• 9 Posts
  • 44 Comments
Joined 1 year ago
cake
Cake day: June 5th, 2023

help-circle

  • True, but worth reading their about page and privacy page. Not saying it’ll stay this way, but the way they are running is something that makes more sense then being sold as a product to Google. And you aren’t getting much of an incognito these days with all the fingerprinting they are doing.

    I will admit kagi search isn’t the highest performer, but it’s viable. DDG, Start page, etc. Might give you more privacy, or not (hard to tell with DDG these days), but it might be worth trying a different model for a while.

    I miss the days when the internet was truly free, but in lieu of that we have to have something better. Kagi is a start.


  • That’s an interesting example, I’ll have to look it out and see if the context bears it out. I say that as although yes he might have only gotten 43%, the question is how many registered voters didn’t vote and how many eligible but unregistered voters there were.

    Vermont has a fairly high voter turnout, but looking at Vermont’s Secretary of State 2016 had a voter turnout of 63% of Voting Age Population from census population. So that 185k of 505k thousands people who didn’t vote.

    Also if I have the right numbers from Vermont’ SOS, that’s 43% of the state total 63% who voted.

    I’ve read other demographic breakdowns on those who don’t vote which is worth looking into, but it’s hard for me to see someone say that there isn’t a mass when we have this huge population of American citizen who don’t vote. Something between 35-45% of the US just doesn’t. That’s a huge swath of disenfranchised people.




  • A brief technical summary from iMAP reveals what happens when users attempt to access sites using Cloudflare and Google DNS.

    • On Maxis, DNS queries to Google Public DNS (8.8.8.8) servers are being automatically redirected to Maxis ISP DNS Servers;

    **

    • On Time, DNS queries to both Google Public DNS (8.8.8.8) and Cloudflare Public DNS (1.1.1.1) are being automatically redirected to Time ISP DNS servers.

    “Instead of the intended Google and Cloudflare servers, users are being served results from ISP DNS servers. In addition to MCMC blocked websites, other addresses returned from ISP DNS servers can also differ from those returned by Google and Cloudflare,” iMAP warns.

    "Users that are affected, can configure their browser settings to enable DNS over HTTPS to secure their DNS lookups by using direct encrypted connection to private or public trusted DNS servers. This will also bypass transparent DNS proxy interference and provide warning of interference,” iMAP concludes.

    Essentially Malaysia law required ISP to drop DNS entries for some sites, local users started using public DNS. ISP started redirecting public DNS requests, and local users started using DNS over HTTPS.

    The pirate wars continue in their arms races.













  • If this request worked, it meant that I could use an “encryptedValue” parameter in the API that didn’t have to have a matching account ID.

    I sent the request and saw the exact same HTTP response as above! This confirmed that we didn’t need any extra parameters, we could just query any hardware device arbitrarily by just knowing the MAC address (something that we could retrieve by querying a customer by name, fetching their account UUID, then fetching all of their connected devices via their UUID). We now had essentially a full kill chain.

    I formed the following HTTP request to update my own device MAC addresses SSID as a proof of concept to update my own hardware:

    Did it work? It had only given me a blank 200 OK response. I tried re-sending the HTTP request, but the request timed out. My network was offline. The update request must’ve reset my device.

    About 5 minutes later, my network rebooted. The SSID name had been updated to “Curry”. I could write and read from anyone’s device using this exploit.

    This demonstrated that the API calls to update the device configuration worked. This meant that an attacker could’ve accessed this API to overwrite configuration settings, access the router, and execute commands on the device. At this point, we had a similar set of permissions as the ISP tech support and could’ve used this access to exploit any of the millions of Cox devices that were accessible through these APIs.

    Blows me a away that an unauthenticated API with sensitive controls and data was publicly facing. Corporations these days want all your data but wonder why some customers are worry about how it is protected, it let alone if it’s being sold. Why should I allow you to control my hardware when you can’t protect yourself.


  • While I agree with the sentiment, I have accepted that the simple way to make “things” work now is to leverage the cheap computing that is ubiquitous. That headunit is likely now built on a SoC or some embedded OS and is easier and cheaper because of it.

    Functionally we need regulations and safeguards in place that maintain the accountability for making the choice to use and build an OS as a life safety device that also serves Bluetooth audio. If the cost of supporting it, or failing to properly develop it, then perhaps the choice to make it dumb will become more adopted. Other economic forces are more likely to play out, but it’s a possibility that we can reinforce by what we buy and signal.