Father, Hacker (Information Security Professional), Open Source Software Developer, Inventor, and 3D printing enthusiast

  • 0 Posts
  • 32 Comments
Joined 1 year ago
cake
Cake day: June 23rd, 2023

help-circle
  • As expected, nobody cares about “reader mode”. Only once in my life has it ever come in handy… It was a website that was so badly designed I swore never to go back to it ever again.

    I forget what it was but apparently I wasn’t the only one and thus, it must’ve died a fast death as I haven’t seen it ever again (otherwise I’d remember).

    Basically, any website that gets users so frustrated that they resort to reader/simplified mode isn’t going to last very long. If I had my way I would change the messages:

    “This website appears to be total shit. Do you want Firefox to try to fix it so your eyes don’t bleed trying to get through it?”

    I want an extension that does this, actually! It doesn’t need to actually modify the page. Just give me a virtual assistant to comiserate with…

    “The people who made this website should have their browser’s back button removed entirely as punishment for erecting this horror!”




  • As someone who’s caught a leaker in the past (well, someone that was exfiltrating company secrets to a competitor) catching leakers is actually pretty easy if you have any modicum of control over the tools they use and the places they work. Barring that, no. Just no. It’s not going to happen.

    If a leaker is gullible and stupid some trickery is possible but I wouldn’t get my hopes up, Warner Music. Seems like a job that’s doomed to fail from the start. I wouldn’t even bother unless they know it’s just a job on paper and are actually just looking to give someone’s kid a legit-sounding job to pad their resume 🤷

    Not only that but if I were in charge of hiring I’d be extremely skeptical of any and all applicants. Anyone smart enough to do the job will know it’s impossible and will just become a master of stalling and picking low hanging fruit (aka useless) and everyone else is just a fraud.










  • If you install Firefox Focus and make it your default browser on Android the Jerboa client (and others I think) will use it when loading links unless you have a specific app associated with a given URL (e.g. NYT app, NPR app, etc).

    If you’re not familiar with Firefox Focus it’s a version of Firefox built for privacy. It basically makes it so that every URL you load behaves like a private browser tab. It also has ad-blocking built in which is sweet (though it doesn’t work on everything/not as good as uBlock Origin).

    Oops: Just realized your question is related to Mastodon and not Lemmy. Though I’m certain that Firefox Focus would work the same way for Mastodon clients.

    Actually, I just checked Tusky and yes, it does load URLs in Firefox Focus. So my advice is still good 👍



  • This is a, “it’s turtles all the way down!” problem. An application has to be able to store its encryption keys somewhere. You can encrypt your encryption keys but then where do you store that key? Ultimately any application will need access to the plaintext key in order to function.

    On servers the best practice is to store the encryption keys somewhere that isn’t on the server itself. Such as a networked Hardware Security Module (HSM) but literally any location that isn’t physically on/in the server itself is good enough. Some Raspberry Pi attached to the network in the corner of the data center would be nearly as good because the attack you’re protecting against with this kind of encryption is someone walking out of the data center with your server (and then decrypting the data).

    With a device like a phone you can’t use a networked HSM since your phone will be carried around with you everywhere. You could store your encryption keys out on the Internet somewhere but that actually increases the attack surface. As such, the encryption keys get stored on the phone itself.

    Phone OSes include tools like encrypted storage locations for things like encryption keys but realistically they’re no more secure than storing the keys as plaintext in the application’s app-specific store (which is encrypted on Android by default; not sure about iOS). Only that app and the OS itself have access to that storage location so it’s basically exactly the same as the special “secure” storage features… Except easier to use and less likely to be targeted, exploited, and ultimately compromised because again, it’s a smaller attack surface.

    If an attacker gets physical access to your device you must assume they’ll have access to everything on it unless the data is encrypted and the key for that isn’t on the phone itself (e.g. it uses a hash generated from your thumbprint or your PIN). In that case your effective encryption key is your thumb(s) and/or PIN. Because the Signal app’s encryption keys are already encrypted on the filesystem.

    Going full circle: You can always further encrypt something or add an extra step to accessing encrypted data but that just adds inconvenience and doesn’t really buy you any more security (realistically). It’s turtles all the way down.