quit32

It is likely that the reader will be implemented into a phone / tablet app so will be pretty ubiquitous eventually.

FWIW it will never technically be legal to rely on visually looking at someones phone to verify age / id bc it would be incredibly easy to fake the display and physical interaction. The only reason it can work as an ID is if it is digitally verified by a reader.

But I do agree that especially in the interim there will be cases where LEO will coerce a phone handover but I don't think this will be a long term problem since physical interaction with the phone does nothing to verify authenticity. You may as well hand them a piece of paper you printed out with your info.

Places that support Apple's digital ID / Wallet state ID do so by utilizing a an identity reader that the user taps their phone against after selecting which info they want to convey. It is not meant for the owner to physically show the phone to the requesting party.

I'm sure this will happen in some cases especially in the interim where digital ID is technically not accepted but the person doesn't have their physical ID. An example would be a traffic stop in a state that currently supports digital state ID since usually the digital ID is basically only supported at TSA currently. But the cop looking at your phone doesn't add any more authenticity vs you just verbalizing the info and them writing it down which is what they usually do if someone has a photo of their missing ID.

Also, Apple cleverly designed it so if phone is in locked state and you activate wallet and select ID, the biometric scan it does doesn't unlock the entire phone and trying to get into the rest of phone requires another biometric scan or phone password.

From the article "Users do not need to unlock, show, or hand over their device to present their ID."

Odd use of Twilio for just a SIP Trunk provider. They also offer programmable voice SIP, a product that is a distinct offering from the Elastic SIP trunking used here. With PV SIP you can directly register the Grandstream HT801 ATA to a programmable SIP endpoint on Twilio and move all the programming logic, including text to speech, to a Twilio serverless "function" and completely cut out the need for a RasPi and Asterisk.

Also FYI for those who do want to use Asterisk behind CGNAT and cannot open ports - if you use PV SIP you can also register it as a Trunk in Asterisk and it can then receive inbound calls over the connection established by the outbound registration with simple a simple Twiml bin that routes whatever Twilio numbers you want to the SIP user you used to register the Asterisk's SIP Trunk. Asterisks can can then use inbound number plan to further route the inbound call as needed.

lol "tracks your current GPS"

Starlink is not going to be A#1 target in space in a new world war. Reconnaissance and Mil Comms satellites will be.

What is really egregious is that apple still touts the T2 security benefits on their site and completely ignores the fact that it can be compromised. This in fact does make it harder to take Apple's hardware security claims at face value knowing what they know about T2 vs what they put out in their resources.

Ahh sorry I forgot I'm using the Twilio ekata_reverse_phone addon that you can get in twilio marketplace so I have carrier info in the lookup response.

I guess then whether it is 100% on Twilio being the carrier is a little less likely but I tested a few more twilio numbers I know and they all returned with Twilio as carrier.

You are probably complaining about calls on a cell line but if happens to be landline, I ported one over to Twilio and actually used it to eliminate spam calls by requiring non whitelisted callers to press 2 digits to continue the call. And also saving about 7x compared to AT&T landline cost.

Connected a voip phone to it via programmable SIP.

Twilio's own lookup API will tell you if they are the carrier with I assume pretty good accuracy. It works on the number I own with Twilio.

Some of the political texts I get show twilio as carrier. Calls tend to be Onvoy which is now Inteliquent I believe.

Will also show who the carrier is believed to be if not them.

https://www.twilio.com/docs/lookup/tutorials/carrier-and-cal...

It is not really being sprung on them with how long it has existed. Not at all like continuing recording on a webcam where you might say things never intended for the party receiving it.

Are ppl who don't even know DKIM exists but know they have shady emails saved in the cloud or on their personal really just banking on repudiation and thats why they take no other action like deleting the email or putting more thought into emails they send? Seriously doubt it.

Exactly bc of statute of limitations, they would not have to look over their shoulders for the rest of their lives because of one poorly written email.

Yes. I have seen first hand where it was used to help accelerate out of court agreement without needing a lawsuit. Basically a 3rd party had one of their outlook user accounts compromised by a bad actor who used it to tell another company new instructions for something.

The 3rd party tried to say other company fell for a phishing email and it was their fault but because of DKIM it was immediately provable that instead 3rd party was compromised and email legit sent from their o365 and they were pretending like they didn't know this. This all got disputed maybe a year after email sent.

Love Matthew Green but I personally am not a fan of this proposal. It doesn't fully achieve what he wants bc its only gmail and timing of compromise would be key. Most of the email hacks have actually been very much in the public interest despite being unethical. Breaches also lead to more productive work by companies in better securing accounts and better protecting sensitive information which google has been doing with account security and adding expiring messages.

Like do we really want companies to just continue sloppily sending customer info in email bc they can deny its legit or should they focus on not getting this info compromised to begin with?

Also, for ransomeware groups that now post data when not paid, it is not really seeming like too big of a disincentive that there is repudiation regarding the files they post.

As mentioned at the end of the original article, you can disable the apple TV recommendations.

Just don't connect it to the internet.

Also great solution for cheap subsidized TVs where they are banking on your connecting to your network so only charge $100.

Plug in an apple TV and you are set.

DCS is so cool. I feel like I need to quit my job / be single again in order to learn it though.

I got the rift in order to play it only to realize that learning DCS from the ground up requires a lot of keyboard input / referencing cheat sheets so need to be pretty proficient with it before you can't see your hands and as you mentioned the resolution is not quite good enough in rift to really see things with much detail though it is still a fun experience to try out.

Looking forward to playing it on a future headset.

It is beyond comprehension that they think pin reminders being mandatory is ok. I have been a huge fan of signal from the beginning and this is single handily a deal breaker and has me looking for alternatives.

How did they not learn from this when they tried it with the activation lock.

Also worth noting that cloud flare is a large driving force behind encrypted SNI which is the last nail in the coffin for putting ISPs in the dark when your average consumer is browsing the net. https://blog.cloudflare.com/encrypted-sni/

Basically when you connect over https using TLS 1.2 to a site that is hosted on a shared server or behind a load balancer, your browser must tell it in clear text which host name it is trying to connect to. Encrypted SNI in TLS 1.3 also encrypts this info such that if you are also using DoH or DNS over TLS to encrypt DNS query then the ISP can only see the IP of server you connect to which is often going to be a huge cloud provider's load balancer that might serve hundreds or more different sites throughout the day / at the same time.

Literally the next para in that blog - "we committed to retaining KPMG, the well-respected auditing firm, to audit our practices annually and publish a public report confirming we're doing what we said we would."

In addition Mozilla put them through a rigorous process when selecting them as their default DoH provider which included them contractually agreeing to adhere to their stated policy. https://wiki.mozilla.org/Security/DOH-resolver-policy

For one cloudflare is a lot more reputable than most US ISPs. Cloudflare explicitly says "We committed to never writing the querying IP addresses to disk and wiping all logs within 24 hours." https://blog.cloudflare.com/announcing-1111/

If gov tried to force CF to change that they would likely put up a huge public legal fight to prevent it whereas ATT / Verizon and Comcast would bend over backwards to secretly comply while also simultaneously seeing if they could inject some ads into the pages you visited.

Great write up. I agree I do not trust them very much and would not use them on a network that has internet access.

They are a great cheap option when using their custom RTSP firmware with synology surveillance stations. I throw them on their own SSID that is isolated from other local networks and does not have internet access. The SS can reach into their network but they can't initiate connections out.

Still they briefly need internet when setting up to enable RTSP but I'm more concerned about them being remotely accessible at anytime and having access to anything else on my network. Even my setup would allow my email and the isolated network's topo to leak bc of brief internet access.

Twilio is pretty great but for this use case using Google Voice is a lot simpler (assuming its available in your country)

I recently did this for a firm that is fully remote now during pandemic. They had non voip line for main number. Set the office phone to FW to a GV number and put GV in DND so it goes straight to voicemail which was what they wanted. Then setup GV to send voicemail to email and gmail to forward to slack channel using the basic slack email integration app.

All in all very easy to setup in 20 min or less and get transcribed VM in slack channel with link to play the message as well.

Article is completely wrong about not being able to decrypt other clients traffic when the PSK is known to the malicious actor and the authentication handshake is able to be observed.

This is well known and even documented in wiresharks guides. see Gotchas -> "WPA and WPA2 use keys derived from an EAPOL handshake,..." https://wiki.wireshark.org/HowToDecrypt802.11