firepacket

Why do you think they say that? Because they really want to help you? You believe that crap if you want, I'll do my own research. SOMEONE has to write it, otherwise where does it come from?

It's a real conspiracy. Simple as that.

Google proved they could beat spam around year 2000, but now suddenly they are now letting messages through with headers that a toddler could tell you are fake.

They know it' spam, we all do. But they let it in anyway because there's some secret economic or political dynamic we aren't privy to.

My password manager works just like this! It just monitors shared folders and keeps everything in a compressed/32k encoded XML file that you can open with a text editor.

It's 1 file per vault, but multiple people can use the same vault and all are update simultaneously.

I believe the most popular password managers have been cracked already, that is why I did a LOT of research and built my own.

It was not easy, but it was fun, and if anyone wants to decrypt my files they have a lot of difficult hurdles to jump through.

Of course, keylogging is easier, but then they still have to run my software or at least seriously read the source code.

This is a huge problem.

How do we reliably be sure we are entering credentials in the right place?

I am thinking we need to look at a bunch of different factors, but what?

I wrote my own with ridiculous Argon2 requirements (Takes 18 secs to open) combined with PKDF hybrid hashing system. (not chained) and strong AES256 CBC implementation with proper random IVs for each field and correct padding. You can encrypt any kind of data and files, it's encoded as 32k UTF-16 + sig XML losing only 1.3% over binary, but I like text files. Of course, some files come out smaller due to the Gzip compression.

It is Dropbox friendly meaning any change or addition in another person using the same vault in the same directory is automatically updated in all open vaults. This was originally for collaboration. You can have your own private vault too with a unique password, as many as you like. They just end up as XML files. It runs fast as uses databinding, can generate strong passwords, and makes copying/pasting easy. I am having trouble encrypting files over 1GB though.

I take great lengths to protect the key. If the file is open too long, it minimizes and locks, when you open it, it decrypts everything again. As soon as decryption is done, the key is stashed away using ProtectMemory function in the framework. I have done memory dumps to ensure the key is not visible when the app is idle.

Files works differently, Their meta data is encrypted but you are able to checksum then and preview them in memory without the key ever being exposed and the content never touches the disk and is zeroed afterward. You can currently play sound, view pictures, execute files (in memory!) and soon video.

I plan on browser integration by a cross-browser userscript and loopback routing (127.0.0.1) that recognizes when the cursor is in a field specified in the login's metadata. But I am am running into trouble because sites like to randomize the name of the login fields, so I a have to use some reliable heuristic approach.

Does anyone have any ideas on how to deal with that? If I can figure that out, and get video previews working I will open source it.

EDIT: Here's a preview of the app: https://imgur.com/a/rZGPCPZ

> Cox is far from alone in blowing off Rightscorp's notices, so it isn't clear why the Atlanta-based provider was chosen as the test case

Not only has Cox has been the most vocal about supporting its users' rights, but aside from a couple TV stations and newspapers they aren't big players in the content producing industry.

Just for the record, if you want a new IP usually all you have to do is change the MAC address of your router and you'll get a new one.

You mean a super cookie?

Not only would this violate tracking laws in some areas, but who would ever want to use such a thing?

I would think the courts would recognize a difference between advertising to the end user for the purpose of purchase/consumption, and advertising to 3rd parties as part of a compatibility protocol.

The UA string is not visible to the consumer, and wouldn't affect the number of people who download and install the browser.

Its only purpose is to ensure compatibility with the server after the browser has already been installed.

Also I wouldn't say the browser is actually impersonating another browser. If it was trying to impersonate, the UA string would need to match the other browser exactly and it doesn't attempt to do that. The string is still uniquely identifiable as an IE11 UA.

+1 I'm confused as to why so many people are saying that FreeBSD doesn't autocomplete when it always has.

Also want to add that csh comes stock with historical auto completion which I very much enjoy.

Typing "tail " and pushing the up arrow will auto complete with the last command you typed starting with "tail ".

I doubt it's intentional. Most common validation regexs that your average web dev would use tend to reject the + character.

> Currently, POS counterfeit fraud is largely absorbed by card issuers.

It's a lie. Why do you think so many stores ask to see ID?

From what I've seen, the accepting merchant account is always debited for every chargeback and the card issuers rarely bear any burden from fraud.

It's not even in the form of transaction fees.

Fraudulent charges are withdrawn from the retailers. Even if it has already posted to the bank account, they will take it back.

The CC companies never absorb the cost for fraud. Their greatest trick is convincing everyone they do.

> He wrote nothing about whether he requires oxygen to live, but I'll wager with you he needs it.

So you think understanding bitcoin applications is obvious as breathing oxygen? Sounds to me like you're making baseless assumptions.

> He spoke negatively of Bitcoin as a currency

Yes he did, and he didn't mention why. It was just a page full of backhanded jabs and insults towards bitcoin with zero reasoning to support it. Doesn't strike me as someone who understands it at all, quite the contrary.

> he highlighted a number of aspects of Bitcoin that he thought were useful and where he expecting to see it having a huge, innovative impact.

Inter-bank asset exchange? If that's where he thinks the major innovation lies, he clearly and severely lacks understanding of potential applications.

> Trust me, you did.

Ok, pal.

> So no, he's quite aware that his issues with "a single bitcoin service" are removed from the underlying protocol.

If he has regulatory issues with accepting small gifts, or if he doesn't like the methodology of a particular bitcoin service, that has absolutely nothing to do with bitcoin as a currency.

How is making statements like "bitcoin is a terrible currency" without including any actual reasoning anything but pure ignorance?

> I think he very clearly understands all the applications.

Really? And what are you basing that opinion off of exactly?

The only applications he mentions in his post relate to taxes and credit card fees. If he had any understanding of the other uses like multiparty transactions, timestamping, identity management, voting, derivatives, and trustfree contracts, then he failed to say anything to convey that awareness in his writing.

> Again, I think you misread the article. It isn't that he is unwilling to learn something. He's learned a great deal and concluded that it makes his life more difficult.

I didn't misread anything. Rather, he miswrote by conflating his opinions of a single bitcoin service with the entire underlying protocol.

I don't understand- how they are lying exactly?

Don't they explicitly ask you if you want to backup your recovery key to the cloud?

Is it really that hard to read prompts and change the default setting to manage your own key backup?

If checking a single radio button is all it takes to NSA-proof your device, I'd say we are in pretty good shape. What is everyone complaining about?

> the police can get you online the way they usually get you -- by having an undercover police agent pretend to be the seller.

Except this method doesn't work online because they can't prove you are the one who ordered it.

Anyone can order illicit material to any location and with any name over TOR. Without corroborating evidence, no court would convict purely on the involuntarily act of receiving mail.

This was a painful read.

He says he "doesn't want to be educated about bitcoin" because "he's heard all the arguments", while at the same time claiming it's a "terrible currency (or not a currency at all)" without any further reasoning.

This poor guy needs to be educated if he thinks that avoiding taxes, regulations, and credit card fees are the only applications.

Common decency dictates that if you openly state you are unwilling to learn about something, you should refrain from posting opinionated articles about that thing.

Your communications can still be tapped, your location can still be tracked through cell towers, and remote malware can still turn your phone into a persistent bug.

I don't think there's much of an advantage to using a dumb phone. At least with a smartphone you can run apps that encrypt your communications.

Assuming your are using SSL, what exactly is the attack vector for getting a "foothold into your javascript execution" besides hacking Coinbase itself?

Also, any attacker who gains a foothold of your operating system execution environment can trivially subvert your security as well. Does that mean crypto is broken on PCs?

It looks like they are basing OneGet off of NuGet - their package manager for Visual Studio. It does handle dependencies and is actually quite good compared to other package managers.

They are using the same syntax as NuGet- the Visual Studio package manager console.

Thanks. Yes, I somewhat agree with your clarification.

And to further your point, it appears this guy (https://www.reddit.com/r/Bitcoin/comments/2k38ta/my_wallet_w...) just got his coins stolen by using blockchain.info over TOR.

However, I still believe nothing is fundamentally broken. Any important protocol should be using SSL - especially when operating over TOR. Lapses like this are still simply user error.

Siphoning bitcoin transactions is not trivial.

Transactions need to be signed by the holder of the private key to the inputs. A MITM attacker still does not have access to any keys.

If it was that easy, bitcoin would be worthless.