packet_nerd

A quick search seems to turn up quite a few examples of webcam spying. I'd love to see actual numbers, but it doesn't seem to be "incredibly rare".

https://www.dailymail.co.uk/sciencetech/article-5228017/Hack...

https://www.dailymail.co.uk/news/article-2638874/More-90-peo...

https://globalnews.ca/news/2158281/what-you-need-to-know-abo...

https://www.telegraph.co.uk/technology/news/10131456/Hackers...

This site claims a guy made a business selling software to hack and remotely control webcams, complete with paid employees and $350,000 in income:

https://www.welivesecurity.com/2015/04/21/webcam-hacking/

I think groundwave propagation only happens reliably at the extreme low end of the HF spectrum, and is mostly associated with medium and long waves (160m ham band & AM radio for example).

For most of the HF spectrum reflections off the ionosphere are the main useful propagation mode. At the short end (like CB radio) bouncing of the ionosphere is harder so line-of-sight is more common.

Of course I wasn't suggesting that we should all give up and live in caves or something. It's not a binary choice. I refuse to believe that the way our world, society, and lives currently work is the best it could possibly be, because it seriously sucks. There's got to be a way to improve and simplify the system incrementally.

Also, I dispute the idea that simpler societies have lower absolute quality of life in every way. Having lived part of my life with an isolated tribal society, there are definitely pros and cons. (A close knit community is one huge pro that I really really miss.) Instead of a blind "our complex systems are better just because they are" I think we should step back and take actual stock of the costs and rewards and really ask ourselves, for each individual thing, whether it's worth it.

The question we should be asking is whether these complex systems are actually required.

In absolute terms, our ancestors lived much much simpler lives and somehow managed to survive. So, it's not that we're required to have such complex systems, it's that we've decided that the reward is higher than the cost (which is fine). But, I wonder, how accurately have the costs and the rewards been evaluated? I suspect that we don't always take into account the full cost and risks of complexity. If we did, I suspect we'd build fewer highly complex systems, and the systems we did build would be better.

If you think of the entire IT experience as a system, somehow all the various social, economic, and technical forces have conspired to produce massive complexity which shows in constant bugs, failures, broken websites, and security breaches. I wish we could just step back, take a deep breath, and find ways to simplify and clean some of this up.

Uniquely identifying wifi MAC addresses and Bluetooth IDs can usually be passively picked up from phones. Correlate those with the other fuzzy identifiers you mentioned for even better and more versatile tracking.

I'm curious, are any MAC-like IDs broadcast plain-text as part of normal cell phone connections that could be passively sniffed? I must have the wrong keywords, but don't seem to be able to find anything on this.

No, wrong incentive structure for ISPs. They're job is to deliver packets from point A to point B, and I want to pay them to do that well, and ditch them if they don't.

> browser based universal tip jar

I like this idea, and would use it myself. I understand the Brave browser does this, essentially, and have been meaning to check it out.

I wonder if a "tip" would be a better system for verifying a real human than Google's captcha (which really goes nuts if you've taken steps to protect your privacy)?

I'd always heard that dairy gets quite a lot of subsidies, including from advertising like the "Got milk?" ads. A quick search seems to support this. It'd be interesting to hear from someone who's dug into this a lot more.

https://www.investors.com/politics/editorials/dairy-subsidie...

https://qz.com/944630/the-us-government-program-behind-the-g...

https://www.idausa.org/government-meat-dairy-advertising/

Or even an online search engine that was configurable where you could customize the search engine and assign custom weights to different aspects.

I'd love to be able to configure rules like:

+2 weight for clean HTML sites with minimal Javascript

+5 weight for .edu sites

-10 weight for documents longer than 2 pages

-5 weight for wordy documents

I'd also like to increase the weight for hits on a list of known high quality sites. Either a list I maintain myself, or one from an independent 3rd party.

Once upon a time I tried to use Google's custom search engine builder with only hand curated high quality sites as my main search engine. It was to much trouble to be practical, but I think that could change with an actual tool.

> What does encrypted/authenticated DNS gain you?

Many things, here's three to start:

* A measure of privacy - instead of every rando with ability to sniff packets (activities you have no way to ever know about, available to many parties along the path) only the DNS server (which you choose, presumably trust, and can change) knows what names you resolve.

* Stronger foundation for TLS - LetsEncrypt and other public certificate authorities depend on DNS to issue certificates. If an attacker controls DNS, they could easily generate certificates for any site they wanted to attack.

* There have been many shady incidents with certificate authorities. I just feel that beefing up some of the other layers in the stack is a good idea.

> faking DNS responses just results in a connection that is closed immediately

On the web it's often not closed immediately, the users often get a certificate warning that they may be conditioned to click through. Of course HSTS helps with that, but still... why the hostility to securing the name resolution layer?

Meanwhile DNS, which is a precursor to almost every connection ever, is rarely encrypted or authenticated in practice. Standards like DNSSEC and DNS over TLS exist but seem to have lots of vocal opposition without any serious proposals for improvement.

A Microsoft certificate training I took recently literally put emphasis on randomizing source port numbers as a way to mitigate attacks.... let that sink in.

I came across backup appliances recently that work on this principal. They literally have TBs of unused disk space in the box in my datacenter, but require an additional license to activate. It makes me very angry!

What would it take to reverse engineer Widevine?

I keep seeing this come up, that it's practically impossible to write a brand new browser. This got me thinking, what would it take to make a better browser?

A browser is something that 1 out of every 2 people on earth [1] use frequently. That's a lot of people! All developers in the world use a browser. Lots of them really believe in open software. Some are 10x developers. A certain percentage are literal geniuses. Exactly one is the smartest developer alive today. I get that it's hard, but smart people mobilized at global scale hard?

Starting from scratch today developers would have better tools, modern languages, and a hindsight view of what worked and what didn't in previous browsers to work with. Wouldn't that make it somewhat easier?

Say the average person loads 10 websites per day, and a less optimized browser requires 100ms more to load each page. That's 415 million hours wasted per year. Say the average person makes $4 an hour, that's 1.6 billion dollars wasted!

If every browser user donated 50 cents, that would be 2 billion dollars. Would that be enough? There are 50 people worth more than 17 billion [2], would one of them bankrolling a new browser be enough? What would it take?

[1] https://en.wikipedia.org/wiki/Global_Internet_usage [2] https://www.businessinsider.com/richest-people-world-billion...

What do you mean by this?

Are you saying that a phishing attack can be executed against U2F/WebAuthen if the attacker controls DNS?

KeePassXC is fantastic, I especially like the good Yubikey integration. The one small feature I miss from the original KeePass was the password templates. I like all my passwords to follow a grouped pattern so its easier to type into a phone or something while still being strong.

KeePassXC works really well with Yubikey too. I use a Yubikey and a short pin for the password.

Unless DNS is compromised.

Most sites let you set up both the Yubikey and a Google auth style TOTP. I always set up both, with TOTP codes saved in KeePassXC and SFTP'd to a backup server.

> theres no such thing as 1-way communication

It's called a data diode.

https://www.opswat.com/blog/why-data-diodes-are-essential-is... https://en.wikipedia.org/wiki/Unidirectional_network

I and I think most people would be happy to pay a small amount to each site we visit, but payments system to make the idea practical just doesn't exist. I for sure am not going to hand out my CC number everywhere; it's inconvenient, it's intrusive (full legal name, address, phone number), and I have no idea how securely and for how long they store that information.

I would really love to see a way to make small payments to sites that I visit simply and all managed in one place.

Many IPs are shared by more than one endpoint, and hundreds or thousands of endpoints sometimes share a single IP. Say a home router is compromised on an ISP using CGNAT and you block by IP, you could potentially be blocking an entire neighborhood of innocent users.

Having parts of the Internet blocked for huge numbers of their customers puts pressure on ISPs to monitor and censor users traffic, which is not the direction I want to see the Internet go.

IPs do not have a one-to-one relationship with users, and I feel strongly that they shouldn't be treated as if they do.

Looking at the cable map [1] makes me wonder, what do they do when cables are crisscrossed over and under each other?

[1] https://www.submarinecablemap.com/

> The world's first raspberry-picking robot

The majority of raspberries are harvested by machine and have been for decades. Handpicking is only necessary for high quality fresh berries.

I do this, using an up-to-date chromium browser proxied through Tor for regular browsing. I do this instead of the regular Tor browser on the theory that there's less potential for 0-day exploits.

Of course, this does compromise anonymity a bit in some respects, since there are probably few people who run chromium on Tor and because it's not as resistant to fingerprinting as the regular Tor browser. That's acceptable to me, as I only use that browser on Tor, and use another browser for things that could potentially leak my real identity.

There should be a service to research, test, benchmark, and otherwise review products. I'd pay for a service like that, and would expect them to never ever accept any kind of compensation from companies making the products they review.

Completely agree. Especially misleading and deceptive ads and ads which deliver malware. Also I really wish my state would ban billboards.

In their place, I want to see (and would pay for) high quality 3rd party product benchmarking, testing, and reviewing.

At least in the conservative community where I grew up, the religious "mark-of-the-beast/new world order" narrative was the main anti-national ID narrative. I'd never heard the illegal immigrant angle before.

It'd be awesome if nmap and other network tools work in WSL2.

> Under no circumstances use the Tor browser (it's okay to use Tor, but do it with Chrome, and seek additional training on how to set it up).

I'm not sure I get the rational behind this one? Is it just because they are already using Chrome, so it's better to reduce the attack avenues?

Also, it seems to me if you need to use Tor, it's probably not a good idea to do so on your regular Windows desktop. Wouldn't Tails be better advice while also being more foolproof for less tech savy people?