Hacker Newsnew | past | comments | ask | show | jobs | submit | taviso's commentslogin

It's fun, but reminds me of a trick using Xvfb.

For example...

    $ Xvfb :7 &
    [1] 21688
    $ xeyes -display :7 &
    [2] 21697
    $ xwd -display :7 -name xeyes -out /dev/stdout | convert xwd:- sixel:-

It looks like this: https://imgur.com/a/Eq2ToVO

Obviously no input though, you would have to use xdotool! The main benefit is that you probably already have all these tools installed :)


Looks like you're on Windows? You can run X apps with XMing, I used to do it years ago. You can run the actual X app and use it, not just get a screenshot.


The point is to view it in a terminal (e.g. XTerm, Konsole, etc), of course you can just run it in an X server.


In 2022, Google TAG were awarded a "lamest vendor" award at defcon for fixing a Chrome vulnerability they discovered was being exploited in the wild... without asking for permission from the NSA first. That was the turning point for me.


Ok that's weird indeed. Here at European hacker events this action would be applauded. Getting permission from spy agencies before fixing something would be a surefire way to get lamest vendor, lol.

Most there don't trust government. And besides security holes can be used by all sides so it's imperative to fix them asap.


I think this award was satire, not to defend defcon, but yeah


A Pwnie for "unilaterally shutting down a counterterrorism operation”


I've used the tool sequin in the past to debug issues: https://github.com/charmbracelet/sequin

It worked great for me, seems much easier to debug logs directly in the terminal.


Thanks for sharing, haven't seen that one yet. Will see if I can borrow ideas from it.


They accidentally used the example key from AES-CMAC RFC, the full details are in the accompanying blog post: https://bughunters.google.com/blog/5424842357473280/zen-and-...


Yikes! One would have expected a little more code review or a design review from a hardware manufacturer, especially of security system. A system that people have been worried about since the Pentium FDIV bug.

I guess this one just slipped through the cracks?


Taking "never roll your own" too far.


I feel like using the example key isn’t really the big failure here.

They didn’t need a keyed hash at all, they needed a collision resistant hash.

SHA256 would have eliminated this vuln and it has a hardcoded “key” built into it.

Using a secret key for CMAC would not have been more secure, it would have just meant sophisticated hardware extraction of the key was required before this attack could be mounted.


I suppose the reuse wasn't accidental, but they mistakenly thought the key doesn't matter for CMAC.


I'm not familiar with the expert they consulted, but the claim that "The main advantage of 2FA is that it is much more difficult to gain access to your accounts via phishing attacks" is just plain false.

TOTP or SMS-2FA are obviously phishable, if you just entered your password into a phishing site, why wouldn't you also enter a TOTP code? I usually point to Modlishka as a practical example (https://vimeo.com/308709275) to help visualize this.

In fact, the main (claimed) advantage of 2FA is that it prevents "Credential Stuffing" of reused passwords. I personally don't think TOTP (or similar) are a good solution to this problem at all, but this is a thorny issue.


The point here, I believe, is that 1Password will only prompt you to enter the 2FA code if the domains match, same with the password. Your point that if you've already decided to enter your password then entering the 2FA code isn't much of a hurdle is sound, but from the perspective of a user of 1Password, it is indeed very surprising (and rare!) when I try to log in to a page and find that 1Password won't show my log in because the domains don't match. It happens, usually due to some cross-origin login flow, but it's rare. So I think the claim isn't false, it's just based on a premise that might not factor in for different people.


If domain doesn't match, password manager of choice will not suggest to populate credentials. In that case it doesn't matter if 2FA is saved by the password manager, or is managed on another device, because you won't have the chance to use the 2FA.

If domain doesn't match, and you manually copy the password, and login, you can as well manually copy the 2FA code.


> The point here, I believe, is that 1Password will only prompt you to enter the 2FA code if the domains match, same with the password.

Yes, same with the password.

So it is not an advantage of 2FA.


I think their point was that it's less phishable from the perspective of needing the attacker to try logging into the site with it in realtime instead of being able to just store the password for some later time. The needed concurrency makes it more difficult (if only slightly).

I'm curious though why you don't think TOTP or similar are good against credential stuffing though, would you be able to expand upon that?


The attacker doesn't need to literally be sitting at a keyboard, that can just be automated.

> I'm curious though why you don't think TOTP or similar are good against credential stuffing though

I have written about this before, but looks like I lost the article somehow. https://web.archive.org/web/20210219185711/https://blog.cmpx...

Imagine you reuse the same password everywhere, and are sick of credential stuffing attacks. You ask your friend for advice, and your friend tells you to just enable TOTP when available, explaining that when there is a data breach you will be safe.

That is obviously bad advice, the vast majority of services do not use TOTP and you will have to race attackers to change your credentials quickly at dozens (hundreds?) of services. I think a reasonable person would say that you have not "prevented" credential stuffing.

A far better solution is unique passwords, it works today with all service providers.


I think that's a miss for Claude, this doesn't look right at all. The accrual account is an okay solution, but the syntax is wrong! That syntax is only used for budgeting and forecasting.

I think the solution is effective dates, there is an example pretty close to this scenario in the manual:

https://ledger-cli.org/doc/ledger3.html#Effective-Dates


I don't think it's terribly wrong. It will generate the desired entries (internally) and proper reports, if you add the appropriate option (--forecast=... for hledger, something else for Ledger). Or you could use it once to generate permanent journal entries, in your main journal or a forecast journal:

  hledger print --forecast='2024-11-01..+3 months' >>$LEDGER_FILE
Effective dates are another solution, but IMHO a misfeature, I mention this for newcomers: https://hledger.org/hledger.html#secondary-dates


Thank you for pointing this out, will check your link instead.


This seems like a weak excuse, the same problem exists on UNIX, but slocate solves it well enough. The slocate solution is to build the index and record permission and ownership, then it can restrict output to entries you have permission to see at query time.


I bought a few items at a drugstore yesterday, and noticed the cashier had very elaborate nails.

She used the second knuckles on her inverted hands (i.e. palm facing up) to operate the touchscreen PoS system, and was very efficient. Tool usage can sometimes be adapted.


I think they're talking about the cp example, doesn't seem like it would handle filenames with spaces!

Super neat project, btw!


You're right, thanks for the bug report. It should now be fixed :)


Super cool, I didn't know about this - too bad it's not archived. I did know about a different game for 1-2-3, I even managed to track down original media and get it working in Linux!

https://lock.cmpxchg8b.com/doom.html

There is a brief gameplay video, if you want to see it.


Consider applying for YC's Winter 2026 batch! Applications are open till Nov 10

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: