I worked in IT at a university about 15 years ago. As part of a research project I helped set up a Tor exit node. Within a few hours of it taking on traffic I was contacted by the universities IT security team. They were seeing all sorts of malicious traffic originating from that system and wanted to know what was going on. They had the system shut down immediately.
A few years ago I was given a technical deep dive into Akamai’s bot detection systems. One area they were quite focused on were bots impersonating mobile devices, and in particular mobile apps. It’s commonplace for attackers to try to mimic the behavior of mobile apps because it often provides more direct access to the data they’re looking for than trying to scrape websites.
To counter this threat Akamai developed a library for their customers to incorporate into their apps. This library collects a bunch of haptic data from the mobile device, such as the tilt sensors, accelerometers, finger taps/swipes on the screen, and other available data. It then encrypts it and sends it along to Akamai along with the data the app sends. Akamai then analyzes that haptic data and uses it as part of their bot detection analysis.
It is VERY difficult for a computer to mimic the truly random way a mobile device moves in space, or the way your fingers tap/swipe on a screen. If you were asked to draw a straight line from the upper left corner to the bottom right corner of your smartphone, not only would it not be perfectly straight but it would be quite fluid in its randomness. Writing a computer program to simulate that would be very tough. You’re far more likely to get lots of short straight lines with jagged angles than something that looks like a human drew it. And computer algorithms can quickly analyze this sort of data and return a confidence score indicating if it appears to have been created artificially or not.
So my guess is that when that QR code is scanned it will launch a Google app that will collect some similar haptic data and send it off to Google along with a unique id for that captcha. Google will then quickly analyze that haptic data to determine if you’re a bot or not.
This has been the norm for high ranking US politicians for decades. About 10 years ago I attended a talk by former Australian Prime Minister Julia Gillard. She described how, as PM, she would regularly take walks along a river in Perth and talk with the folks she would encounter. She had a couple personal security guards who would be with her, but it was all very informal.
When Hillary Clinton visited as US Secretary of State she came with an escort of a dozen or so Secret Service in her entourage. On a whim Gillard suggested going for a walk like she usually did. The Secret Service freaked out that this hadn’t been planned weeks in advance, that the walking route hadn’t been scouted out ahead of time, that they didn’t have agents pre-positioned along the route, etc.
I recall that Gillard said they actually did go on a short walk, but the entire Secret Service entourage was very nervous the entire time.
Haven’t you heard the price of memory is skyrocketing?
I have a few decades programming experience, as a professional software engineer, an open source developer, and a DevOps engineer. There is no way in hell I would do a code review where 15k lines were added and a similar amount of lines removed without having a long discussion with the person who made those changes. I’d want to ask a lot of detailed questions about the changes, questions that an LLM isn’t likely to answer, and most definitely not questions I’d be inclined to try to type into an LLM to try to get an answer.
Over the years I’ve dealt with all manner of bugs, from overflows & underflows, to bad assumptions about logic flow, and much much more. The whole purpose of pointed questioning of the author is to be comfortable with decisions made in the code and to minimize the chances of all sorts of potential bugs.
Just wait until buggy malware worms its way into these things and the screen just shows kernel panics in an infinite loop.
Edit: or worse, somebody hacks it to play random hardcore porn videos.
How do you decide which open source projects are worthy of taxpayer money, and how much does a given project get?
I have a couple projects I’ve put up in GitHub as open source. Would they qualify? Or are you just talking about well known open source projects like Linux?
Reminds me of the estimated 3,000 pairs of shoes that Imelda Marcos reportedly had.
They’ll drag out any legal challenge in hopes you won’t want to pay for months of legal fees fighting it, on top of whatever legal fees are incurred that caused you to challenge it in the first place…
It definitely needs to be private. If an attacker can obtain both the password hashes and the salt(s) (via the same database vulnerability for example) then they have everything they need to run offline attacks against the passwords.
It could be an older codebase that’s using an inline encryption algorithm as opposed to a hash. Using an encryption algorithm with a private key would result in varying length outputs.
Proper hashing of a password includes a salt that should be kept private. This means the password should definitely be passed to the server in plaintext. The server adds the salt to the password, then hashes it.
This adds more protection should an attacker somehow manage to get access to your hashed passwords. Even if they identify the type of hashing mechanism used it will prevent the use of rainbow tables, dictionary attacks, etc. against the hashes.
I’d be surprised if that worked these days. They do much more than just a cursory check whenever we go. And they also now scan your membership when you enter, and your photo pops up on their tablets. I’d be curious what would happen if the photo didn’t match…
Probably the companies themselves. I work remotely, and our company provides software phones to remote workers as needed. 99% of the time I don’t need one, but there have been a few times where I’ve needed one for various reasons. So I have one temporarily set up for myself, usually for just a few days. Just about every time I have done that I get random voicemails from frustrated customers who are trying anything to just reach a human.
Wary why? I work remotely in IT and manage a ton of Linux systems with it. Because my company has a large number of remote employees they limit us to Windows or Macs only, and have pretty robust MDM, security, etc. installed on them. Since MacOS is built on top of a unix kernel it’s much more intuitive to manage other unix & linux systems with it.
Personally I haven’t used Windows really since before Windows 10 came out, and as the family tech support department I managed to switch my wife, parents, brother, and mother in-law all to Mac’s years ago as well.
Ugh. I didn’t realize that & haven’t checked out their site in ages…
I just searched for their app in the Apple App Store and it looks like there are at least a few competitors out there now, so if you’re interested in something like this then I’d suggest shopping around to see what alternatives are available.
ANI and CallerID serve two very different purposes. Suppose you managed the telephones for something like an insurance company, where you have lots of customers calling in, but also have lots of employees calling out. You want the Caller ID on your customers phones to show the main # for your company whenever you call them, so it would show something like 1-212-555-1000.
Because the company has a lot of employees, it has 100 individual phone lines, so 100 agents can be on calls at the same time. The phone company actually allocates 100 numbers in that case, and those numbers could be very different than the above -1000 number. So the numbers 1-212-555-7000 through 1-212-555-7099 all belong to the company. Each time an employee makes a call their telephone system finds any one of those numbers between -7000 and -7099 that isnt in use and uses it. The call is billed to that specific number, and the bills for all 100 lines are combined & billed to the company at the end of the month.
If the company couldn’t configure its phones to display 1-212-555-1000 as the Caller ID then customers would see random numbers in the range of -7000 to -7099 any time the company called them.
I’ve never personally used it, but https://www.trapcall.com is a service that can reportedly unmask spoofed/blocked numbers and provide you with the actual number a person is calling from.
I did computer telephony work many years ago and have a general understanding of how this works. Caller ID is trivial to spoof, but there’s an underlying protocol called Automatic Number Identification (ANI) that was historically used for long distance billing when those calls were billed by the minute. Since it involves billing it can’t be spoofed by the caller, and the telephone companies are careful to ensure it’s accurate. What Trapcall apparently does is replace the spoofed Caller ID with the ANI.
DigiCert recently was forced to invalidate something like 50,000 of their DNS-challenge based certs because of a bug in their system, and they gave companies like mine only 24 hours to renew them before invalidating the old ones…
Community theater can be a great choice if you have them in your area. $25 for a bunch of volunteers beats out the outrageous prices charged by megacorps like Ticketmaster any day of the week. I’ve seen many quality community theater productions, and have even seen some actors who have gone on to have professional TV and movie careers.