arkadiyt

bcrypt famously only looks at the first 72 bytes of the input. There are ways around that - don't use bcrypt, or do bcrypt(sha256(password)), or whatever, but it is not the case that "just feed the input to the hash" removes all length restrictions

For anyone unaware, a SOC3 is just a SOC2 with the audit details removed - it includes a high level statement from the company (Apple) and from the auditor (EY), that's it.

Also Apple certainly does invest heavily in security and privacy but SOC2's are so commoditized that it's like saying "look I can afford 50k", it's not particularly interesting

This is addressed in the blog :)

It's from the linked rav4world post

There's still a fuse for the DCM even in this car but:

- It has an internal battery and will keep running for quite a while after pulling the fuse. This is a safety feature in case you get in a crash that disconnects the 12V battery

- It will break your in-car microphone as discussed. Repairing that requires opening up the dash

- That won't do anything for disconnecting the GPS antenna

In a perfect world they wouldn't collect it either, but I'd rather Apple have it than the car manufacturer (or rather, only Apple vs both Apple and the car manufacturer)

When I removed the DCM the in-car microphone stopped working, but I bought one of these to get it working again: https://www.autoharnesshouse.com/store/AHH-DCM77.

Also even with no modem, if you use CarPlay on your phone _via Bluetooth_ then the car will just use your phone's internet connection, so I only use CarPlay via a wired USB connection.

Aside from that the car works great, everything is 100% functional. I suppose I don't get OTA updates, which I'm fine with.

I bought a 2024 RAV4 Hybrid and

1) physically removed the modem (the "DCM") and

2) disconnected the GPS antenna from the head unit

Took a little research but was still an approachable project

Apple Health data is end-to-end encrypted, even without using ADP. They don't have access to it: https://support.apple.com/en-us/102651

> intercept SMS including the verification codes sent by apps like WhatsApp

For anyone worried, this approach:

1) Breaks the existing phone from receiving WhatsApp messages, so you can notice that behavior

2) Can be prevented by setting up a WhatsApp pin in your settings

I don't need something to protect the privacy of others from me, I need something to protect my privacy from others. The majority of people who use smart glasses are not going to be using this - where is the product that will protect me from them?

If using a non-FS key exchange (like RSA) then the value that the session key is derived from (the pre-master secret) is sent over the wire encrypted using the server's public key. If that session is recorded and in the future the server's private key is obtained, it can be used to decrypt the pre-master secret, derive the session key, and decrypt the entire session.

If on the other hand you use a FS key exchange (like ECDHE), and the session is recorded, and the server's private key is obtained, the session key cannot be recovered (that's a property of ECDHE or any forward-secure key exchange), and none of the traffic is decryptable.

> does a 4096 not give you more security against passive capture and future decrypting?

If the server was using a key exchange that did not support forward secrecy then yes. But:

    % echo | openssl s_client -connect rachelbythebay.com:443 2>/dev/null | grep Cipher
    New, TLSv1.2, Cipher is ECDHE-RSA-AES256-GCM-SHA384
    Cipher    : ECDHE-RSA-AES256-GCM-SHA384

^ they're using ECDHE (elliptic curve diffie hellman), which is providing forward secrecy.

> Make an RSA key of 4096 bits. Call it your personal key.

This is bad advice - making a 4096 bit key slows down visitors of your website and only gives you 2048 bits of security (if someone can break a 2048 bit RSA key they'll break the LetsEncrypt intermediate cert and can MITM your site). You should use a 2048 bit leaf certificate here