• 1 Post
  • 291 Comments
Joined 10 months ago
cake
Cake day: September 11th, 2023

help-circle













  • Funny thing I’ve been driving for 30+ years, and have never had a formal driving test:

    • Permit at 15: No tests, only restriction was to have a licensed passenger in-vehicle

    • License at 16: Had driver’s ed in school, state’s driving test waved, and license transferred to other states without any new driving test

    • Motorcycle license: Took a safety course while in the military, state added endorsement without any test, which also transferred out-of-state

    • Heavy vehicles: Trained on military 5-ton/deuce+0.5/Frontloaders/HMMWVs - all kinds of heavy equipment - no formal tests, only unit sign-off (even on civilian roads)

    • The kicker: I now live in a US state where a driver license is good with no re-testing till age 64

    Gonna suck when I actually do have to take a test. Hopefully there will be sane infra to go completely driverless by the time I get that old.



  • executing foreign JavaScript

    This is a great point I try to convey to my less-technical friends and family. Looking at a webpage is not like changing the channel on a tv of old. Looking at a webpage pulls code from who knows where and executes it on your local machine.

    These advertisers expect that I should blindly trust them to execute code on my cpu, in my memory, on my machine? Yeah fuck that, it’s a privilege. I don’t invite every hobo walking by to come into my house and take a shit in my toilet.

    If they don’t like that not everyone executes their syphilis-ridden javascript, then they should put their shit behind a paywall. But they won’t, since they know they don’t have a product worth paying for.





  • Doesn’t it require a separate process to be using the cryptographic algorithm in the first place in order to fill the cache in question?

    Yes, that’s my understanding. I haven’t looked at the code, but their high level explanation sounds like their app is making calls to an API which could result in the under-the-hood crypto “service” pulling the keys into the cache, and there’s an element of luck to whether they snag portions of the keys at that exact moment. So it seems like the crafted app doesn’t have the ability to manipulate the crypto service directly, which makes sense if this is only a user-land app without root privileges.

    why wouldn’t the app just steal your password and avoid all of this in the first place?

    I believe it would be due to the app not having root privileges, and so being constrained with going through layers of abstraction to get its crypto needs met. I do not know the exact software architecture of iOS/macOS, but I guarantee there’s a notion of needing to call an API for these types things. For instance, if your app needs to push/pull an object it owns in/out of iCloud, you’d call the API with a number of arguments to do so. You would not have the ability to access keys directly and perform the encrypt/decrypt all by yourself. Likewise with any passwords, you would likely instead make an API call and the backing code/service would have that isolated/controlled access.