101–110 of 152 posts
Earlier quoted context omitted.
> they can ask & issue orders to not discuss the matter, They can't do that.
Why not in the form of a National Security letter? https://en.wikipedia.org/wiki/National_security_letter
It can only compel the release of collected metadata to agencies.
Earlier quoted context omitted.
No soldering needed?
Yes, no soldering. Here's an example of the sort of thing that is sat on my desk: https://lastminuteengineers.com/esp8266-dht11-dht22-web-serv... If a NodeMCU board is too big for you then an ESP 01S is smaller and even cheaper. Less I/O options though but very useful. Needs a writer and wires to program. You can get one with a relay that is capable of switching 16A. https://frenck.dev/diy-smart-doorbell-for-just-2-d…
Earlier quoted context omitted.
Looks like it was a question about where to report it, followed by a handful of suggestions and _then_ the close. I don't see any reason for bad blood from that, especially since there was a bit of follow-on discussion and by the look of it, a fix was released a couple of weeks back.
Yeah, on second read I agree with you. I'm just wondering why the public PoC disclosure before that team had more chance to fix. The arduino-esp8266 folks are super popular in the ESP community. By my read, the fix is still open in that repo, tracked by the follow-up issue: https://github.com/esp8266/Arduino/issues/6436
Earlier quoted context omitted.
Why not in the form of a National Security letter? https://en.wikipedia.org/wiki/National_security_letter
No, a national security letter can't do this. It can only compel the release of collected metadata to agencies.
Earlier quoted context omitted.
Every hardware manufacturer can be instructed/bribed/forced to add backdoors to their hardware by their own government, hence the necessary push for open drivers/firmware (Broadcom itself, just to name one, has had strong ties with the US govt for a long time). I can imagine a meeting in which some high rank officer says "Here's our backdoor blob, you merge this to all your chipsets firmware, so when necessary we can…
> Every hardware manufacturer can be instructed/bribed/forced to add backdoors to their hardware by their own government, hence the necessary This is false. In most western countries governments cant force HW makers to add backdoor.
I'm not aware of anything that would prevent the court from ordering a vendor to implement features to effectuate surveillance ordered by the court.
Earlier quoted context omitted.
I suppose "relatively few people" is true if you define people the way it would have been understood a century ago. Corporate and institutional systems will almost invariably do WPA2 Enterprise. Without Enterprise, there's just one magic shared key "password" known to every user of the network. The Enterprise mode outsources authentication of participants to a separate service using EAP and nearly always ends up leve…
So if it's the norm to connect to unknown APs with SSID "eduroam" and submit your username and password, can I make a rogue AP that sniffs everyone's credentials? Or is this prevented under Enterprise, e.g. through a pre-shared certificate for the authentication server (which isn't run by the AP host)? If the latter, can I make my own real eduroam AP?
Since TLS ends up in the picture many institutions use the Web PKI, so a typical modern device already understands how to verify that this is the right server for example@example.com to authenticate against, it's the one with a Certificate for the DNS name example.com. But yes, they can do all this with custom certificates instead and I'm sure lots do that.
Yes, you can in principle make an EduROAM service. You should probably talk to whatever higher education or further education IT body exists in your country.
Notice that only academics and students get to access the network, so unless you're either of those things you'll need to also add an escape hatch for yourself and anybody else you want using it. Offering the service to others does not entitle you to any access, it would be only a courtesy to others.
Earlier quoted context omitted.
> Every hardware manufacturer can be instructed/bribed/forced to add backdoors to their hardware by their own government, hence the necessary This is false. In most western countries governments cant force HW makers to add backdoor.
I would be interested in a review of applicable law which would limit the effect of a US FISA court order. I'm not aware of anything that would prevent the court from ordering a vendor to implement features to effectuate surveillance ordered by the court.
And that's a pretty weak compulsion, since the people who are bound are the people who would ordinarily prosecute any federal crime, and they probably aren't interested in prosecuting themselves.
It's fine to say we want everything as secure as possible. But what about the tradeoff between a system being easy to connect/use and making it so difficult to connect that hobbyist users can't get the device to work. If you are doing mission critical or life-safety related work with $3 devices, you are doing it wrong. Spend a little more and use something else. In my case, I am monitoring room temperatures in my hou…
Actually I think it's easier to make cheap, mass produced device secure because you have loads of eyes to check the code.
But there is a point where you make a device so secure that it can be very difficult to connect with anything.
Earlier quoted context omitted.
So if it's the norm to connect to unknown APs with SSID "eduroam" and submit your username and password, can I make a rogue AP that sniffs everyone's credentials? Or is this prevented under Enterprise, e.g. through a pre-shared certificate for the authentication server (which isn't run by the AP host)? If the latter, can I make my own real eduroam AP?
The AP needs to arrange (typically with a RADIUS server) to tunnel the authentication to a remote EAP at the users institution. The local RADIUS server will discover your username (often an email address) but the other credentials used are up to the institution and only delivered there. It will often be MSCHAPv2 which is designed to authenticate Windows passwords, but it could even do X.509 client certificates. Since…
Earlier quoted context omitted.
>I'd say Espressif has a near monopoly due to first comer advantage. No. Espressif is used because it is _cheap_ and has relatively good support libraries. Just the chips/modules from other vendors are usually 15 to 20€ in single quantities while you can get an ESP8266 minimum development board (almost all normal arduino boards are minimum development boards) for like 3€. Unless other vendors reach that same level, t…
First comer advantage is huge. I work with a mid sized engineering consultancy. We began switching to ESP as our primary platform just around 2 years ago, just as wifi gadgets were starting to boom. To date, we got 500 megs of MCU project in our repo. Though most of code is repetitive, there is no chance we will part with such a huge codebase. Being able to complete a $200k project in a few weeks through code reuse,…
No. It was first comer advantage in affordable wifi MCUs since they existed just fine before but only as more expensive solutions as I mentioned. You can keep on claiming otherwise but the facts don't support you in claiming that there weren't wifi MCUs before.