kristoff

joined 1 year ago
[–] kristoff@infosec.pub 1 points 2 months ago

interesting advice. Thanks!

[–] kristoff@infosec.pub 1 points 2 months ago* (last edited 2 months ago)

I do not see that as phone-usage, I'm doing an experiment to see how easy / difficult it is to revert the "i need to know the time, so I grab my phone" reflex back to "I need to know the time, so I look at my wrist".

I'm currently reading some books on how easy it is to manipulate peoples behaviour using 'nudging', this to better understand the social engineering tricks used by hackers.

An chapter in one of these books in how social media use tricks to manupale our behaviour that resemble the tricks used by the gambling industry.

One of the things I find intriging is the size of a smartphones today. If you look at it objectively, they are actually so large that most people would consider it to be annoyting: you have to carry it in a bag, in a pocket of your pants -but you have to take your phone out when you want sit-, or ..you carry it in your hands. Have you noticed how many people have their smartphone in their hand when they walk around? But, of course, if you have something in your hand, it is very easy to open it quickly check your notifications; which reinforces the addiction.

So, that's the thing. People do not find it annoying.

So .. as an experiment, I am trying out how easy / difficult it is to break the habbit.

A small sidenote when (or if) I manage to get my garmin vivosmart HR charges, it does rapport activity per week, number of steps and number of floors I went up on foot per day, even without a smartphone app. So that's at least something :-)

[–] kristoff@infosec.pub 1 points 2 months ago (2 children)

One of the reasons I am looking for a new sportswatch is because I try to reduce my smartphone use and I noticed that I actually took out my smartphone just to check the time.

I have an old garmin vivosmart HR but I do have a problem with the charging cable. Plus I am not able to download the healthstats with my linux 'daily driver' laptop.

Perhaps I should just get a cheap regular watch somewhere? 🤔

[–] kristoff@infosec.pub 2 points 2 months ago

I don't. I thought the emoji would have made that clear.

I have been doing cybersecurity awareness lately. We are starting to get over the furst hurdle: make people see the signatures of phishing message. But now we are starting with the 2nd hurdle: make people understand that when they write a genuine post, they should avoid these signatures of phishing, in this case, the "time pressure" argument.

The problem is that the more genuine messages have phising signatures, to more difficult it becomes for people to distinguish a genuine posts from phishing. There is also the risk that you genuine posts will get noted as fake (although that is clearly not the case here :-) )

[–] kristoff@infosec.pub 1 points 2 months ago

ah .. currently not available :-/

[–] kristoff@infosec.pub 4 points 2 months ago (1 children)

ah. That looks very interesting. And they have a show here in the EU, and it seems to work with gadgetbridge (thx Lambda RX :-))

Thanks!

[–] kristoff@infosec.pub 1 points 2 months ago* (last edited 2 months ago) (2 children)

A URL 'Free up to some-end-date'. ???

Phishing link? 🤔

33
submitted 2 months ago* (last edited 2 months ago) by kristoff@infosec.pub to c/linux@lemmy.ml
 

Hi all,

Simple question. Does anybody know a (not to expensive) sportswatch that is supported by Linux / FOSS software?

(Yes, I know 'FOSS software' is two times the word software) 😀

[–] kristoff@infosec.pub 2 points 2 months ago

Well, in principe I do not see that much different between 'curl | bash', 'sudo apt-get install' or installing an app on your phone. In the end, it all depends on trust.

Considering how complex software has become and on how many libraries from all over the internet any application that does more then 'hello world' depend, I do not see how you can do if you are not prepared to put blind trust into some things.

Concerning CrowdStrike, I am just reading an book on human behaviour (very interesting for everybody who is interested in cybersecurity), and I am just on the chapter about the fear of deciding with unknown parameters vs. the fear of not deciding at all. Any piece of software will brake at some point, so will you wait forever to find something that will not have any vulnerabilities?

[–] kristoff@infosec.pub 1 points 2 months ago

Obtainium seems to have a very interesting take on this. Thanks for the link! I will check it out 👍

[–] kristoff@infosec.pub 1 points 2 months ago (2 children)

The problem is here is this: how is a user supposted to know if the official website of an application is organicmaps.app, organic-maps.app, organicmaps.org or github.com/organicmaps?

And even if she/he knows, hackers do ways to make you look the other way. The funny thing in this case is that the original author complained that the app was removed from google playstore, and did so on the fosstodon mastodon-server. Although I guess this was not at planned, he made the almost perfect social-engineering post. :-)

5
apps .. repo or not (m.krbonne.net)
submitted 2 months ago* (last edited 2 months ago) by kristoff@infosec.pub to c/cybersecurity@infosec.pub
 

Hi all,

Interesting problem. An open-source project gets their app removed from google play, so they post a message on mastodon that -for the time being- you can download the app via direct download.

I post a reply saying that directing people to a direct link is not a good idea, as hackers could start doing the same to spread malwhere, better use an official repo (like f-droid, where they are already on).

A typical problem of somebody who writes a genuine post, but without realising it himself writes something that is very close to what a phishing message would look like.

However, this got me thinking. What you want to avoid is that people get used to the idea that it is OK to download and install apps from a random URL. But if you point people to f-droid, they need to also download the apk for that, and configure the security on your phone that apk's downloaded via may be installed.

I guess, the later should surely be avoided as most people will then leave that option enabled. (I had to search deep into the security setting to find the option to switch it off again).

What are your opinions on this? What would be the best way to do this and not teach people bad security habbits?

Direct download or f-droid? Other ideas? Is there a good sollution for this?

Kr.

[–] kristoff@infosec.pub 2 points 3 months ago

One of the basic elements of a democracy are three branches. In fact, democracy is an inherent instable system where these three branches must keep eachother in check. A natural concequence thereof is that every one of these three branches has the right to conduct and lead investigations.

That the courts can act proactive or reactive is more a cultural element then a core element of democracy. There are quite some countries where judges are part of the investigative process and can unilateral.

As Brazil, as a number of other countries in Latin America, has been in the situation in the past that both the gouvernement and the parlement are controlled by people with a .. euh .. not so good reputation on their democratic values, a judicial branch that acts in a more proactive manner should not be that IMHO unexptected.

[–] kristoff@infosec.pub 1 points 3 months ago* (last edited 3 months ago)

Here there are two issues: free speech and the judicial system in Brasil. I'll reply to the later in a different mail.

The freedom of speech is the result of democracy. No democracy, no freedom of speech. It is also inherent part of the democractic process.

On the other hand, it is not the only element of a democracy. and it can also be used against these other elements?

My question to you: can you use a fundamental freedom, granted to you by the fact you line in a democracy, to attack democracy?

 

Hi all,

Perhaps a stupid question. Some time ago, I received a rpi zeroW as a gift, but as I did not have any use for ii I passed it to somebody else in our electronics-group. Now, that person has had a +30 year carreer as self-taught programmer -starting out with BASIC on DOS machines- so he showed of some of his old BASIC applications in dosbox on the pi.

So far so good, but he had an interesting question: Years ago, I wrote a library in BASIC for screen / window applications in DOS. (you know, pop-up text-windows and so on). How do I do that on linux (in C)?

As I myself only do 'backend' coding (so no UI), I have to admit I did not have any answer to that.

So, question, For somebody who has mostly coded in BASIC (first DOS and later Visual Basic) and now switched to C and python, what is the best / most easy tool to write a basic UI application with window-function on linux/unix. I know there exist things like QT and ncurses, but I never used these, so I have no idea.

Any advice?

Kr.

 

An open question, related to cyberpunk culture.

Considering the possibilities of current social-engineering as used by social media and desinformation, to what degree ido you think it is now possible to 'implant' fake memories into somebody's consciousness, without that person noticing it.

 

Hi all,

Small question. Does anybody know if there already exists a lemmy community on disinformation (in the infosec area or more broadly)?

Thanks! :-)

Kr.

 

Hi all,

Had a small chat on #AI with somebody yesterday, when this video came up: "10 Things They're NOT Telling You About The New AI" (*)

What strikes me the most on this video is not the message, but the way it is brought. It has all the prints of #disinformation over it, .. especially as it is coming from a youtube-channel that does not even post a name or a person.

Does anybody know this organisation and who is behind it?

Is this "you are all going to lose your job of AI and that's all due to " message new? What is the goal behind this?

(Sorry to post this message here. I have been looking for a lenny/kbin forum on disinformation, but did not find it, so I guess it is most relevant here)

(*) https://www.youtube.com/watch?v=qxbpTyeDZp0

 

I do not think this has already been mentioned. As I guess most of you are also an mastodon (or another fediverse-enabled playform)

More info also here: https://github.com/revengeday/blackhand-mastodon-bot

 

Hi,

I don't know if this has already been posted here.

Some time ago, I found this 3-part documentary on the cyberpunk genre:

Part 1: https://www.youtube.com/watch?v=sttm8Q9rOdQ (also in the title of this post)

Part 2: https://www.youtube.com/watch?v=0VoX3vr6CCM

Part 3: https://www.youtube.com/watch?v=KczJNtexinY

Enjoy! :-)

 

HI all,

For people who live in the neighbourhood of Hanover, Gernany. In almost 3 weeks from now, I will give a workshop "Hacking Radio-signals" in the summer edition of hackover 2023. The exact timeslot still has to be decided, but hackover is the weekend of 14, 15 and 16 July.

In the workshop, we will capture, analyse and decode the signal of a 433 MHz remote-control. You do are required to bring your laptop and have some software installed beforehand.

If you are interested, either drop a message in this thread or contact me at the email-address in the announcement

view more: next ›