valverde

It's a custom-built chip according to https://atap.google.com/soli/

The signal has to make its way to a speaker in analog form, eventually. In a way, analog output will always be supported.

Ah, sorry, I misread your comment. Indeed, a browser that doesn't respect cross-domain restrictions is a poorly written browser.

My point still stands, though: the point of cookieless domains is not security, but bandwidth. And there are legitimate reasons to have top-level domain cookies - sharing authentication state between subdomains is a common example - which would prevent a subdomain from being used as a CDN, without receiving cookies.

There are many high profile websites that use the cookieless domain approach: Google, Facebook, and Reddit off the top of my head. I wouldn't say they are poorly written - it's more of a design decision to have cookies in the top-level domain.

It's not about the security of the cookies, it's about the bandwidth you save by having a separate domain for static content, because the client does not have to transmit the cookies for each request.

Because WhatsApp uses your phone book as the only way to interact with its contact list. You can't add someone to directly to your WhatsApp contact list.

It could probably access it less often by only sending deltas, but that would mean their servers would have to store your whole phone book. I don't think that's any better from a privacy perspective.

Of course Facebook Messenger doesn't do the same, it has its own contact list coming from Facebook.

Yes. Much like many consumer projectors.

They have been doing that for a while.

https://news.ycombinator.com/item?id=7037575

Tap and hold your Wi-Fi network, then select "Modify network". The proxy options are under the advanced options.

Making it impossible is impossible. They might make it more difficult.

Thanks! I added that to the article.

I had Facebook installed while investigating for this article, and could not identify a similar behavior.

Google, on the other hand, did the exact same thing, but I remember explicitly agreeing to that.

Thank you for the feedback. That was my original intention, but seeing the constant location updates from Foursquare while writing the article surprised me (admittedly not too much).

Interesting. I created a test account just to be sure I hadn't accidentally opted in before and, sure enough, it was enabled.

I recognize this as a possibility and I would definitely take it down if the bank requested it.

On the other hand, if anything, I exposed that they did a good job. They could have rolled out their own crypto, or some flawed form of code generation, in which case I would have disclosed it to them through proper means. But they adhered to standards (TOTP, RFC6238) and protected their data as well as possible. This article should be seen as praise.

Then again, corporations aren't always that understanding, which is why I would be happy to comply.

This specific token is time-based, so a clone would not be detected.

On the other hand, counter-based tokens as you described them do exist, and it would indeed be simple to detect if one of those was cloned.

I wouldn't even call this an attack, given that you would need physical access to a rooted device to carry it out.

Don't forget bandwidth costs. I could get about 100mbps to an external server. At $0.12/GB, 100mbps * 35 minutes = 25GB = $3. Most clicks won't cost you this much, but you should definitely keep an eye on this. Maybe set a bandwidth cap somehow.

Also, I noticed a public key in ~/.ssh/authorized_keys. Is that intentional or just part of how EC2 APIs work?

Other than that, great job. I would definitely use this service.

It seems to be appropriate.

"Why do pirates have a better experience than customers?"

This pretty much sums it up. I couldn't agree more.

Please don't e-mail me my own password in plaintext when I sign up. Other than that, looks pretty promising :)

Ah, the clbuttic mistake.

Take a look here: http://en.wikipedia.org/wiki/Fork_bomb#Examples

This probably means that jailbroken iPhones will be banned from GameCenter soon. Too bad.

I tried to use some of the more advanced OpenGL stuff, but in the end I used the standard P3D canvas (which is part of Processing's core).

I used the "Video" library to make a video out of the animation, and Maxmind's Java library for geolocation. Other than that, it's pure Processing.

>what platform did you do that on?

The video was rendered on a Mac. Is that what you meant?

This brings up a more interesting question: how would you provide encrypted free Internet access in a coffee shop?

Giving out passwords to customers is the most common approach, but there must be a way to provide encrypted access without a shared key.

Clickable: http://www.youtube.com/watch?v=S4ehmI2YVdQ

Step 5 does more harm than good, IMHO. In most LAMP scenarios, you don't want your MySQL server to be facing the public.

The default, on the other hand, is pretty secure, and I recommend it (unless you have a really good reason to do otherwise).

Security through obscurity will not solve their (or anyone's) problems.

Also, someone claiming a system to be "cyber attack proof" is clearly misguided.