Andromxda 🇺🇦🇵🇸🇹🇼

@ Andromxda @lemmy.dbzer0.com

Posts

78
Comments

1302
Joined

2 yr. ago

Mastodon: @Andromxda@infosec.space
wiki-user: Andromxda

Moderating

Piracy: ꜱᴀɪʟ ᴛʜᴇ ʜɪɢʜ ꜱᴇᴀꜱ lemmy.dbzer0.com

Bazzite lemmy.world

7mo ago

Cheapest VPN in the long term for watching movies and tv shows?
Jump
1

Andromxda 🇺🇦🇵🇸🇹🇼 @lemmy.dbzer0.com 7mo ago

Would use it for piracy, not if you need good privacy. It's good enough to avoid a complaint letter from your ISP when torrenting, but can you be sure that they don't sell your data to advertisers? I don't know. Will they respond to a law enforcement subpoena? Probably.

7mo ago

Just use cURL

Jump

Andromxda 🇺🇦🇵🇸🇹🇼 @lemmy.dbzer0.com 7mo ago

Outlook.

Thankfully Thunderbird, although most folks here just use the Roundcube web client.

With a giant signature that includes an embedded image.

They are auto-generated and enabled for everyone. Typical corporate bullshit I guess.

Also the image is a 2400px image that has been resized using width and height attributes.

It's a portrait (that thankfully has been downsized and compressed so much, that it's barely recognizable (thank goodness, because it's a horrific photo)), as well as a photo of my physical signature. Oh god do I hate emails and email signatures. And fuck my company for wanting emails to look "authentic" and including this stupid ass signature.

That rate limiting can easily be bypassed by an attacker. In order to be effective, the rate limit needs to be enforced by tamper-resistant hardware, i.e. a secure element. Here are some of the requirements for a secure element: https://developer.android.com/privacy-and-security/keystore#StrongBoxKeyMint

An implementation of StrongBox KeyMint must contain the following:
Its own CPUSecure storageA true random-number generatorAdditional mechanisms to resist package tampering and unauthorized sideloading of appsA secure timerA reboot notification pin (or equivalent), like general-purpose input/output (GPIO)

For details, I recommend reading:

Only devices with a proper implementation of a secure element (Titan M2, i.e. Pixel 6 or later, or the Apple SEP, i.e. iPhone 12 or later) are actually resistant to brute-force attacks by forensic data extraction tools, such as Cellebrite or GrayKey. GrapheneOS has obtained some internal documents from multiple forensics companies. They published the Cellebrite docs at https://discuss.grapheneos.org/d/14344-cellebrite-premium-july-2024-documentation

Specifically, I recommend looking at this chart:

It clearly shows that data cannot be extracted from iPhones with the SEP, unless the device is in the AFU state, meaning that the encryption keys are kept in memory.

Those are the charts for Pixels: