• 1 Post
  • 111 Comments
Joined 10 months ago
cake
Cake day: September 11th, 2023

help-circle
  • I do something similar, but I guess scorched earth edition:

    • Only use firefox, no chrome or chromium variants

    • Never signed in to my google account (only have it to keep a gmail forward going for old ass subscriptions)

    • Have firefox configured to only keep whitelisted sites’ cookies and data between restarts - google is not on that list

    • uBlock Origin

    The last several months I started seeing that youtube screen “enable history to see recommendations” blank page when first landing, as if it was a punishment to me. It’s not. I remember all the channels I like, and it’s easy enough to keep checking back. So that blank screen is actually a nice bonus to me.













  • Funny thing I’ve been driving for 30+ years, and have never had a formal driving test:

    • Permit at 15: No tests, only restriction was to have a licensed passenger in-vehicle

    • License at 16: Had driver’s ed in school, state’s driving test waved, and license transferred to other states without any new driving test

    • Motorcycle license: Took a safety course while in the military, state added endorsement without any test, which also transferred out-of-state

    • Heavy vehicles: Trained on military 5-ton/deuce+0.5/Frontloaders/HMMWVs - all kinds of heavy equipment - no formal tests, only unit sign-off (even on civilian roads)

    • The kicker: I now live in a US state where a driver license is good with no re-testing till age 64

    Gonna suck when I actually do have to take a test. Hopefully there will be sane infra to go completely driverless by the time I get that old.








  • Doesn’t it require a separate process to be using the cryptographic algorithm in the first place in order to fill the cache in question?

    Yes, that’s my understanding. I haven’t looked at the code, but their high level explanation sounds like their app is making calls to an API which could result in the under-the-hood crypto “service” pulling the keys into the cache, and there’s an element of luck to whether they snag portions of the keys at that exact moment. So it seems like the crafted app doesn’t have the ability to manipulate the crypto service directly, which makes sense if this is only a user-land app without root privileges.

    why wouldn’t the app just steal your password and avoid all of this in the first place?

    I believe it would be due to the app not having root privileges, and so being constrained with going through layers of abstraction to get its crypto needs met. I do not know the exact software architecture of iOS/macOS, but I guarantee there’s a notion of needing to call an API for these types things. For instance, if your app needs to push/pull an object it owns in/out of iCloud, you’d call the API with a number of arguments to do so. You would not have the ability to access keys directly and perform the encrypt/decrypt all by yourself. Likewise with any passwords, you would likely instead make an API call and the backing code/service would have that isolated/controlled access.