There have been multiple accounts created with the sole purpose of posting advertisement posts or replies containing unsolicited advertising.

Accounts which solely post advertisements, or persistently post them may be terminated.

PastaGorgonzola

@[email protected]

This profile is from a federated server and may be incomplete. Browse more on the original instance.

PastaGorgonzola ,

You can follow the steps here to use a previous version of the desktop app to extract the keys: gist.github.com/…/94bb0c11a6209c82418d01a59d958c9…

The javascript didn’t seem to send the extracted data anywhere, but I did disconnect from the internet while running the script.

T-Mobile sued after employee stole nude images from customer phone during trade-in (www.cnbc.com)

T-Mobile sued after employee stole nude images from customer phone during trade-in::T-Mobile has been sued again for failing to protect consumer data after an employee at one of its Washington stores stole nude images off of a customer’s phone.

PastaGorgonzola ,

Remote wipes are possible. Log into your Apple/Google account, figure out how to find your device, then perform a remote wipe.

PastaGorgonzola ,

The biggest difference: nothing sensitive is stored on the server. No passwords, no password hashes, just a public key. No amount of brute forcing, dictionary attacks or rainbow tables can help an attacker log in with a public key.

“But what about phising? If the attacker has the public key, they can pretend to be the actual site and trick the user into logging in.” Only if they also manage to use the same domain name. Like a password manager, passkeys are stored for a specific domain name. If the domain doesn’t match, the passkey won’t be found.

www.youtube.com/watch?v=qNy_Q9fth-4 gives a pretty good introduction on them.

PastaGorgonzola ,

That’s the part where the server doesn’t story any information that an attacker could use to log in. The attacker would need the private key, which is stored inside a secure chip on your device (unless you decide to store it in your password manager). All that’s stored server side, is the public key.

When you’re using a password, the server will store a hashed version of that password. If this is leaked, an attacker can attempt to brute-force this leaked password. If the server didn’t properly store hash the password, a leak simply exposes the password and allows the attacker access. If the user didn’t generate unique passwords for each site/server, that exposes them further to password spraying. In that case an attacker would try these same credentials on multiple sites, potentially giving them access to all these accounts.

In case of passkey, the public key doesn’t need to be secret. The secret part is all on your end (unless you store that secret in the managed vault of your password manager).

I do agree that your risk is quite small if you’re already

  • using a decent password manager
  • doing that the right way
  • have enabled 2FA wherever possible
PastaGorgonzola ,

Take this

PastaGorgonzola ,

It gets worse: it’s extremely addictive. Research has shown that habitual users who want to detox die within 48 hours unless they start consuming it again.

PastaGorgonzola ,

Not sure what part you don’t understand, but I’ll try and help: Snopes (a fact checking website) shows that the way links are displayed nowadays (the new link presentation or new way links are presented) on X (formerly Twitter) lacks any sense -> snopes shows the folly of it.

PastaGorgonzola ,

Unless you have siblings. Then you’re the less successful evolutionary branch that died out.

PastaGorgonzola ,

I’m going to have to stop replying because I don’t have the time to run every individual through infosec 101.

Sorry, but you’re missing the point here. You cannot do anything with a password without storing it in memory. That’s not even infosec 101, that’s computing 101. Every computation is toggling bits between 1 and 0 and guess where these bits are stored? That’s right: in memory.

The backend should never have access to a variable with a plaintext password.

You know how the backend gets that password? In a plaintext variable. Because the server needs to decrypt the TLS data before doing any computations on it (and yes I know about homomorphic encryption, but no that wouldn’t work here).

Yes, I agree it’s terrible form to send out plain text passwords. And it would make me question their security practices as well. I agree that lots of people overreacted to your mistake, but this thread has proven that you’re not yet as knowledgeable as you claim to be.

ELI5: Legitimate-interest cookies (kbin.social)

So almost every GDPR cookie consent banner out there has a section for "legitimate interest" cookies that they can leave on by default and you will inadvertently accept even if you choose "Reject all" unless you go to the detailed settings and disabled those too....

PastaGorgonzola ,

It’s rather vague to me too, the most helpful summary I found was this one:

In general, the condition applies when:

  • The processing isn’t required by law, but there’s a clear benefit to it;
  • There is little risk of the processing infringing on data subjects’ privacy; and
  • The data subject should reasonably expect their data to be used in that way.

So “we don’t have to do this, and most likely it won’t be privacy sensitive, and you probably already know we want to do this, but you can still opt out”

Source: itgovernance.eu/…/the-gdpr-legitimate-interest-wh…

PastaGorgonzola ,

Three genders, and 5 words for “the”: der, die, das, dem, den. Depending on the gender of the noun and its function in the sentence.

PastaGorgonzola ,

Serves me right for trying to show off :D

PastaGorgonzola ,

“God bless America” seems a more apt comparison. Seeing as “Sieg Heil” was meant to glorify Hitler, rather than inspire pride of the country. Besides that, comparing Ukraine to Nazi Germany seems a bit too “Russian propaganda” for my tastes.

How does a signing a post with a pgp key prove that you are actually the person behind the post?

I saw that people on the dark web would sign their posts with a PGP key to prove that their account has not been compromised. I think I understand the concept of how private and public keys work but I must be missing something because I don’t see how it proves anything....

PastaGorgonzola ,

What you are doing is exporting your key. Your public key is indeed something you can (and should) share as it enables others to verify that you are indeed who you claim to be (or more accurately, that you’re in control of the private key that’s linked to that public key). So while you should share your public key, your private key must remain private.

What these people on the dark web are doing is one step further: they sign their messages with their private key. This creates a cryptographic signature that’s different for each message (changing a single character in the message will generate a wildly different signature). Anyone with the public key can simply copy that message including the signature and validate it. If even a single character of the message was changed, the signature will not be valid. Thus ensuring others that the person who posted the message is indeed in control of the private key.

Signing is different from encrypting: while encryption renders your message totally unreadable to anyone without the correct key, signing doesn’t change the message itself. It simply appends a signature allowing others to check that the message wasn’t tampered with.

PastaGorgonzola ,

If this is some kind of messaging board, you’d probably put your public key in your profile (I assume that since OP is talking about the dark web that the posters there would rather not share their actual identity).

Let’s talk about Alice, Bob and Eve. Alice is an active poster on a dark web forum. She puts her public key on her profile and uses the corresponding private key to sign her messages. If Eve wants to pretend to be Alice, Eve can simply put her own public key on her profile and sign messages with her own private key. But Bob is smart. Rather than just looking at the profile of the poster and copying their key every time, Bob saved it in his key store and assigned it to Alice (possibly even marked it as trusted). When Bob sees a post by Eve, he’ll try to validate it. This validation might succeed (if Bob has access to Eve’s public key), but it will be clear that the message wasn’t signed by Alice’s key.

Of course, this all assumes that Bob has quite some knowledge of how this works and is vigilant enough to perform all these validations correctly.

As for the regular internet, there are some services where you can share your public key: keys.openpgp.org is one of these. Of course, as /u/[email protected] says, there’s still the matter of trust. You need to make sure that the public key you’re using is actually from the right person.

PastaGorgonzola ,

I’m not convinced by this argument: at the back of the phone is a built-in LED (used as the flash). Which could be used for notifications too.
Phones with OLED screens could use part of the screen as a notification as well. Both of these can be accomplished in software. Currently you have to notice that something happens as it happens, otherwise you need to at leas activate the screen. The notification LED was useful in that you could glance at your phone and see if you missed something.

  • All
  • Subscribed
  • Moderated
  • Favorites
  • •
  • random
  • lifeLocal
  • goranko
  • All magazines
    •