121–130 of 211 posts
This is super irresponsible to have on HN. Not funny. Especially for people who live in despot countries. Not sure if the USA counts quite yet.
Earlier quoted context omitted.
Why don't people just visit in incognito mode in the first place?
Because that's annoying, history is useful sometimes, and logging in to multiple times to multiple sites is a chore. Edit: grammar
History is important, but the site is called "ruinmysearchhistory.com". I visit websites I know with my normal window, the rest is mostly in incognito and if it's something I want to remember, I'll make sure to include it (i.e: visit it in normal mode, Evernote, Bookmarks, email to myself, etc).
Earlier quoted context omitted.
How do you know this for a fact? If the roles were reversed would you delete? Or would you just like and say you did?
(Tedious disclaimer: my opinion only, not speaking for anybody else. I'm an SRE at Google.) I can happily endorse the company's public statements on this subject: personal data will be deleted within the timeframes specified (for obvious technical and that's-a-bad-idea reasons, it's not instant). Part of SRE's function is to arrange for SLAs to be met, including deletion SLAs.
Earlier quoted context omitted.
If I were in charge of a publicly traded company I most definitely wouldn't want a scandal like that lurking beneath the surface. It would absolutely leak.
The existence of classified programs that remain classified and unknown for years is evidence against this oft-used argument.
Earlier quoted context omitted.
I'm no security expert, but I was under the impression that HSTS pinning would make that hard to do, especially on sites like google.com. And I can't quite parse your sentence to know if you're implying that all companies do... (or just that I shouldn't be so naive as to assume none are), but I can see the cert chain for google.com in my browser at ${big_company} and it doesn't seem like I'm being MITM'd.
You have conflated two technologies - Strict Transport Security, which is a header that tells the browser to stick to TLS connections only. If your admin has deployed a CA that your browser trusts and uses a cert from that CA to MITM your traffic, they will have no problems doing so ;) Certificate pinning, on the other hand, allows a client to refuse to connect to a TLS service that fails to prevent the correct certi…
Earlier quoted context omitted.
Rule of thumb: if an adversary has physical access to your computer, treat it as compromised.
Okay? I'm very familiar with that principle, but I don't understand how to take that statement and apply it to the situation at hand. No one has ever operated this computer except me (though I did enroll the corp wifi certs). So again, how could I be MITM'd without being aware of it, given HSTS? Yes, someone could have snuck in a hacked copy of Chrome Canary that exposes phony cert chain information... but that's not…
Earlier quoted context omitted.
I had a weird one yesterday. I went to the New York Times using private browsing and read a single article in the relationship section (something about wedding speeches) and then noticed that the next page I went to 90% of the recommended articles were engagement announcements. I guess things are hard when you only have a single data-point to base recommendations off.
I always find it amusing when you sign up for a service, and then for the next little while, half the ads you see are for that service. "Uh... but I've already signed up..."
Earlier quoted context omitted.
I had a weird one yesterday. I went to the New York Times using private browsing and read a single article in the relationship section (something about wedding speeches) and then noticed that the next page I went to 90% of the recommended articles were engagement announcements. I guess things are hard when you only have a single data-point to base recommendations off.
I always find it amusing when you sign up for a service, and then for the next little while, half the ads you see are for that service. "Uh... but I've already signed up..."
Earlier quoted context omitted.
You bet they do! In the past I have had to manually install my company's certificates as a root CA. The annoying thing was that the certs they use are expired and use SHA-1, so I also had to explicitly tell my browser to trust expired/unsafe certificates as well. All in the name of increased security!
I would quit a job like that, unless there were seriously profound reasons for such a grotesque invasion. 1. There are proper ways to restrict activity without resorting to eavesdropping. 2. If they don't trust you enough to be responsible and use good judgement, you're probably stuck in a dead-end situation anyway. 3. In the more rare scenarios, where you might be operating live-saving or life-threatening equipment,…