The General Technology Thread

[DoggyDaddy]

For a website sure, but not when you are using it for an SSH session into a switch that is only accessible from the internal network.

What, you want some testing or something before you patch?

via Imgflip Meme Generator

 

[KLB]

via Imgflip Meme Generator

 

[jamil]

The self signed cert thing is bad. Most IT people don't even understand PKI let alone consumers bombarded by overly protective but ineffective web browsers.

My current favorite is when the security/policy office claims that a 0 day vulnerability must be patched on all windows systems immediately and pushes out the patch without even communicating to system owners before the patch goes out.

Well, no one wants to pay for CA certs on dev environments. That's the only place we use them.

 

[jamil]

Well, you know what they say. "If you're not part of the solution, then you're a consultant"

That is relevantly hilarious.

 

[wtburnette]

via Imgflip Meme Generator

Yeah, I always do this when the vendor answers our question about separation of duties no...

 

[jkaetz]

For a website sure, but not when you are using it for an SSH session into a switch that is only accessible from the internal network.

Well, no one wants to pay for CA certs on dev environments. That's the only place we use them.

By "bad" I meant "overexaggerated". A self signed cert can be more secure than one of the big budget CAs so long as you trust its publisher/creator. I always argue with chrome about self signed stuff.

 

[KLB]

By "bad" I meant "overexaggerated". A self signed cert can be more secure than one of the big budget CAs so long as you trust its publisher/creator. I always argue with chrome about self signed stuff.

Ah. The latest "security" changes by all of the browsers make me crazy. I have a bunch of internal tools that get all kinds of warnings when I go to them. Some even after I frickin install the self-signed cert on my laptop.

 

[ArcadiaGP]

Motorola announcing their new foldable-screen RAZR phone tomorrow. Initial price-tag of $1500

 

[jkaetz]

Motorola announcing their new foldable-screen RAZR phone tomorrow. Initial price-tag of $1500

They are smoking some good stuff. It's starting to be like vehicles, MSRP $1500, but we'll give you 30% off if you buy in the first two weeks.

 

[ArcadiaGP]

This guy spent 7 days in Virtual Reality. Cool video. Great editing.

[video=youtube_share;BGRY14znFxY]https://youtu.be/BGRY14znFxY[/video]

 

[ArcadiaGP]

She wouldn't unlock her iPhone for police. Now Indiana's highest court will hear her case.

 

[KLB]

Here's hoping they side with the stalker.

 

[PinoyJedi]

She wouldn't unlock her iPhone for police. Now Indiana's highest court will hear her case.

This is about to be a very slippery slope, that people not knowing the law might end up getting themselves into trouble.

Where is the line drawn? To most people, giving access to their smartphones is equal to letting that person into their homes to snoop around.

 

[actaeon277]

Why do they even need to go into the phone? They can't go through phone company records?

 

[KLB]

Why do they even need to go into the phone? They can't go through phone company records?

I don't know that the companies keep text messages. As far as calls go, they should be able to get that from the carrier.

 

[DoggyDaddy]

I don't know that the companies keep text messages. As far as calls go, they should be able to get that from the carrier.

Text messages (maybe?), photos, browser history... I don't think the carrier would have that info.

 

[Phase2]

Text messages (maybe?), photos, browser history... I don't think the carrier would have that info.

The number of companies that have different levels of insight into your phone data is much larger than most people realize:

• Typically, any info that passes through your carrier's network can be recorded by the carrier. The biggest key is whether that communication is encrypted. So, SMS (not generally encrypted), voice (not generally encrypted) and web data (mixed) can be captured/recorded. Even when actual data is encrypted, what web sites/services you are interacting with, when and from what location (aka metadata) is easily recorded.
• Your phone's OS vendor (Apple/Google) has much insight into what you are doing. The phone OS is routinely contacting Apple/Google in the background. You are guaranteed to have at least some of the following going on: reporting on phone activities (location, apps being used, etc), backing up your data to Apple/Google, using vendor services that provide direct info for the vendor (searches, google maps, gmail, Siri, etc). It is almost impossible to stop this tracking, even when you try to turn off these services.
• Have any apps on your phone? *Many* apps generate revenue by relaying information about your activities. Some apps are clean of such reporting, but that info is not easily visible. Here is one Android app that has 19 trackers embedded. The more apps on your phone, the more organizations are building electronic dossiers on you.

Frankly, if you carry a smart phone, you are paying a monthly fee for a tracking device that is continuously reporting on your activities to many organizations that you likely aren't even aware of. Welcome to surveillance capitalism.

 

[JettaKnight]

Why do they even need to go into the phone? They can't go through phone company records?

Don't iPhones have end to end encryption on some messaging?

 

[Phase2]

Don't iPhones have end to end encryption on some messaging?

End-to-end encryption only hides the content of your messages, not who you are contacting (metadata). It is possible, but rather involved, to mask the metadata.

 

[KLB]

The number of companies that have different levels of insight into your phone data is much larger than most people realize:

• Typically, any info that passes through your carrier's network can be recorded by the carrier. The biggest key is whether that communication is encrypted. So, SMS (not generally encrypted), voice (not generally encrypted) and web data (mixed) can be captured/recorded. Even when actual data is encrypted, what web sites/services you are interacting with, when and from what location (aka metadata) is easily recorded.
• Your phone's OS vendor (Apple/Google) has much insight into what you are doing. The phone OS is routinely contacting Apple/Google in the background. You are guaranteed to have at least some of the following going on: reporting on phone activities (location, apps being used, etc), backing up your data to Apple/Google, using vendor services that provide direct info for the vendor (searches, google maps, gmail, Siri, etc). It is almost impossible to stop this tracking, even when you try to turn off these services.
• Have any apps on your phone? *Many* apps generate revenue by relaying information about your activities. Some apps are clean of such reporting, but that info is not easily visible. Here is one Android app that has 19 trackers embedded. The more apps on your phone, the more organizations are building electronic dossiers on you.

Frankly, if you carry a smart phone, you are paying a monthly fee for a tracking device that is continuously reporting on your activities to many organizations that you likely aren't even aware of. Welcome to surveillance capitalism.

Can record and do record are two different things.