richardowright

When the ID changes on the tag, a nearby device can link the two id's together since they're in the same 'position' (i.e. id x was at y position and now id z is there, so id x = id y). However, someone who is not there wouldn't be able to link those ID's together. This gets you the privacy feature and the anti-stalking feature. (The anti-stalking feature likely wouldn't need a perfect series of matches; if you have a good chain of them, you'd have good confidence.)

Does this include access to thinks like the Azure Control Plane components? In my mind, that code has a different exposure.

I've also been having this issue with ATT Fiber, but I'm out of Atlanta.

Try CDAP - https://cdap.io/ . Open source with Google backing it.

Or use the opensource take of it - https://cdap.io/

Seeing a translation of "(security) driver slayer".

https://twitter.com/DAlperovitch/status/1293948157618003969

They do have a very comprehensive simulation system with a large part of the work being done at Dobbins Air Force Base just outside of Atlanta. From what I understand, the team is quite small (<10).

Why not use reverse verbal passwords (i.e. have the bank give you a secret phrase)? That should eliminate a large amount of issues without the need for a call back.

Sprint's towers were built for it's CDMA network running in the 1900 MHz spectrum. However, their LTE network primarily run at the 2.5GHz spectrum which has far less range/requires a different cell tower spacing. As a result, they have coverage gaps on the LTE network. If they moved to VoLTE, they'd drop a lot of calls due to the gaps, so they've primarily kept voice on the CDMA network.

Full post from eclypsium https://eclypsium.com/2019/01/26/the-missing-security-primer....

Also I assume aws baremetal servers are not vulnerable due to the nitro security card (https://m.youtube.com/watch?feature=youtu.be&v=e8DVmwj3OEs&t...).

I imagine you just "replay" the issued/signed JWT to Facebook, so you can act like that user.

Any plans to publish the results from the pbkdf2 version?

It seems to me like the breach may still be ongoing/the vulnerability may still exist. In the announcement, they use "have been" as in its actively occurring. Additionally, in the press release (http://ir.homedepot.com/phoenix.zhtml?c=63646&p=irol-newsArt...), they don't indicate that the breach has stopped; they only say they have taken aggressive action.

It seems unlikely that the attack would continue since the attackers have lost their cover, but the wording is a bit strange.

I also think that since this would be exploited against non-state actors as well as states changes the payouts calculations significantly. Much, if not most, of the value is derived from exploiting non-state actors (i.e. Al Qaeda) who almost certainly would not have this capability or would not be able to keep it quite if they did. By signaling to the state actor on these capabilities, they would be giving up the value of exploiting the information from the non-state actors. So, even if you believed that state actors had these capabilities, it may be better to be kept a secret between the two countries and allow low priority secrets to be exploited than to have the info publicly known and the capability lost.

Something still doesn't add up for me on this.

1. How does this explanation relate to the slide that the US is the World's Telecommunication Backbone? The only explanation I can think of is that Google, etc... were only providing information for servers that were physically in the US.

2. How does this prism name relate to the program? To me, the prism name seems more linked to fiber optic cable than to this sort of data monitoring. Perhaps it's an allusion to splitting the data stream and reflecting it to the NSA.