Interesting. The same PIN that I use to unlock the card on my laptops works on my phone. I'm not sure what would lead to the behaviour you describe!
378 karma · joined January 16, 2012
The only way this kind of auditing could be trusted is if all the secrets are stored on the server that implements the auditing, which is exactly the model I believe that most users of `pass` are trying to avoid.
The "Password Store" app on Android is compatible with `pass` and supports Git and NFC for using the Yubikey Neo to decrypt the passwords.
I remember seeing some guy who had his `pass` Git repository public on GitHub and challenged the world to crack any of them. Myself, it's just git+ssh to a repository on my own server.
Really? What if s/he just decrypted the file themselves and had a look at the content, rather than using the convenient wrapper that a password manager provides?
In order to "steal" IP addresses (get them routed to you) you would need to buy a connection to at least one exchange point, probably several if you want all the traffic for the target to route to you and not just some traffic from some networks. You'd need to buy rackspace somewhere with a connection to the exchange point, install routers, establish BGP peerings with the exchange point (if they're doing route reflection) or with all the other major networks at the exchange.
There are multiple steps along the way where humans would look at the prefixes you were going to be announcing. This would include looking them up in RIPE, but anything more than a cursory inspection would likely reveal your ruse.
At this point it becomes more of a social engineering attack, and even if you got as far as announcing it, there are things like BGPMon that would pick up the fraudulent announcement pretty quickly and you'd likely find that the cable was pulled out of your router pretty fast.
The construct in parent assigns 1 if foo is "falsey", not strictly if it is nil. Even if foo is already initialised but contains a "falsey" value it will be assigned 1.
Back in the day I used to just run "rfcomm bind <mac-address> <channel>". But it turns out BlueZ decided to deprecate (read: stop building by default) the rfcomm command in favour of... wait for it... a barely-documented D-Bus interface.
How much do you have to hate your users before you decide to take away a useful, functional executable and replace it with an unspecified interface over D-Bus that requires hours of research to use rather than 30 seconds of reading a manpage?
Incidentally, Aviation Herald reports[1] that "AC-759 had already overflown taxiway C by about 0.25nm when ATC instructed the aircraft to go around" and further that "it is estimated that AC-759 overflew the first two aircraft by 100 feet".
100 feet isn't much, and I imagine this was utterly terrifying for the pilots lined up on the taxiway, but 0.25nm past the beginning of taxiway C is basically touchdown point on the runway (had they been lined up with it), and they were still 100 feet above the ground. That indicates pretty strongly that the pilot of AC-759 had noticed their mistake and was taking evasive action already, before ATC instructed them to go around.
* Conditions were clear. The pilot landing would have an increasing probability of noticing their mistake from lights on the runway and taxiway as they got closer to landing.
* After being alerted that the pilot landing could see lights on what they thought was the runway, the ATC would likely have paid closer attention to the various tools available to them to see the location and heading of the aircraft.
And finally, the one factor that happened to be the first of these to happen:
* Multiple pilots looking directly toward the oncoming aircraft, one of whom alerted ATC.
Just because this happened first doesn't mean the other things failed or wouldn't have happened.
I still much prefer TOTP whenever possible as the phone is potentially vulnerable to social engineering against the SIM provider.
It could also be a leg-up to American carriers competing on those routes. Another commercial option is a tactic to require implementation of security practices that involve American-made equipment.
I'm sure there are many other possibilities that make more sense than the public explanation, which only seems to make sense if we assume the people protecting us are incredibly stupid. I don't think they are, so the public story is probably just a cover.
I suddenly feel less good about my next dentist appointment.
It's the first time I've found an alternative to google.com that is actually usable (i.e. I find what I'm looking for near the top of the first results page every time I make a search).
You can use Google as one of the results providers, but you won't see any AMP results, and since searx can mix in results from Stack Overflow etc, you might find that a different search engine than Google still gets you good results.
I think Google would pull fewer of these monopolistic tricks if people would realise they have genuine alternatives.