Drip33

Another example of a great sub:

/r/kidneystones

sad face noises

What if I own the company and it's an acceptable Terms of Service use? What if I'm unemployed? Should I still be fired?

I have access to some marketing data and for fun,

select * from mobile_location where latitude between 38.88778433380732 and 38.891917997746894 and longitude between -77.01269830654866 and -77.00613225870377 and epoch_timestamp between 1609954200 and 1610067600

Returned quite a number of mobile devices accurate to the meter. Was fun to see which phone was in which room or blade of grass of the building. I'm not even American.

I found this page useful to test how code I've written handles unusual characters.

?l?d mask with I think 9 characters using default Android OS with updates. Both phones I think were minimum Android 5.0+ because that is when they switched to Scrypt to store password/encryption keys.

Galaxy S7 - online and cracked, Galaxy S4 - offline and not cracked ~2017-2019

My powered on phone was 0day'd by Cellibrite according to internal Law Enforcement emails in disclosure and my powered down phone was not supported at all.

Edit: The cracked phone has been in my possession for a while now and I've only powered it on twice for mere minutes since getting it back if there are any phone experts around that want to investigate.

If you can generate the private key to a 27 character or longer English readable Bitcoin address then you can use the same magical technology you possess to earn far more than $1 billion USD.

This address has no known private key https://www.blockchain.com/btc/address/1BitcoinEaterAddressD...

Sure someone could randomly guess it but not likely. You don't need to have or know a private key to generate a valid checksum bitcoin address that can be sent to.

What I wrote about is forfeiture which doesn't include criminal penalties. Most of the American (which I am not) federal press releases I read about have a maximum $250,000 fine per count.

Here is a random press release from justice.gov https://www.justice.gov/opa/pr/six-additional-individuals-in...

>The Sherman Act offense charged carries a statutory maximum penalty of 10 years in prison and a $1 million fine for individuals. The maximum fine may be increased to twice the gain derived from the crime or twice the loss suffered by victims if either amount is greater than $1 million. The false statements offense charged carries a statutory maximum penalty of 5 years imprisonment and a $250,000 fine. The obstruction of justice offense charged carries a statutory maximum penalty of 20 years imprisonment and a $250,000 fine.

These fines are on top of the forfeiture so if the person in this article earned $1 million gross, $100k net they would have to repay on a guilty finding $1 million + say $500k in fines = $1.5m when they only "earned" $100k.

Previous discussion: https://news.ycombinator.com/item?id=20927197

> Also forfeiture doesn't account for the fact that you may have paid capital gains tax. I feel like they really shafted me on that one.

As someone also charged but not convicted, I learned hypothetically you also don't get to account for expenses if you lose. Meaning you could run a $10 billion gross revenue drug empire, it costs $9.9 billion to run so you walk away with $100m and you still have to pay $10 billion in forfeiture.

Neither but yes you're right for both.

> Is this a CFAA violation? No hashes were cracked

Cracking hashes alone is not a crime or I'd be in jail.

> I guess the "modern" browser fixes this for everyone else not using a ("modern") proxy.

Only if the site owner wants it so https://hstspreload.org/

There's a lot they can do, but then it makes it impossible to search your inbox for old emails by subject, from, to etc fields.

You can reduce what an adversary sees by not including anything useful in the subject line and the only thing you can't protect is who you're speaking to and when.

I'm assuming the computer is "locked" but online, and no users consent to logging in to run anything. Will any of these methods still work if Firewire drivers are disabled?

I thought that wasn't possible since DDR3 or 4?

>If you can get a dump of the computer active memory you can ultimately get the decryption keys on consumer hardware

What methods are available to get a memory dump if Firewire is disabled? Feds couldn't break my encryption after ~1.5 years but my devices were all off when they showed up. Ironically the one device they did get into was a cell phone powered on but it had little evidentiary value and in one funny way was partly exculpatory.

Take it further. If you witness a car from Tesla or any other publicly traded corp spontaneously combust on the side of the road and you know it will result in massive recalls before the general public and then short the stock, is that insider trading too?

Edit: Or use satellite images to see when companies are receiving big shipments, sending out deliveries, or track customers to predict stock prices and revenues https://www.theatlantic.com/magazine/archive/2019/05/stock-v...

That requires some sort of malware (or similar) installed on the device/software creating the transactions which has access to the private key to leak it via some predetermined way and is different from what I thought you were saying that a pre-signed transaction could directly send funds to an unwanted address without you knowing by inspecting the signed transaction itself before broadcasting it.

Regardless, whatever job you have where what you've said is a legitimate threat model sounds like the most interesting job in the space.

>The fun bit is that the signer can backdoor transactions, and that part isn't something that can be verified by anybody who doesn't have the private keys.

Can you explain this? This is contrary to my knowledge of reviewing the details of a pre-signed transaction.

Looks still unconfirmed https://decrypt.co/32145/hackers-blackmail-exchange-with-5-m...

>In short, the researchers claim that the hackers have gained access to an exchange’s funds. They are able to send money to certain whitelisted accounts that are marked as reliable in the exchange’s database to—but not to their own. So, they are sending the funds with excessively high transaction fees to sap the exchange’s accounts, and they’re demanding a ransom if it’s going to stop.

I've never heard of someone successfully and unintentionally fat fingering a Bitcoin address typo to a valid Bitcoin address nobody owns. Fee box is a different thing, the recent $2.5m ETH headline you saw was not an accident but an attack/blackmail. Bitcoin core itself prevents you from using too high of a fee without an express override in the config.

Probably just twice. Bitcoin addresses are check summed so it's nearly impossible to fat finger a mistake.

>Something like r/watchpeopledie, they don't have to censor, and it seems contained. I wouldn't want to visit it, not more than once, it may not be healthy in general, but taking it down seems to be "just" censorship?

I can say for me personally after spending some time on that subreddit that I am far more cautious and safe in everything I do. I always look out for falling objects, wear helmets and safety gear when appropriate, drive even more defensively etc. The sub opened my eyes to the dangers of planet Earth, all the ways it tries to kill us, and I don't think I'm alone on this.

Was the write a shell php file portion of the video/exploit patched?

Sites like https://sqliteonline.com/ and https://inloop.github.io/sqlite-viewer/ could be perpetually vulnerable if not?

>This headline is very misleading

I was not sure if I am allowed to editorialize titles a bit but I agree because they are still sworn officers. If dang is around, he should change it.

>The announcement comes one day after two members were suspended without pay when a video surfaced, showing them pushing over a 75-year-old protestor, causing injury.

>“Fifty-seven resigned in disgust because of the treatment of two of their members, who were simply executing orders,” said John Evans, PBA president.