g_p

10 ms·

1.
by g_p 16d ago
The data broadcast from ADS-B includes both GPS position (Lat + Lon) and altitude. If you created a bounding box, you could add a height parameter to make it 3D, and get a list of such aircraft and the timestamps of their transmissions whil
2.
by g_p 4mo ago
Yes, you should be able to. In essence, the state of the TPM is represented in the values of the PCRs (Platform Configuration Registers). Those are hash-extended through the boot process. You can create a key or similar attribute which has
3.
by g_p 1y ago
Even with a ported number, inbound call routing still heavily relies on the "number range" owner to direct the incoming call to the correct network. If the original number range owner has their subscriber database go down, they ca
4.
by g_p 1y ago
When roaming, your home network is needed for routing incoming calls to you, and handling authenticating your device to the visited network.
5.
by g_p 1y ago
There are absolutely ways to intercept a call from a targeted user that would be viable to use to gain access to a mid to high value user's funds. SS7 call routing and rogue 2G base stations are some potential approaches. In terms of b
6.
by g_p 1y ago
You need a SIM card (ideally) with support for elliptic curve crypto, and some additional fields added in the profile (SIM services 124 and 125). You can then, once those services are enabled, place network public keys on the SIM itself. Th
7.
by g_p 1y ago
In terms of existing examples, there's a few equivalent (or at least similar) fields defined as SIM files - for example, the FPLMN (forbidden PLMN) list of networks your phone shouldn't attempt to attach to. You're right that
8.
by g_p 1y ago
> 5G Standalone security and privacy requirements > To help ensure compatibility of iPhone and cellular iPad devices on private 5G SA networks, infrastructure vendors must adhere to the following security and privacy requirements: &gt
9.
by g_p 2y ago
A lot of the patents needed to implement mobile standards are designated as "standards essential patents", meaning that the party bringing them up the table in the standards committees needs to disclose them and agree to licence t
10.
by g_p 2y ago
You might find Privacy Pass of interest then - https://help.kagi.com/kagi/privacy/privacy-pass.html It should be out in the next day or so.
11.
by g_p 2y ago
There's a couple of options in settings worth checking, as Netguard works for me when roaming just fine. Under Settings > Defaults, make sure you don't have "block roaming" turned on. Expand the rules for the apps giv
12.
by g_p 2y ago
I recently came across a signature check that was (correctly) checking the signature against a public key... The issue was the public key itself was unauthenticated, and provided by the (signed) ciphertext itself... Meaning the crypto was f
13.
by g_p 2y ago
Thanks - yeah it seems like this is supported in FIDO 2.1 (but not 2.0). I suspect this is only implemented in Yubikey 5.7 and above. Once the technology is there to support it, hopefully the user experience part can be improved with time.
14.
by g_p 2y ago
That's a pretty neat solution. I like that idea. If you wanted to go a step further, you could use a smartcard with hardware PIN reader as a PKCS11 crypto device, and use that to decrypt the long lived keys in the store, then pass it b
15.
by g_p 2y ago
That's a fair point, although as the PIN is validated locally, you could argue from the server perspective you gain a second (knowledge) factor, but from a local perspective it's entirely correlated with the existing stored factor
16.
by g_p 2y ago
I share your paranoia and felt that passkeys were a step back as anything getting access to your browser extension memory can realistically dump both your "password" and MFA ("passkey") in one move. I wonder if there wou
17.
by g_p 2y ago
Yeah, a fair point (though if you can't manage keys one by one that seems a massive usability issue and oversight with no safe path to resolution). This adds another step needing considered for a user, as finite storage means a whole e
18.
by g_p 2y ago
The downside of this (at least in my personal view) is it's a regression from the elevated security you got with non-resident FIDO/U2F MFA. The moment you go "passkey" and have to use a system like the one you suggest, y
19.
by g_p 2y ago
TOTP codes are phishable and repayable in real-time - both via web (visiting the wrong site which asks for a TOTP and relays it within a few seconds), and via social engineering over the phone (give us one of the codes to prove it's yo
20.
by g_p 2y ago
Which? is a UK brand, and in the UK it's fairly common to see the postcode (or rather the first couple of digits) used to determine which regional programming a user wants, given the (to some extent historical) TV regions and channel n
21.
by g_p 2y ago
Readeck saves an archived copy of the links you save (where it can). From their docs, "Every bookmark is stored in a single, immutable, ZIP file. Parts of this file (HTML content, images, etc.) are directly served by the application or
22.
by g_p 2y ago
The issue so far seems to be that most OSs don't really have an effective way to restrict that file to a single application. User-oriented filesystem permissions don't work, as all software runs "as" the user. If you ass
23.
by g_p 2y ago
When browsing a site full of JS-heavy ads, sure. When running a browser performance benchmark, generally not - the ad block extension adds an overhead to the page. I saw this when experimenting with Orion Browser on Mac, which uses the Webk
24.
by g_p 2y ago
One other potential area of variability could come from browser extensions - I imagine that users who compare browser power performance are more technical than the median user, and are more likely to run browser extensions (e.g. ad blockers
25.
by g_p 2y ago
It certainly does - if you remain current then not a lot has really changed. If you understand the principles of control systems and how an electrical grid works, this is broadly "just" a grid stability concern. To some extent thi
26.
by g_p 2y ago
A good point - perhaps the focus is too heavy on paperwork or "measurable compliance". From experience in this sector though, I think the real issue is a lack of technical awareness and competency with enough breadth to extend int
27.
by g_p 2y ago
Given the challenges of techniques like TLS interception (i.e. through pinning and other good security features), about the only measure I can see left is network isolation. You can set up a local network that has no WAN connectivity on it.
28.
by g_p 2y ago
They don't need to break into separate sites though - the issue at hand is that a single failure in the centralised "control plane" from the vendor (i.e. the API server that talks to consumers' apps) can be incredibly vu
29.
by g_p 2y ago
The Microsoft view is that LTSC is for "single purpose devices", more akin to appliances or embedded systems ( https://learn.microsoft.com/en-us/windows/whats-new/ltsc/ove... ) Those tend to be s
30.
by g_p 2y ago
There absolutely are access control systems out there using PKI. For example, the PIV specification (a la DOD CAC) slot 9e is intended for "card authentication" without a PIN typically being required. PKCS based cards get all the

More ›