Earlier quoted context omitted.
SMS is not really great.
SMS is trivially exploitable. It has negative security value.
Trivially? How?
Keyhole – Forge own Windows Store licenses
181–190 of 319 posts
Re: Keyhole – Forge own Windows Store licenses
#182Now I just wish this could give me a license to install the Lego Boost for Windows 10 app that used to be on the windows store until 2020... From my understanding, if you have the license, then you can still download it but it's not available for new users.
Maybe you could use this instead: https://en.scratch-wiki.info/wiki/LEGO_BOOST_Extension
Re: Keyhole – Forge own Windows Store licenses
#183Earlier quoted context omitted.
Exactly why you should never, ever, enable auto update, for anything. Too often it ends up breaking something or patching something you don't want patched. It allows a profit seeking company to enable or disable software functionality on your device, regardless if it's in your interest.
It should be noted that unless you've modified an Xbox One, from what I understand you cannot stop it from auto updating unless you permanently disconnect it from the internet (which will cause your licenses to eventually expire, in the year timespan or so), new launch games won't run (they're tied to a minimum version of the OS).
[deleted]
Re: Keyhole – Forge own Windows Store licenses
#184Now I just wish this could give me a license to install the Lego Boost for Windows 10 app that used to be on the windows store until 2020... From my understanding, if you have the license, then you can still download it but it's not available for new users.
Maybe you could use this instead: https://en.scratch-wiki.info/wiki/LEGO_BOOST_Extension
I tried that and it'll be great when my kid is older but the Lego Boost app has some kind of gamification built in that's honestly pretty sweet and is a good gateway I think.
Right now, I'm using an android emulator to be able to run the app on a laptop (we don't have tablets) but it's a janky experience compared to a native windows app.
Re: Keyhole – Forge own Windows Store licenses
#185Earlier quoted context omitted.
[flagged]
There's no way secure boot totally prevents cheating, either. It just moves the goalpost a little, cheating will always be possible.
The goalpost just needs to be moved further than is economically interesting for cheaters in general to reach.
Perhaps secure boot by itself isn't enough, but I would imagine it would be a relatively large bump, when combined with a kernel-level anti-cheat. I presume such anti-cheats would e.g. disable the debugger access of game memory or otherwise debugging it, accessing the screen contents of the game or sending it artificial inputs.
What vectors remain? I guess at least finding bugs in the game, network traffic analysis, attempting MitM, capturing or even modifying actual data in the DRAM chips, using USB devices controlled by an external device that sees the game via a camera or HDMI capture.. All these can be plugged or require big efforts to make use of.
Re: Keyhole – Forge own Windows Store licenses
#186> As it turns out, data after the signature block isnt checked at all... and it can even override data that came before it. Whenever two blocks of the same type are stored together, the last one overrides all the others before it. So, if we want to change any license data, we can just make a block for it and put it after the signature block! Amazing.
I wonder if this is the worst cryptography blunder since Nintendo Wii using 'strncmp' to validate a hash (which stops after the first matching 00 byte)
This "check the block signature and then read another one" bug is incredibly common. I'd say it's one of the top 5 bugs I see in Validating Things. Other examples of places I've seen this recently include some variants of VW AG infotainment systems (mostly MIB2 High, I think), but it's kind of everywhere (as was the `strncmp-a-hash` method of validating an RSA-PKCS#1.5 signature).
This is probably the most egregious/impactful manifestation of it, though, especially if it applies to Xbox.
Re: Keyhole – Forge own Windows Store licenses
#187Earlier quoted context omitted.
Total tangent, but extremely interested in the use of the Yen/Yuan sign as a footnote marker. Is there some history here I’ve overlooked or is this just arbitrary?
Haha - i was looking for ¹, ² or § but couldn‘t find them on my german ipad onscreen keyboard, so i improvised.
I learned BASIC programming on a VIC-20, and I typed in so many "A$, B$, C$", for decades thereafter I pronounced "$" as "string" ("A-string, B-string", etc); it got weird as I discussed Perl scripts with coworkers...
Re: Keyhole – Forge own Windows Store licenses
#188Earlier quoted context omitted.
Total tangent, but extremely interested in the use of the Yen/Yuan sign as a footnote marker. Is there some history here I’ve overlooked or is this just arbitrary?
I've not seen it used this way before but it is similar enough to the dagger and double-dagger symbols that the intent to use it as a footnote marker is clear.
[deleted]
Re: Keyhole – Forge own Windows Store licenses
#189Earlier quoted context omitted.
Yep. This seems to be the most overlooked part of the article, although maybe the most interesting. Unfortunately not for anyone who has activated the auto-update feature on his/her Xbox, as the latest system software version seems to include a higher kernel version than supported by the collateral-damage exploit.
Exactly why you should never, ever, enable auto update, for anything. Too often it ends up breaking something or patching something you don't want patched. It allows a profit seeking company to enable or disable software functionality on your device, regardless if it's in your interest.
Yup, 100%. My golden rule of computers is:
If it's working right now, an update can only cause it to break. The best case scenario is that it still works. Why would your roll the dice?
Re: Keyhole – Forge own Windows Store licenses
#190Earlier quoted context omitted.
TPM end game is to have identity tied to a device on pcs, just like the monopolies already have on Android and IOS. you know how google and apple dropped actual totp 2nd factor for their own accounts and force you to sign on another device to confirm signing on new devices? same thing.
Apple has SMS if you don’t own an Apple device. In fact, they require SMS to set up 2FA. They probably dropped totp because non-technical people can’t figure it out.
Hell technical people can't figure it out. Everyone complains that it's fragile because what if their phone breaks, and those that think they know better, think it's because of the dozen one-time-use emergency codes.
It's not their fault though. Every web site or service that offers totp and the most user-facing apps like google authenticator all scrupulously avoid telling you to save the seed value in the initial setup qr code.
That short random string is all you need to have working totp on as many different devices as you want, set up a new one any time you want, and it's nothing but a simple static never-changing secret exactly like a password.
You can wake up naked in a foreign country and be all back in a few minutes and without having to re-setup any sites or anything like that.
That is, IFFFFF you have previously saved all the totp initial setup seed values right along with the passwords for those same accounts. If not, you can go do it right now.