocks the update of libssl but Python requires new functionality you would be stuck in dependency hell. Leaving this problem to the users just makes this problem worse. So the package maintainers need to sort something out.

    It is a huge pain when it happens but tends to be pretty rare in practice. Typically they can just wait for software to update or ship a small patch to fix it. But in the worst case you need to maintain two versions of the common dependency. In lots of distros very common dependencies tend to get different packages for different major version for this reason. For example libfoo1 and libfoo2. Then there can be a period where both are supported while packages slowly move from one to the other.


  • IF no dependency tries to update too. Off course in that case I would stop. Without pacman -Sy, I never do that anyway, only -Syu.

    That’s all you need to know. As long as you always use pacman -Syu you will be fine. pacman -Sy is the real problem. The wiki page is pretty clear about the sequences of commands that are problematic https://wiki.archlinux.org/title/System_maintenance#Partial_upgrades_are_unsupported.

    Right? What i don’t understand is, when I uninstall with pacman -Rs firefox, delete the cached firefox package (only that file), then the system is in the same state as before I installed it. Then -S firefox should be okay, right? And it even looks up the new version.

    This isn’t correct. It won’t look up the new version. Assuming that the system was in a consistent state it will download the exact same package that you deleted. The system only ever “updates” when you run pacman -Sy. Until you use -y all packages are effectively pinned at a specific version. If the version that gets installed is different than the one you removed it probably means that you were breaking the partial update rule previously.


  • But that is my point. Just running pacman -S firefox is fine as long as you didn’t run pacman -Sy at some point earlier. It won’t update anything, even dependencies. It will just install the version that matches your current package list and system including the right version of any dependencies if they aren’t already installed.

    But that means if you already have Firefox installed it will do nothing.