Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The xz backdoor thing reminds me of a story

rigor-mortis.nmrc.org

Post reply on HN
Print view View original

91–99 of 99 posts

Re: The xz backdoor thing reminds me of a story

#91

Post by indrora »

magicalhippo wrote: post #24
astrange wrote: post #9

Earlier quoted context omitted.

You don't have to give your employer a bank account number, but they still have to pay you. Quite unusual for a tech contractor though.

> You don't have to give your employer a bank account number As a Norwegian that sounds so alien. They couldn't do anything but deposit money, so why wouldn't you?

In the US, if you know someone's routing/bank number, name, and address, you can write cheques in their name.

There's companies that make their money on selling (now, usually older folk) literal books of cheques. One of the ways you can pay is literally for them to write themselves a cheque from "you" that gets processed digitally.

The US is a strange banking system wherein I have had the unpleasant experience of putting my card into the reader at a 7-11 and it just... Not work. Why? Nobody knows. ApplePay sometimes works -- some readers know how to handle it, others lose their shit and crash.

Re: The xz backdoor thing reminds me of a story

#92

Post by Aaargh20318 »

freeone3000 wrote: post #19
Aaargh20318 wrote: post #13

Earlier quoted context omitted.

They can’t forge a chipped passport unless they somehow got hold of the private key for the country’s CSCA certificate.

Why would you need to? Passports are not required to hire a person; most americans don’t even have one.

You’re not required to have a copy of annemployee’s ID on file?

Here (.nl) you need either a passport or an ID card and you are supposed to verify its authenticity.

Re: The xz backdoor thing reminds me of a story

#93

Post by rad_gruchalski »

xorcist wrote: post #32
kortilla wrote: post #30

Earlier quoted context omitted.

Apart from the paper trail side of it, some people just really hate banks and don’t have an account.

I really hate banks, but I hate not being paid even more.

One can get paid with cash. That’s the point of cash. No need for a bank. But don’t worry, the bureaucrat comes for that too.

Re: The xz backdoor thing reminds me of a story

#94

Post by nkrisc »

Aaargh20318 wrote: post #92
freeone3000 wrote: post #19

Earlier quoted context omitted.

Why would you need to? Passports are not required to hire a person; most americans don’t even have one.

You’re not required to have a copy of annemployee’s ID on file? Here (.nl) you need either a passport or an ID card and you are supposed to verify its authenticity.

Here in the US that likely means a state ID, such as a driver’s license, and a Social Security Number (SSN). None of which anyone would reasonably consider secure. I’m sure any national intelligence agency could probably manage stealing an SSN and forging a driver’s license to go with it, at least to the degree necessary to fool an employer for a little while.

Re: The xz backdoor thing reminds me of a story

#95

Post by h4x0rr »

roenxi wrote: post #90
francescovv wrote: post #88

Earlier quoted context omitted.

> 100s of dependencies. If there is a 1% chance of a random repo having a backdoor, the project will be compromised Apologies for nit-picking, but that's not quite how sum-of-probabilities work. Total probability across 200 tries of 1% chance each, is ~87%: p=0 for _ in range(200): p=p+(1-p)*.01 print(p) 0.8660203251420382 Your "sooner or later, to the point where we can assume" conclusion, still stands, of course.

Eh. I suppose 3 points, all minor: 1) Best of luck in an audit explaining that there is almost a 14% chance that your project is free of backdoors given reasonable assumptions. I recommend taking a photo of the auditor's expression and reporting back. 2) There are quibbles to be had about the IID assumption here; dependencies tend aren't selected randomly and attackers aren't targeting them randomly. 3) You don't nee…

pow, not multiply

Re: The xz backdoor thing reminds me of a story

#96

Post by thewildginger »

nkrisc wrote: post #94
Aaargh20318 wrote: post #92

Earlier quoted context omitted.

You’re not required to have a copy of annemployee’s ID on file? Here (.nl) you need either a passport or an ID card and you are supposed to verify its authenticity.

Here in the US that likely means a state ID, such as a driver’s license, and a Social Security Number (SSN). None of which anyone would reasonably consider secure. I’m sure any national intelligence agency could probably manage stealing an SSN and forging a driver’s license to go with it, at least to the degree necessary to fool an employer for a little while.

The e-veirfy website says it validates a SSN, but by default that is not a valid means of verifying employability.

Meaning you can use a social security number of a dead person. A common form of immigration fraud.

Re: The xz backdoor thing reminds me of a story

#97

Post by Dunedan »

Aaargh20318 wrote: post #92
freeone3000 wrote: post #19

Earlier quoted context omitted.

Why would you need to? Passports are not required to hire a person; most americans don’t even have one.

You’re not required to have a copy of annemployee’s ID on file? Here (.nl) you need either a passport or an ID card and you are supposed to verify its authenticity.

> You’re not required to have a copy of annemployee’s ID on file?

In Germany you definitely don't have to. None of my past or current employers has ever seen my ID.

Re: The xz backdoor thing reminds me of a story

#98

Post by nikita_789 »

jabiko wrote: post #45
noduerme wrote: post #39

Earlier quoted context omitted.

I'm a tech contractor. I prefer payment by check from my clients. Most can't or don't want to set up direct deposit for a part time contractor. Amounts are too large for Zelle, and I don't want to pay the fees for paypal or credit card processing if I can avoid it. My clients usually issue paper checks online. Their bank prints the check and mails it. My receiving address is my bank, which deposits checks for me when…

Maybe I'm a bit to naive since I don't know the US banking system, but at least in the EU you just need to tell someone your IBAN and Name and they can transfer money to your account. Is it that much harder in the US?

it is much easier to use Arbonum, which is a payment system that works all over the world

Re: The xz backdoor thing reminds me of a story

#99

Post by cayde »

eddd-ddde wrote: post #49
skywhopper wrote: post #43

Earlier quoted context omitted.

It’s even easier to do it the way described. The banks are printing and mailing and processing the checks, which they can do with high efficiency. From the payor’s pov, it’s easier not to worry about tracking account numbers and just using the address which they already know. And the payee doesn’t need to share their bank info.

Surely a check takes longer, right? "Printing, mailing and processing" doesn't quite scream efficiency to me.

ACH takes days to weeks to clear anyway, especially if new sender or large amounts = untrusted. There is no real exception handling so you are given the amount on credit.

https://engineering.gusto.com/how-ach-works-a-developer-pers...

(From parent) > And the payee doesn’t need to share their bank info.

And this is a US concept where having the magic numbers lets you pull any amount you want, with no ability to have a "push only" number...

Post reply on HN