gtklocker
* There is a way, however it's common practice to leave it unlocked and I'm not sure you mention that in your article.
* The software that you give access to your phone (be it drivers or the recovery images themselves) isn't signed by anyone. Some of the software isn't even available via HTTPS. I think it's a bad idea to trust some HTTP and unsigned executable more than Google, who are making all they can to ensure the integrity of anything that runs on your phone.
* Unlocking your bootloader is a bad idea. Google erases all your data whenever you unlock your phone[1]. They don't hate you, they've just realized the security issues that come from having an unlocked phone. Take this for example: You're at the airport and ready to leave. However, TSA stops you for a "random" check. They have your phone for about 5 minutes and there's nothing you can do about it. Now, they could ask you for your passcode but then you'd know something's wrong. Now, your bootloader is unlocked, which means they can see your device at firmware level and alter it to their liking it. Nothing can stop them from plating a backdoor in there or just making a copy of all your files and you wouldn't know. That's why Google does [1].
[1]: http://wiki.cyanogenmod.org/w/Install_CM_for_maguro#Unlockin...
I've worked on technologies ranging from package management/maintenance and Linux distros to web development and computer graphics.
Currently studying Computer Science and Engineering, my passion is to learn and to teach.
Lately I'm quite inclined in writing Python but I've also done lots of Javascript (also WebGL) and some PHP as well.
Website: https://gtklocker.com/ Github: https://github.com/gtklocker/ CV: https://gtklocker.com/cv.html Twitter: https://twitter.com/gtklocker Email: [email protected]
http://www.edn.com/design/automotive/4423428/Toyota-s-killer...
It's obvious why it can be a grand target for Man in the Middle, defacement and worst of all integrity attacks. Apart from preventing many of the latter, implementing HSTS could have really mitigated the problem. Anyone who had already visited the site wouldn't see the defaced page. Furthermore, they could get added to an STS preloaded list[1], making the attack invisible to anyone using a modern browser.
If you are interested, the Wikipedia page[2] does a fair job at explaining more about why HSTS is needed.
[1]: https://src.chromium.org/viewvc/chrome/trunk/src/net/http/tr...
[2]: https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security...
$ curl -I https://www.openssl.org/
HTTP/1.1 200 OK
Date: Sun, 29 Dec 2013 03:57:54 GMT
Server: Apache/2.2.22 (Ubuntu)
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Length: 15686
Content-Type: text/html
[1]: https://en.wikipedia.org/wiki/HTTP_Strict_Transport_SecurityHow do I switch tabs using my keyboard? Cmd-<N> doesn't work, so does not Cmd-Alt-Left|Right.
gunther> gcc -O2 semtex.c
gunther> ./a.out
a.out: semtex.c:63: main: Assertion `(map = mmap((void*)0x380000000, 0x010000000, 3, 0x32, 0,0)) == (void*)0x380000000' failed.
Aborted
gunther> uname -r
3.4.2-x86_64-linode25Right now I'm using a Macbook Pro 2012 w/o the Retina. I do all my development on Linode servers, remotely. I get 6 hours of battery life and the machine is a pleasure to work on. I wouldn't go back to my old Windows laptop, where I used PuTTY to work.
Really.