• 0 Posts
  • 58 Comments
Joined 10 months ago
cake
Cake day: September 5th, 2023

help-circle


  • We need an open source smart tag. I recently researched how the landscape has changed and, as an android user, still nothing good in available. I’m not sure if I remember right, but Google’s find my device was supposed to be open source or at least open spec? Might be worth looking into how easy it would be to code a lil firmware for this network myself. As much as I’d love a tag for things I cannot lose, the current options are throwing money away for no actual useful tracking (Samsung), forfeit your privacy (Tile, perhaps others), sell your soul (Apple).






  • What’s great is that it’s also “backwards-compatible” with type E. Male type E plugs will usually also have ground connections for a type F, so you can plug it into female E and F sockets.

    Edit: In fact, looking back at the picture, that’s exactly the kind of male plug shown for both type E and F. It works with both types. It has the hole for an earth prong, but it also has a contact on the bottom side if you look closely.





  • Apple has the benefit of making everything themselves, down to the secure enclave processors and, as of some time also, the processor as a whole. They get to design their hardware, OS, software, ecosystem, all around security and it all plays together nicely.

    If you control everything, you can do whatever you want with it. Android phones being more of a mixed bag of different vendors making different parts of the phone, including the software components, makes this interplay much more difficult. It usually takes android quite some time before they catch up on the latest security concepts.









  • Absolute joke of a comment. You are assuming the browser is a holy grail completely isolating the internet from the operating system.

    First of all. The browser runs on the operating system’s services. In particular, the isolation that you implicitly cite is done entirely by the kernel. (That’s for example why you cannot run chrome in an unprivileged docker container - the crucial isolation-centered system calls are not available) The whole network stack is managed by the operating system. Cryptography can also partially be done OS-sided. The simplest example is CSPRNG, which is usually provided by the OS. (Advanced systems may rely on external physical generators, see Cloudflare’s lava lamps).

    Secondly. Completely and utterly wrong. The linked video displays the execution of Meltdown/Spectre within a browser. Using JavaScript. This allows the attacker to gain access to any data they want on your computer simply by running some JavaScript code. Easily remotely executed via XSS on a poorly written website. You may read the full article here. Or inform yourself about Meltdown and Spectre here. How is that relevant? Combating this vulnerability was primarily done via critical OS updates. The exploits are inherit to certain CPUs and are therefore not fully fixable. Still, the combination of BIOS, Chipset, OS, and browser updates help prevent very serious attack vectors. (That’s the reason why the browser’s time measurement is only accurate to about the millisecond.)

    So no. Browsers aren’t the magic solution to everything (sorry Ubuntu Snap). They very much depend on the OS providing the assumed security guarantees. And even assuming no direct vulnerabilities in the OS, we can never exclude side-channel attacks, like what Meltdown and Spectre were (or still are if you refuse to update your system).