News for hackers. Stuff that matters.

nulluk

As bri3d has mentioned, I think you are confused because the key actually has three independent functions and you need to make the distinction between them all.

    - Remote central locking via UHF
    - Immobiliser authentication via RFID (this is what is vulnerable) 
    - Key for the ignition barrel or manual unlocking of doors
As far as my limited understanding goes using the the key fob for remote central locking does not expose any risk, instead its the immobiliser part, so manually opening your door with the physical key provides no extra safety, its when the key is present near the ignition barrel, thats where the immobiliser kicks in and where this venerability exists
Re:SEO hidden text and AJAX on Thursday July 30, 2015 @11:07AM (#9975465)
I think its known Google can masquerade as a "normal" visitor if it suspects you of cloaking (non identifying UA string and coming from a non disclosed google crawl IP)

https://support.google.com/webmasters/answer/66355?hl=en

I think they also use this to notify you in webmastertools when/if your site is hacked and is doing it to avoid detection by the normal user.

Re:EU’s New VAT Rules Could Create a Mess for Startups on Tuesday November 25, 2014 @11:13AM (#8658272)
Yes and this is what is the most unsettling part, the TLDR for small businesses is if you don't sell through a marketplace your sod out of luck and now regarding the VAT threshold and need to burden the cost of becoming VAT registered
Thanks! The quick response is we haven't got around to it yet. We have been hard at working integrating new features and with only a select few customers (that we can count on two hands) it wouldn't showcase the platform very well.
Our initial customers are primarily retailers but we aren't intentionally limiting ourselves to that market, the platform works across a few different sectors.

We have a Magento plugin as our first drop in integration so if you are running a Magento webstore you can just install and configure a plugin and we will automatically ask all your customers for a review a certain amount of days after purchasing. We also have a few POS and Point of Delivery integrations currently in the pipeline but as it stands they are all custom integration jobs to be branded up as the registered company, maybe this could be addressed with an iPad app that restaurants could present when customers are settling the bill?

It's honestly something we haven't looked at yet but if a potential client wants this to come onboard with us then we are more than happy to put in the development time to provide the solution

Feedback is really appreciated, also feel free to ask any questions on here or directly via [email protected]
Re:Ask HN: Password best practices? on Wednesday January 22, 2014 @10:13AM (#7102947)
Good timing on this post, recently decided to shape up my own practices.

I'm currently storing everything in a separate OSX keychain with a strong 20+ character password but there seems to be very little out there describing how OSX encrypts the notes. I can only find articles from a few years ago staging it's 3DES but I would like to think its been upgraded since then.

Re:Lock Picking – A Basic Guide on Friday January 03, 2014 @06:46AM (#7004974)
Trained as a locksmith out of college, dad and sibling still trade mainly on "warrant runs" for the large energy providers when they need to get access to house to cut people off.

It's really cool seeing people take an interest in picking, but just wanted to point out that professional & hobbyist picking is completely different. A professional’s first priority normally is to get into the property, damage generally not being a huge issue so the approach changes dramatically.

First you try all the doors, as you would be surprised by how many people just simply don't lock their doors whilst making a judgment what will be the easiest entrance. Then you target the door with the worst lock, normally a UPVC door with a euro cylinder and use an electric pick gun to give it a quick blast. This gets you in within 5 minutes 90% of the time. [1] If the pick gun doesn't work you snap the cylinder in the door and replace the lock for a total cost of about £5 [2]

The hardest part of the whole job is when you have to identify a mortice lock in order to bypass it and knowing if it's worth an attempt at a pick. (Simple 3 lever locks are worth a pick first before a drill) Once the lock has been identified though it's easy to drill, you get your template out [3], mark up the holes and drill out the stump

There are also other methods and the general gist of the story is you use the method which takes the least amount of time with doesn't leave an unreasonable amount of cost!

Some other methods/products to look at which are interesting and commonly used:

- Mica, a specifically made plastic for slipping rim latches, most commonly referred to as "yale locks": http://uklockpickers.co.uk/mica-shim.html

- Letterbox tool, very basic (its just posh string on a stick) but also very effective at knocking off deadbolts or opening a latch that won't slip: http://www.walkerlocksmiths.co.uk/bypass-tools/letterbox-too...

- Try out keys for mortice locks with a low number of levers: http://www.walkerlocksmiths.co.uk/mortice-picks-tools/try-ou...

- Plug spinner for when you pick the lock the wrong way: http://www.youtube.com/watch?v=fUmCUj44BPg

[1] http://www.youtube.com/watch?feature=player_detailpage&v=mTt...

[2] http://www.youtube.com/watch?v=FqhhXyROxQM

[3] http://www.eltonlockservices.co.uk/drill%20template%20new%20...

Re:A Social Network for Crohn’s Disease – Crohnology (YC S12) on Thursday September 12, 2013 @04:29AM (#6372819)
With both myself and my partner having Crohns we have found a lot of value it Crohnology and its absolutely an amazing idea, simply for the community thats grown around it.

However my single annoyance is all the treatments are display by brand name and over here in the UK medicine is generally never referred to by its brand name, meaning it was extremely difficult to input my past treatments without a lot of googling

Re:What to expect in SEO in the coming months [video] on Monday May 13, 2013 @03:30PM (#5700880)
Apologies your right. Trying to bring it back around to my original point by rephraseing my orgional statement then.

If your worried about this update then you haven't been doing seo right and If your relying solely on a 3rd party for the existence or profitability of your company then you have bigger issue at hand than just your seo.

Re:What to expect in SEO in the coming months [video] on Monday May 13, 2013 @02:53PM (#5700630)
Yes probably I am, because we are talking millions of sites and statisticly your going to get anomolies. Then again if your business model is based primarily on your SERPs then you have a bad business model and should be doing everything you can to mitigate that risk.

It's one of the risks you take which should of been identified if your a competent business owner that wants to survive.

Re:What to expect in SEO in the coming months [video] on Monday May 13, 2013 @02:04PM (#5700312)
Keyword stuff is abusive, bolding all your keywords should rightly get you penalised. It's not far off the old days of stuffing the defunct meta keywords tag.

First point on googles webmaster guidelines says it all. Your chasing google, build a site for your users first, google will follow because it's in there interest to provide the most relevant content.

  Avoid tricks intended to improve search engine rankings.
  A good rule of thumb is whether you'd feel comfortable explaining what you've done to a website that competes with you, or to a Google employee.
  Another useful test is to ask, "Does this help my users? Would I do this if search engines didn't exist?
Re:What to expect in SEO in the coming months [video] on Monday May 13, 2013 @01:58PM (#5700257)
I can't deny negative SEO is a worry and yes whilst Google opened up the doors for it they also recognised it and have started providing ways to hopefully protect yourself. (Disavowing links etc)

If your in a competitive market where you have to worry about negative SEO so much so that it is making an impact on your SERPs then I'm sure the web spam team would be more than interested in hearing from you

Re:What to expect in SEO in the coming months [video] on Monday May 13, 2013 @01:53PM (#5700207)
I understand it's all algorithmic and there will be some truly innocent collateral damage involved but Google wouldn't be pushing this out if they didn't feel the overall quality of search would increase.

Most of the collateral damage is going to be people straddling the grey hat line and rightly so in my own opinion.

Re:What to expect in SEO in the coming months [video] on Monday May 13, 2013 @01:39PM (#5700089)
If matt says it's more substantial than penguin 1.0 then its going to have a big ripple effect, the last penguin update effected more than 10%+ of SERPS.

If your worried about this update then you haven't being doing "SEO" right.

Remotely reboot the router of any Virgin Media Superhub customer (Major UK ISP)

Virgin Media have an online activation process for their superhub users and at the end of the process they automatically reboot your router; but once this process is completed visiting this URL reboots your router regardless with no CSRF protection.URL: http://activation.virginmedia.com/Activation/start.doso a simple iframe on any webpage is enough to restart any virgin superhub users...

( Read More... | no comments | 2 points | on HN )
Re:Coinbase Response: Data On Merchant Pages on Friday April 05, 2013 @03:22PM (#5500457)
I wouldn't recommend detecting bots, Google will see it as clocking and badly penalise you for it as it goes against there guidelines: http://support.google.com/webmasters/bin/answer.py?hl=en&...

Returning a noindex meta or header should be enough for the honest crawlers, if your worried about dishonest crawlers then your fighting a loosing battle and have a different problem all together.

Re:Coinbase Response: Data On Merchant Pages on Friday April 05, 2013 @02:08PM (#5500010)
Disallowing a link in robots.txt will not stop google from indexing the page. Google "reserve the right" to index the page if they see links going towards it to stop webmasters shooting themselves in the foot, they however won't fetch the page in accordance to robots.txt.

The recommended way is to allow google to crawl the page but explicitly "noindex" the page via the robots meta tag (or even the x-robots header) - http://support.google.com/webmasters/bin/answer.py?hl=en&...

Edit: Matt, explaining in a video: http://www.youtube.com/watch?v=KBdEwpRQRD0

Re:Schema Migrations for Django on Friday March 22, 2013 @02:10PM (#5424568)
Andrew spoke about the current situation at DjangoCon last year (2012) not sure how much still stands out of this video but its good for a general overview of the current state and his plans for the core integration - http://www.youtube.com/watch?v=gwP7zLDDdPA
Re:Sick of SEO Scumbags on Monday March 11, 2013 @08:08AM (#5356166)
My SEO 101 has always been "Build a technically sound website with good content and UX. Then talk about it."

Google will follow, you shouldn't be chasing them. They are in the business of providing the most relevant results, make it easy for them to crawl you and the rest will come over time with trust.

Re:Stripe launches beta in the UK on Friday March 01, 2013 @08:02AM (#5304007)
Stripe Connect with collecting fees? - https://stripe.com/docs/connect/collecting-fees
Re:Stripe launches beta in the UK on Friday March 01, 2013 @07:49AM (#5303962)
Really good news. Can't wait to start taking payments by stripe for our "Stripe for Magento" extension, how about that for meta?
Re:Configuring A Static Asset Pipeline With Django And Heroku on Thursday February 28, 2013 @05:02AM (#5297993)
Using relative paths in your css generally resolves that issue, is there a specific reason that doesn't work in your use case?
Re:Configuring A Static Asset Pipeline With Django And Heroku on Wednesday February 27, 2013 @08:39AM (#5292256)
Instead of prefixing everything with {{ STATIC_URL }} in your templates, use the template tag {% static 'foo/bar/img' %} which will allow you to do asset time-stamping/versioning,

https://docs.djangoproject.com/en/dev/howto/static-files/#wi...

Edit: forgot to link to the versioning part in the docs: https://docs.djangoproject.com/en/dev/ref/contrib/staticfile...

Edit edit: ADMIN_MEDIA_PREFIX is also depreciated from 1.4 onwards: https://docs.djangoproject.com/en/1.4/releases/1.4/#django-c...

Re:How do keys work? Explained in one Gif on Tuesday January 22, 2013 @07:21PM (#5100590)
I have been brought up picking since I was in secondary school (Both Father and older Brother are locksmiths). It's very interesting stuff and once you see the in's and out's of peoples daily "security" you realise it's just about a game of not being the lowest common denominator. If a thief wants in, they aren't going to spend there time picking (or even bumping) they go straight for the snapper, or simply put the window through.

Apologies on the video music, you might want to turn it down but this is the first Video I come across of snapping a euro cylinder on youtube: http://www.youtube.com/watch?v=vVeij3jffCM

Re:Taking payments online in Europe in 2013 on Monday January 21, 2013 @07:45AM (#5091207)
Does the official extension do everything you require? We have actually just released a magento extension for Stripe and were looking at porting it over to Paymill but after some research figured out they had an official open source once so we are trying to determine if it's still going to be worth the time investment.
Re:Taking payments online in Europe in 2013 on Monday January 21, 2013 @07:35AM (#5091170)
We applied and simply got a rejection email with little to no explanation of why we got rejected which is disappointing. I'm going to try and open up communications with them again to see if we can reapply now that we are fully trading (unfortunately through paypal)

  The evaluation of new applications in order to accept credit card payments is subject
  to strict compliance rules and risk regulations in Germany. Our current acquiring 
  bank has declined your contract for some reasons with regard to their risk and compliance 
  management guidelines. We do not receive any detailed reasons from the bank.
  This is why we cannot give you a better explanation. Unfortunately, 
  Paymill does not have an influence on that decision.

Older »