Viewing profile — cybergibbons

The problem is, people are using solely what3words for location. Every single call recording to emergency services doesn't use any other information. The odds are around 1 in 24 th…

Yeah, that's not true. https://cybergibbons.com/security-2/why-what3words-is-not-su...

Yes, that's pretty much the definition of incorrect.

Old skool! Those were the days :)

A design requirement of the app is it works offline.

Your surface area is totally incorrect.

Only with a ridiculously long word list containing plurals and words people can't spell.

Yeah, multiple MRT members have contacted me to say this is a real struggle. If someone is on the move, it's virtually impossible to work out what direction they are going.

It's promoted for use in search and rescue, so other bands are in use.

Why 3 words? Why not 4?

You would still get high densities of cells which share two words being present close together, leading to any issue with the third word causing a confusing location.

No, I went from the patent and using the API instead: https://twitter.com/cybergibbons/status/1386344576856825858 https://twitter.com/cybergibbons/status/1386393951276609539 https:…

The word list already is 40k long. That's beyond most people's vocab and includes really awkward to spell words. IMO, if the solution is to use words, then What4Words would have ha…

Two reasons: 1. It needs to be reversible so you can go from words to lat/lon. 2. They wanted to use shorter words in cities, so the distribution of low n didn't want to cover the …

Yes, sorry, added that bit on my phone when out and about and made a mistake. Corrected.

RTCs are actually quite rare, especially in a lot of the lower power RF SoCs. Drift would also be an issue - most move at least 10 minutes a year. That's with good temperatures, no…

Is CTR more common?

I've added a section on padding oracle attacks towards the bottom. I don't think there's a significant different in ease of understanding between most of the modes. I used CBC as i…

I considered using a padding oracle attack in the post, but it's aimed at a very basic level of understanding. I find padding oracles are much harder to describe to newcomers. Also…

Why do you need to spend money to use HTTPS with IoT?

Less well tested than OpenSSL, but historically has been relatively secure.

Specifically, in the case of the firmware running on the Trådfri gateway, it already supports TLS.

No, unfortunately not. We had to do it all black box as it was on sale or return, so couldn't inspect the firmware to find vulns. It was runnign Tizen, which makes things a lot har…

I did the work on this. Yes, the much bigger threat is taking control of these devices and using them as a pivot. We've done this for IP cameras, DVRs etc. It doesn't seem to engag…

I did the work on this. Yes, the much bigger threat is taking control of these devices and using them as a pivot. We've done this for IP cameras, DVRs etc. It doesn't seem to engag…