Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Keyhole – Forge own Windows Store licenses

massgrave.dev

Post reply on HN
Print view View original

201–210 of 319 posts

Re: Keyhole – Forge own Windows Store licenses

#201

Post by Jerrrrrrry »

Jerrrrrrry wrote: post #142

ironically, I will be using un-ironically to play Guitar Hero games that I have the physically discs to, on retail hardware, that has the games installed, but not "licensed" to play without physical tethering of the disc in the failed DVD drive. The double irony is that, even if it works, I may not be able to read my own game-saves since the Console's own public key is on the revocation list. I could sidestep this by…

ecosystem of xml > tlv > null-terminated strings / utf16 for user input make an off by one error anywhere or unverified* malicious user input in the house of cards of technical debt in any MS ecosystem collapse into minefield of privilege escalation, RCE, etc horizontal pivots...not trivial, however.

this bug is essentially a retro-active pivoting platform for the lucky day you combine unsanitized input and context escape.

seems like just trivial digital sticker-swapping, but MS over-leveraging its successes, refusal to break things (to maintain backwards compatibility, and it's own technical debt..), mean that some mistakes, however trivial, yet affecting, are immortalized

Re: Keyhole – Forge own Windows Store licenses

#202

Post by timenova »

indrora wrote: post #132
38 wrote: post #118

Earlier quoted context omitted.

Exactly why you should never, ever, enable auto update, for anything. Too often it ends up breaking something or patching something you don't want patched. It allows a profit seeking company to enable or disable software functionality on your device, regardless if it's in your interest.

It should be noted that unless you've modified an Xbox One, from what I understand you cannot stop it from auto updating unless you permanently disconnect it from the internet (which will cause your licenses to eventually expire, in the year timespan or so), new launch games won't run (they're tied to a minimum version of the OS).

The same is the case with the Xbox Series X/S. I was shown three options for the last update: [Update Now] [Continue Offline without Updating] [Shut Down Xbox].

Re: Keyhole – Forge own Windows Store licenses

#203

Post by 38 »

timenova wrote: post #202
indrora wrote: post #132

Earlier quoted context omitted.

It should be noted that unless you've modified an Xbox One, from what I understand you cannot stop it from auto updating unless you permanently disconnect it from the internet (which will cause your licenses to eventually expire, in the year timespan or so), new launch games won't run (they're tied to a minimum version of the OS).

The same is the case with the Xbox Series X/S. I was shown three options for the last update: [Update Now] [Continue Offline without Updating] [Shut Down Xbox].

right, so at this point you dont own the device any more, you are renting it.

Re: Keyhole – Forge own Windows Store licenses

#204

Post by semi-extrinsic »

kotaKat wrote: post #68
dangus wrote: post #51

Earlier quoted context omitted.

What garbage hardware are you running where TPM is failing?

Every Windows Update that Lenovo kept pushing UEFI updates on their shiny new X13s with the Snapdragon and the Pluton chip in it kept tripping Bitlocker on every update. So, uh... Lenovo?

FWIW, my old corpo HP would also trigger Bitlocker sometimes on random shit, such as upgrading the firmware of the docking station. But that was usually fixable either by unplugging USB devices while booting, or just trying many reboots until Bitlocker suddenly decided everything was OK.

Re: Keyhole – Forge own Windows Store licenses

#205

Post by HideousKojima »

choo-t wrote: post #30
dist-epoch wrote: post #21

Earlier quoted context omitted.

Let me tell you a secret: it's because the gamers are demanding that. The game companies couldn't care less if there are cheaters in the game, but it's the players which put huge pressure on the game companies to detect and ban cheaters.

> Let me tell you a secret: it's because the gamers are demanding that. Citation needed. Whose these gamers ? I surely didn't ask for this neither any of the gamers I know, nor seen any demand about that in gaming forums. > The game companies couldn't care less if there are cheaters in the game, but it's the players which put huge pressure on the game companies to detect and ban cheaters. The jump from this to "requi…

The real solution is letting players host their own servers and build their own communities of players they trust, but corps don't like giving that kind of freedom to users

Re: Keyhole – Forge own Windows Store licenses

#206

Post by emeril »

thot_experiment wrote: post #189
38 wrote: post #118

Earlier quoted context omitted.

Exactly why you should never, ever, enable auto update, for anything. Too often it ends up breaking something or patching something you don't want patched. It allows a profit seeking company to enable or disable software functionality on your device, regardless if it's in your interest.

Yup, 100%. My golden rule of computers is: If it's working right now, an update can only cause it to break. The best case scenario is that it still works. Why would your roll the dice?

so true - the few who are at risk of real exploits are already aware of this and do more than just system updates

I only let my browser autoupdate (somewhat reluctantly) since I view that as the most likely security issue on my winpc but when I used to let win10 autoupdate (and other garbage dell drivers), things would start breaking after each update

this also applies to phone app updates - I only update if there's a reason to, not just for the sake of updating...

and people wonder why I have the best working phone and pc at the office...

Re: Keyhole – Forge own Windows Store licenses

#207

Post by choo-t »

mjr00 wrote: post #194
choo-t wrote: post #136

Earlier quoted context omitted.

> You don't play competitive games, that's fine, but a lot of people do and they demand more competitive integrity than casual players. Little difference : I don't play competitive game with completes strangers on company run servers. I've played competitively on community based server, with people being screened by other players and the community able to regulate itself (ban or unban players). The problem space is v…

> Little difference : I don't play competitive game with completes strangers on company run servers. People don't consider playing around with your friends to be competitive. You don't get to choose who else is competing in the game or what strategies they use. This is just an area that you are clearly not familiar with. > The whole kernel-level anticheat stuff is a poor solution to a self-made problem by the develop…

> People don't consider playing around with your friends to be competitive.

I didn't say friends. Please don't modify my argument to refute it.

> You don't get to choose who else is competing in the game or what strategies they use.

I, as a single player, no, but us, as a community, yes, and it's the same for any game or sport, different group run different tournament with different rules about who play and how.

> This is just an area that you are clearly not familiar with.

Please refrain to use ad hominem, especially when you have no idea who you are talking with.

> This wasn't self-made by the developer, it was demanded by the players.

I don't know any players who asked for the disappearance of community run server or human moderation, neither that wanted do lose agency on the way they play. I don't they these players doesn't exist, but I don't make gross generality about players.

> Competitive games have almost exclusively moved to online, skill-based matchmaking with a ladder system because that's what players want.

They're not a hive mind, lots of them didn't or doesn't like matchmaking in any form, and even for the ones that wanted it, that doesn't mean developers have to remove other mean of play, like server browser and private server.

Re: Keyhole – Forge own Windows Store licenses

#208

Post by fragmede »

klodolph wrote: post #180
Zambyte wrote: post #178

Earlier quoted context omitted.

Depending on if you consider "authorization" to require consent or informed consent, it already is illegal behavior under CFAA.

That would require a pretty creative interpretation of the CFAA.

The CFAA's broad enough so as to allow a lot of creative interpretation. A journalist using view source was breaking the CFAA was one district attorneys view.

Re: Keyhole – Forge own Windows Store licenses

#209

Post by fragmede »

ivewonyoung wrote: post #181
throwaway48476 wrote: post #140

Earlier quoted context omitted.

SMS is trivially exploitable. It has negative security value.

Trivially? How?

I wouldn't call it trivial, but either a SS7 attack or by bribing the TMobile/Verizon/att store employee, you can get someone's SMS messages.

Re: Keyhole – Forge own Windows Store licenses

#210

Post by dangus »

throwaway48476 wrote: post #140
olyjohn wrote: post #60

Earlier quoted context omitted.

SMS is not really great.

SMS is trivially exploitable. It has negative security value.

SMS is the only 2FA method that the general public understands.

It is absolutely better than nothing even if isn’t great.

Post reply on HN