Man flies over South Africa in a chair tied to helium balloons [video] - <AUTHOR> https://www.theguardian.com/world/video/2017/oct/26/man-flies-over-south-africa-in-a-chair-tied-to-helium-balloons-video <comment><USER2> Launching high-altitude helium balloons has been the activity some friends and I do for fun. Over the course of 2 years+ we've been doing this, we had over a dozen of successful launches where we could retrieve the payload.

For kids, this is a great inspiration and educational opportunity, especially for those who are interested in technology and programming. We used Arduinos and Raspberry pis in many components of the payload, from the tracker to the data logger. They get to program and control the behavior then test the hard/software so I personally think it's a great way to hook them up with computers and really understand them. This is one of those instances of "doing crazy stuff" kids are interested in.

For adults, it involves many fun aspects too. Specifically for geeks, the best feature is the optimization of weight, reliability, and features for the payload. Some people did get crazy with party balloons that carry impossibly light and efficient payloads that last for over a year with full tracking and sensory information. It can get surprisingly technical when you want to communicate with the payload reliably from the ground (over the radio wave). You'd be baffled and outraged when it was reported that with all the amazing things we could do, we didn't know peep about a missing airplane. The little phone in our pocket knows and tracks every step we take, you'd think - what's so hard about keeping communication with an object in the line of sight? I think all we don't appreciate enough is how advanced and amazing our cellular network is. When you have cellular communication, you have everything, the economy of scale is real and it works. With (amateur) radio, it's a different story: Many times we'd had flawless successes communicating with the payload, sometimes we just couldn't do it for some mysterious reason with the same equipment. I've grown to be much more sympathetic to people who have to work with that vast amount of distance, space, and power envelop when it comes to tracking some flying object on the sky, let alone on/under the sea.

As a side note, I can't imagine launching such a huge object such as yourself tied to a cluster of balloons to the sky could be something the authority is too fond of.

<comment><USER3> Are there any safety issues with this? Air traffic control? What if balloon bursts and payload falls to earth.

What are the rules on launches?

<comment><USER2> It will surely burst when it reaches about 100k ft. We attach a parachute to the payload to make it descend gradually. Other than that, there is no control over where it's going to land. However, because the payloads are small styrofoam boxes, they don't pose a very serious danger in the rare case that they land on roads. Flight predictors are really surprisingly good at simulating where the payloads will land, so it's usually not a huge surprise.

We'd rather be safe than sorry. So far, nothing really bad has been reported in the HAB community. It will leave a bad stint if something blows up on someone's face.

Regarding authority, we often file a NOTAM-Notice to Airmen ([https://sites.google.com/a/mtlsd.net/citizen- science/ib1/not...](https://sites.google.com/a/mtlsd.net/citizen- science/ib1/notam)).

</comment></comment></comment><comment><USER4> The original is Larry Walters, of course.

[0] [https://en.wikipedia.org/wiki/Larry_Walters](https://en.wikipedia.org/wiki/Larry_Walters)

<comment><USER5> Indeed. I am always amazed that they don't pass out when they cross 15,000'.

<comment><USER6> Who are "they" exactly?

<comment><USER7> I assume they are "the people who makes these flights".

<comment><USER8> Well, smarty pants, who are these numerous persons who flew in their lawn chairs strapped to helium balloons to 15K feet? There must be heaps of them since they manage to keep ChuckMcM in a state of constant amazement.

<comment><USER5> If you followed the Wikipedia link there were 5 imitators listed, and the current story makes 6. These are the ones that got enough coverage to warrant an entry. I know personally an EMT who responded to a call of one person who tried this over Lake Tahoe and "crashed" into the lake, but it wasn't in the papers or in the Wikipedia article.

<comment><USER8> And only two reached 15K altitude, so your original comment rings hollow as there's basically no basis for being "always amazed" at this fact.

<comment><USER5> So do you have a problem with me or with the grammar? If its me my email is in my profile and I'm always ready to listen to feedback.

If its the grammar, my amazement comes from not one story of someone trying this stunt including extra oxygen. Many of the stories include the notion of a pellet gun to shoot individual balloons for altitude control. That sets up an additional failure mode where you pass out from lack of oxygen before you can shoot a balloon. That people fail to consider and plan for the failure modes of this stunt _is_ always amazing to me.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER9> I know that man, he's Tom Morgan, founder of a company called The Adventurists.

They are probably best known for organizing the Mongol Rally and the Rickshaw Run, among other charity rallies.

I participated in the Mongol Rally 2009 and for me was the experience of a lifetime.

This is their website if you are interested in learning more about them: [https://www.theadventurists.com](https://www.theadventurists.com)

<comment><USER10> I participated this summer and I would agree - it's an amazing experience. The fact that the Adventurists still have a very personal approach with everyone taking part even though there were over 300 teams this summer is testament to how cool those guys are!

</comment></comment><comment><USER11> How does he safely maintain altitude? The helium balloons will expand as he rises (due to the lower pressure at higher altitudes), eventually popping. It's how weather balloons descend. Is he counting on a slow descent after some initial fraction of the balloons pop? That's quite a bet.

</comment><comment><USER12> I don't want to be a party pooper, but...

Helium is scarce enough to stop using it for this kind of purposes.

[http://www.bbc.com/news/magazine-24903034](http://www.bbc.com/news/magazine-24903034)

<comment><USER13> Crisis averted: [https://www.livescience.com/60607-helium-reserve- discovered-...](https://www.livescience.com/60607-helium-reserve-discovered- in-tanzania-photos.html)

<comment><USER14> Sounds like Tanzania soon has a monopoly position.

</comment></comment></comment><comment><USER15> this isn't inspired by the movie "Up." July 2, 1982 Larry Walters tied his lawn chair to balloons and carried an air pistol to shoot balloons to control the amount of lift. [https://en.wikipedia.org/wiki/Larry_Walters](https://en.wikipedia.org/wiki/Larry_Walters)

When he landed his quote to the press before his arrest was:

"It was something I had to do. I had this dream for twenty years, and if I hadn't done it, I think I would have ended up in the funny farm."

This is called Cluster Ballooning: [https://en.wikipedia.org/wiki/Cluster_ballooning](https://en.wikipedia.org/wiki/Cluster_ballooning)

Guinness Book of World Records even has a category. I told my Dad I wanted to do it and he almost grounded me right then and there.

</comment><comment><USER16> In 2008 a brazilian priest did the same in Santa Catarina. No one has ever saw him again after the launch.

[https://en.wikipedia.org/wiki/Adelir_Ant%C3%B4nio_de_Carli](https://en.wikipedia.org/wiki/Adelir_Ant%C3%B4nio_de_Carli)

<comment><USER17> Well, not to get too macabre, but people eventually did see (part of) his _body_ , found floating in the ocean a few months later.

<comment><USER18> Also don't want to mock the dead, but this note made me shake my head:

> His training for the stunt included jungle survival and mountain climbing > courses, but apparently did not include instruction on use of his GPS - in a > telephone call he made during the flight, he stated that if someone could > just explain how to use his GPS he could relay his position to rescuers.

</comment></comment></comment><comment><USER19> What could possibly go wrong?

<comment><USER20> Well, a Brazilian priest attempted a similar feat in 2008[1]. He won the 2008 Darwin Award for it [2].

[1] [https://gizmodo.com/5022283/sad-ending-flying-priest- found-d...](https://gizmodo.com/5022283/sad-ending-flying-priest-found-dead- in-the-atlantic-god-positioning-system-still-missing)

[2] [http://darwinawards.com/darwin/darwin2008-16.html](http://darwinawards.com/darwin/darwin2008-16.html)

<comment><USER21> > Darwin Award

Making fun of people dying. Fucking sick stuff.

It's also logically crap. Often it's people (as in this case) doing things outside the normal. Things as hackers we should celebrate.

It's also often people in extreme poverty just trying to make a living, aka the fucking sick part that we as rich educated people make fun of cause we don't have to do dirty things like recycle metal from unexploded ordnances cause rich.

<comment><USER22> Hey, tell me about it. There was a tragic accident at my school, when a structure collapsed and killed several students, because it had insufficient engineering oversight. But, eh, Darwin Awards had to make a joke, so they collectively gave it to all the victims, who were getting up at the crack of dawn to volunteer on a group project, and following all the safety rules they were given.

<comment><USER23> That's weird because it directly contradicts most rules of Darwin Awards, that the people must be mature (well I don't know what kind of school it was), that they must be the ones responsible for their death (from what you say, the engineering is what killed students later) and that it must be because of "extraordinary misjudgment" on the part of the people both responsible and victims (who are supposed to be the same).

Can you link to your story on their website in order to contact them and withdraw the award since it breaks the rules?

<comment><USER22> I dug into it a bit further, and apparently the story is that the Darwin Awards used to be more crowd-sourced, but as a direct result of the incident I'm referring to, they instituted heavy moderation and apologized for any distress caused by their seeming approval of a tasteless article. So it's a little more forgivable than I realized. My opinion gelled back when the story was still in progress, but I didn't hear about the conclusion.

If you want to read the details, just google "aggie bonfire", or "darwin award aggie bonfire".

</comment></comment></comment></comment></comment></comment><comment><USER24> I so want to do this :)

<comment><USER25> Do it then!</comment></comment>


Hackulous Shuts Down, Taking Its iOS Piracy App Installous With It  - <AUTHOR> http://techcrunch.com/2012/12/30/hackulous-deadpool-installous-shut-down/

<comment><USER2> This underscores the fact that piracy isn't about the money; it's about availability and convenience. If only the app creators would make their apps available on some kind of easy-to-use online store where installation is a breeze, customers are automatically informed of updates they can download for free, and all this is provided for a few bucks an app, we'd see nobody resorting to using piracy apps like these.

<comment><USER3> How would you improve on say, the Apple app store? What you've described is what Apple has already created IMO.

<comment><USER2>
      > What you've described is what Apple has already created IMO.

Exactly.

</comment></comment></comment><comment><USER4> This is definitely a good thing. Support the developers. It takes a lot of time and effort to build an app. Surely a single dollar (usually) is not too much to pay. Im' still surprised how cheap most apps are for my phone ;o

<comment><USER5> The price of some apps is ridiculous though. I'm not defending pirates but look how much Anki costs on the App Store whilst being free on Android.

<comment><USER6> $25 seems pretty reasonable to me if it's the sort of thing you find useful. How is that "ridiculous"?

<comment><USER5> Relative to the Android price. It seems unfair for iOS users to pay for development of the platform across all platforms.

<comment><USER6> Funny how people get up in arms about price differences like this, yet nobody _ever_ suggests that the price of the cheaper one should be raised to remedy the situation.

Would the iOS price suddenly not be "ridiculous" if they charged $25 for the Android version too?

<comment><USER5> No, but why not go halfway? Lower the iOS price to half and raise the Android price to the same as iOS.

<comment><USER6> _Why_ go halfway? $25 seems like a decent price for this.

</comment></comment></comment></comment></comment></comment></comment><comment><USER7> While another App store (even used for pirated apps as well) is probably a good thing, and having fewer sources of software (less competition) is bad, I have to say: good riddance.

It wasn't exactly ethical, and even when used for semi-legitimate purposes (obtaining software "not available" in your region) it was slow, cumbersome and unreliable.

</comment><comment><USER8> Honestly as a user, Installous totally sucked. The thing was rife with malware and it was impossible to tell which apps were legit and which were malware. I tried it a couple of time just to see what it was like (this was also before widespread app reviews) and although you could grab apps for free, it wasn't reliable or safe.

<comment><USER9> You tried a couple of times yet managed to come across enough malware to describe it as such? I've been using Installous for a long time and have never come across any "malware" on it.

Also, isn't iOS sandboxing designed to ensure no rogue apps cause havoc on the system?

<comment><USER10> There's nothing to stop code in an ipa from escaping that sandbox if the code isn't checked by Apple.

<comment><USER9> And how would we know that has happened? The parent comment suggests it was obvious which downloads were malware just by using Installous.</comment></comment></comment></comment>


ICANN plans second round of domain name expansion - <AUTHOR> http://www.thehindu.com/sci-tech/internet/article2935898.ece

<comment><USER2> What a scam. Shameless.</comment>


Bill Gates invests $1.7B in U.S. schools - <AUTHOR> https://www.washingtonpost.com/local/education/billionaire-bill-gates-announces-a-17-billion-investment-in-us-schools/2017/10/19/9938f11c-b4eb-11e7-a908-a3470754bbb9_story.html?utm_term=.4bff894ce8fc <comment><AUTHOR> It's good and all, but I'm not sure that this will give much better results. Investing this amount of money in old ed system will give the same output. That's not an example of smart money. P.S. I don't want to be hater or something but I think that he could do much more with his resources. Maybe something like Ad Astra of Elon Musk.

</comment><comment><USER2> I would like to see him come up with some better stuff for the 2-4 year early learning. There is not that much quality material and options in this age range.</comment>


The closest I've ever come to falling for a Gmail phishing attack - <AUTHOR> https://twitter.com/tomscott/status/812265182646927361 <comment><USER2> Sysadmin at a school: we use GMail for our students and faculty, and we got hit by this hard right before the holiday break. Three employees and a handful of students all got hit by the attack within a two hour period. It's the most sophisticated attack I've seen. The attackers log in to your account immediately once they get the credentials, and they use one of your actual attachments, along with one of your actual subject lines, and send it to people in your contact list.

For example, they went into one student's account, pulled an attachment with an athletic team practice schedule, generated the screenshot, and then paired that with a subject line that was tangentially related, and emailed it to the other members of the athletic team.

They were using bit.ly to obscure the address (in Russia). We had to take our whole mail system down for a few hours while we cleaned it up.

<comment><USER3> Requiring 2-factor auth would prevent this from being exploitable, right? Probably impossible in a school environment but in an enterprise situation, more palatable perhaps.

<comment><USER4> My school is actually rolling out optional 2-factor auth. I'm not a fan of the system they use^, but it's neat that a University is taking advantage of some security best practices.

^Instead of using "standard" 2-factor that generates a code on-the-fly within an app like GAuth or Authy, users receive a text message with 10 codes. The first digit of every code increases sequentially (0972,1042,2512,etc), must be used in that order (0 code on first login, 1 code on second, etc.), and the page informs the user which number they're on.

<comment><USER5> Sorry to hear about your experience, Jarwain!

Duo offers a choice of authentication methods, depending on the usability and security requirements of your application or organization.

Duo Push is actually one of the easiest (and most secure) authentication methods, as one of the commenters pointed out:

[https://www.youtube.com/watch?v=tPLxe9HUDjY](https://www.youtube.com/watch?v=tPLxe9HUDjY)

It might be worth pinging your IT/security dept to ask about enabling Duo Push as an option or to change the policy for SMS passcodes (eg. you can just have one passcode sent instead of ten).

\- Jon Oberheide, Co-Founder & CTO @ Duo

<comment><USER6> Duo does work as advertised, and my uni uses it, but the privacy policy allows for a lot of personal data collection.

tldr: "Duo Security does not sell, rent, or trade and, except as described in this Privacy Policy, does not share any Personal Information with third parties for their promotional purposes." But Duo still collects A LOT of data on you.

From the policy: "Device-Specific Information: We also collect device-specific information (e.g. mobile and desktop) from you in order to provide the Services. Device-specific information includes:

attributes (e.g. hardware model, operating system, web browser version, as well as unique device identifiers and characteristics (such as, whether your device is "jailbroken," whether you have a screen lock in place and whether your device has full disk encryption enabled)); connection information (e.g. name of your mobile operator or ISP, browser type, language and time zone, and mobile phone number); and device locations (e.g. internet protocol addresses and Wi-Fi). We may need to associate your device-specific information with your Personal Information on a periodic basis in order to confirm you as a user and to check the security on your device."

The policy continues to state that Duo may use this data for analytic/advertising purposes (although only in-house) as well as to comply with legal requests, subpoenas, NSLs etc.

Duo isn't collecting your data for nefarious purposes or to sell it to other companies but they still are collecting A LOT of it. Other two factor methods, like the one's used by Google and Facebook, allow clients to install their own code generators that don't collect personal data or even need access to the internet. Of course these methods don't have push requests that you can just approve rather than type in the code.

<comment><USER7> also, if it's a US company and it ever goes bankrupt/sells its assets, third party buyers aren't bound by any privacy policy whatsoever. yes, this is crazy and it means US privacy policies are basically meaningless; best just don't give them your data, but what can you do. personally I believe that collecting the data and pretending a privacy policy makes it okay, is nefarious by itself already.

</comment></comment></comment></comment></comment></comment><comment><USER8> I reported this a back in March 2016, and Google said it was not an issue.

Analysed whole attack here: [https://gist.github.com/timruffles/5c76d2b61c88188e77f6](https://gist.github.com/timruffles/5c76d2b61c88188e77f6)

This was the response I got:

> The address bar remains one of the few trusted UI components of the browsers > and is the only one that can be relied upon as to what origin are the users > currently visiting. If the users pay no attention to the address bar, > phishing and spoofing attack are - obviously - trivial. Unfortunately that's > how the web works, and any fix that would to try to e.g. detect phishing > pages based on their look would be easily bypassable in hundreds of ways. > The data: URL part here is not that important as you could have a phishing > on any http[s] page just as well.

<comment><USER9> Ah the classic "ugh. we don't want to have to fix this, so here are some bullshit technical reasons why it's impossible and a bad idea".

<comment><USER10> yeah but we all do this everyday to the designers

</comment></comment></comment><comment><USER11> Had the same exact experience in August.

Amazing thing was I KNEW the email was phishing. I was asked to look at it by someone internally who was suspicious. I forwarded it to a Gmail account I use for dodgy items. I fired up a VM and logged in to the Gmail account. I looked at the email. I briefly examined the raw message (too briefly). Then I clicked on what I still thought was a Google Drive attachment.

My first thought was "oh I've been logged out of Gmail for some reason". I was just about to login again when I decided to double check the URL and finally saw what was going on.

I think most normal users would be very vulnerable to this. It's very subtle. Luckily the guy in accounts is paranoid.

<comment><USER12> The scariest part is that you knew that there was something suspicious and still [almost] got phished. There's no reason to believe anyone (technical or not) that wasn't looking out for something suspicious would have possibly avoided the attack.

Pretty nasty phishing attempt, way more subtle than past attacks.

</comment></comment><comment><USER13> I think its naive to believe that even the most tech savvy are immune to phishing. People get tired, hurried, stressed - and during those moments anyone's guard can be let down.

<comment><USER14> Yes - I am vigilant to almost a paranoid level, but one day a phishing email came from "Australia Post" purporting to be a missed delivery notification on a day that I was expecting a delivery and thought I had missed the driver.

I was in a hurry, and frustrated and was a millisecond away from clicking the link when some gut feeling told me that something was not right. Closest I've come to date, and it worried me.

EDIT: Sorry, I meant to respond to @soneca below, as this relates to phishing emails arriving with impeccable timing...

</comment></comment><comment><USER15> The only two things that I think could have prevented me from falling for this is: I don't have images loaded by default for unknown senders, and LastPass wouldn't match the domain and therefore wouldn't show the button to autocomplete on the password box.

Depending on how observant I'd be at the moment, I might check the URL bar and see something fishy. But I could fall for this, which is worrying.

<comment> mike-cardwell "I don't have images loaded by default for unknown senders"

Does this just prevent the display of images which require fetching from a remote URL, or does it also include images which are embedded in the email as attachments?

<comment><USER16> Aside from the fact that this was not an external image, it was also emails to him by a friend.

</comment></comment></comment><comment><USER17>
        clickme

Or if you want to reproduce it console:

        a = document.createElement('a');
        a.href = 'data:text/html,valid_looking_url    ';
        a.textContent = 'clickme';
        a.style.position = 'fixed';
        a.style.left = 0;
        a.style.top = 0;
        a.style.zIndex = 9999;
        document.body.appendChild(a);

The "valid_looking_url" will appear in document but it can be hidden from page by script or made transparent using css

</comment><comment><USER18> Thanks for sharing this - this is fiendishly clever. Even with all the investment in infosec, we're still woefully unprepared to deal with this type of attack. We need to start thinking about new approaches to protect users.

<comment><USER19> It's a hard problem but the industry isn't doing as much as it could do. There's low hanging fruit that has gone unharvested for years at most big companies.

1\. Reform the browser address bar. Safari does this right. Chrome, IMHO shamefully, does not. The address bar is completely ignored by a large fraction (I've read it's about 25%) of users because it's full of meaningless technobabble. These users navigate _entirely_ by sight. Weak sauce changes like making some of it light grey instead of black makes no difference. The usability nuclear holocaust that is the browser address bar is in my view THE leading cause of phishing because it's rendered users unable to identify _who_ they are talking to when they submit data via the web. The address bar should show the domain name _only_ , or the EV identity when that's present, and the browser industry should adopt practices to push usage of EV SSL everywhere. Only EV SSL is a feasible approach to get the actual, legal, verified identity of a server operator on the users screen in a reliable and scalable way.

2\. The big networks need to lead by example and adopt EV SSL, see above.

3\. Kill re-authentications dead. Google was talking about this internally around the time I was working on the account system there, but I don't recall if they ever did it. For as long as web sites routinely ask users to re- authenticate at seemingly random times users will type their password into any page that looks right without thinking. Only by making authentication a very rare event can you start to convince users to take more care over checking the site origin. I think Facebook has got this right: I don't think I'm ever asked to sign in to Facebook unless I'm using a new device, but lots of websites don't.

4\. Teach UI/UX designers about the dangers of designing user interfaces where attacker controlled content isn't strongly visually separated from system controlled content. In this era of personalisation and theming there's really no reason why things like the Gmail attachment icon needs to be placed right next to the content of an email with the same generic white background as attacker controlled content. Give it a semi-transparent background and set users up with a wallpaper-esque theme by default and it gets a lot harder to put things in a message that look like UI widgets.

<comment><USER20> > 1\. Reform the browser address bar. Safari does this right. Chrome, IMHO > shamefully, does not. ... The address bar should show the domain name only, > or the EV identity when that's present,

Chrome on Android does this. And it's extremely annoying. Since mobile browsers (and desktop browsers with tabs) usually don't show the title of pages, the address bar is the only place to tell e.g. what Wikipedia page you're currently reading.

You are probably correct, that it's a win for security, but I wish it could be turned off.

<comment><USER19> Wikipedia pages have the title at the top of the page.

In practice, the sort of users who complain about such things are in my experience the sort who also have dozens of tabs open, which smushes the title down to just a few characters. Heck even when there's space in the tab bar Chrome won't allocate more than a few cm of space on screen to showing the title. HTML titles are pretty much a dying thing anyway, so given the ongoing pain caused by phishing I wouldn't hesitate to pull the plug on them.

<comment><USER20> On mobile, scrolling to the top of a Wikipedia page can be 20 screens or more. After that it's a lot of working going back to where you were. Many news sites are similar.

<comment><USER21> You could just pop open the tab view, so you can see the page title.

</comment></comment></comment></comment></comment></comment><comment><USER22> There is also a password alert chrome plugin by google [0].

If you ever enter your google password on any domain other than accounts.google.com. It will immediately alert you and give you a link to change your password. It can handle multiple passwords too if you have multiple google accounts.

[0] [https://chrome.google.com/webstore/detail/password- alert/noo...](https://chrome.google.com/webstore/detail/password- alert/noondiphcddnnabmjcihcjfbhfklnnep)

<comment><USER23> It sounds like the attackers got in almost instantly -- presumably they logged in via script, not a human. Changing your password at that point would probably be like closing the stable door after the horse has bolted.

Still useful, I guess, because it lets you know immediately what's up, so you can send out emergency emails to your contacts.

<comment><USER22> The plugin actually alerts you the moment you press down the last key on your keyboard, before you could even press enter, so you don't even get a chance to submit the password.

But even if you assume at that moment the attacker has your password... I had seen gmail takeovers live and Google's authentication system allows you to recover an account even after it was taken over as long as you still have the old methods of authentication and you are within an unspecified timeframe.

Of course you will have to spend the day cleaning up your email filters and apologizing all your contacts, but at least you will have your account back.

</comment></comment></comment><comment><USER24> As a side note, it looks like this couldn't have happened with an external mail reader like Thunderbird. Even when targeted to that and mocking some other UI element, clicking the link would open a browser window and reveal the fraud, at least to power users.

I'm not advocating against web-based mail readers, simply because it's not always possible or practical to use external ones. But it seems security is harder to implement because everything is "made of the same parts", i.e. a web-based mail displayed in a web-based application, opening links in the same (browser) window.

</comment><comment><USER25> I'm surprised that with Google's image detection technology that Gmail doesn't do image recognition on images with links where the image look like popular document attachment, and send them to spam. Or perhaps they do but the phishers are able to evade it.

<comment><USER2> They aren't using popular attachments. They are using customized attachments from the actual compromised sender. I commented elsewhere in the thread, but once they gain your credentials, they will go into your account to get one of your attachments, and then email a screenshot of that to your contacts, some of whom may have already seen _that_ attachment.

<comment><USER26> Sure, but the chrome around the image is still "trusted attachment" chrome.

I get it that the browser ppl will say only their chrome is trusted, but when someone is using your app, your app's internal ui affordances receive that same level of trust in your users' minds.

</comment></comment></comment><comment><USER27> Once I almost fell for an extremely well made Paypal-phishing mail. It was late at night and I had just made a purchase via Paypal at a very small web shop. The timing was so perfect to catch me off guard that I am certain that site had been broken into to gather my email address.

</comment><comment><USER28> My rule for gmail... I type gmail.com then log in. That's the only path I take to log in. I never click a link and log in, etc. really I do this for most sites I use.

<comment><USER29> What do you do for "Sign in with your Google Account" situations?

<comment><USER30> I personally never sign in with a google (or any other) account, I always sign up for new accounts with my email.

</comment></comment></comment><comment><USER31> I'd be really interested to see the increased success rate. Even if the most tech-savvy weren't fooled (I'm not so sure), I would be surprised not to see a vast increase from your average misspelled ecommerce phishing email. Shame those crooks don't practise open data.

</comment><comment><USER32> That is very well done. I only see people suggesting 2-factor auth as a remedy, but I guess any password manager would work as well. You wouldn't even get to the point of compromising your password.

I use 1password, which will only fill in the password associated with the current domain.

</comment><comment><USER33> I guess it's an aims race, but I would guess there are a few potential ways to mitigate against this:

1\. Watermark all images on the in-email preview. 2\. You should be able to design a mail scanner which would detect images that look too much like gmail elements and flag them.

<comment><USER34> Yes! They do it for banknotes (it's impossible to scan or xerox them). They could do it in the same way for login pages!

</comment></comment><comment><USER35> The problem here is monopoly, or mono culture.

The whole world is, basically, using one email client. The lack of diversity means a well written scam like this spreads easily.

I can say for certain I'd never fall for this scam -- because it looks like crap in Pine. I know I'm special, but the same applies to Thunderbird, or whatever.

There's probably a parallel to biology here. Let's get diversity back in our internet culture and with it resistance; scams like this will be harder to convince and much less likely to spread. Hopefully removing some of the incentive, too.

<comment><USER36> I have been reading the comments wondering if this was a specific GMail webmail thing. I'm guessing that using IMAP or POP3 through an email client will make this harder? I'm by no means without risk but I rarely use the GMail web-client so wasn't sure exactly what the scam was

</comment></comment><comment><USER37> > The problem doesn't get better until we destigmatize it.

Absolutely, it can happen to anyone. I'm sick of people here or on other forums who do some victim blaming, calling phishing victims "idiots". It's not going to solve the problem. And often Gmail or Chrome teams dismiss these kind of issues.

I had to revert to the html version of Gmail because I was sick of all the phishing attempts and disable images in the client.

</comment><comment><USER38> As a security professional, I'm wired to loathe shortened links. This is a great example and exactly why I created a little hobby Chrome extension to expand all shortened links for inspection - [https://unshorten.link](https://unshorten.link)

</comment><comment><USER39> That's scary. Would having 2FA enabled on your Gmail account protect you from this kind of attack?

<comment> mike-cardwell Depends on the type of 2FA. If it's using U2F, then you'd be fine as that is tied to the domain name of the site you're on, but if it's using TOTP/HOTP (i.e. Google Authenticator), and the phishing site asked you for your 2FA code, and you gave it, then you would still be successfully phished.

<comment><USER20> Is the difference here that TOTP/HOTP is entered by the user, while U2F is entered automatically?

<comment> mike-cardwell Yes. With U2F the recipient of the token is verified by a machine. With TOTP/HOTP it is verified by the user looking at the browser address bar.

</comment></comment></comment></comment><comment><USER40> Almost fell for another clever one today: [https://medium.com/@scardine/clever-phishing-scam-of-the- day...](https://medium.com/@scardine/clever-phishing-scam-of-the- day-225ac70f0c21#.1em2rcyd2)

<comment><USER21> What's the point of that one? Just hoping that the user selects the same security questions and/or password as their google account?

</comment></comment><comment> martin-adams I nearly fell for this attack if it weren't for my email address on the fake Google login not being autofilled. That made then look at the URL, and my ultrawide monitor revealed a cunning URL that had some white space padding to hide the real URL.

</comment><comment><USER41> Always smiled at phishing scams but this scares the hell out of me, so I just headed to Google to setup 2-factor authentication.

How is your experience?

I understood that I can register specific machines not to use 2-factor, so if I loose my phone I still can login in. Anything else to consider?

<comment> martin-adams You can create application specific passwords, but I don't know if you can log in to the master account with those.

But you can generate backup codes that you can print out or store somewhere safe for that emergency.

</comment></comment><comment><USER42> I was about to ask why don't browsers prompt for confirmation when submitting a password on an unfamiliar domain, but then I realized the fake login page would just use a normal text field instead of a password field and fake the password dots.

</comment><comment><USER43> I wonder if the usage of plain-text mails would reduce phishing or increase it?

<comment> mike-cardwell You mean, if the phishers sent text email instead of html email, would they be less successful? Probably. So why would they?

Are you suggesting that all email/webmail clients stop rendering HTML?

<comment><USER43> I'm suggesting that companies like Google should have a plain-text option.

Long term goal is be to get rid of HTML, at least in my utopian mind as in it will never happening in reality.

</comment></comment></comment><comment><USER44> I think it's time for Google to implement the personalized icon thing Banks have when logging in. I definitely classify my email to be near as important security wise as my banking information.

</comment><comment><USER45> IMHO javascript should _never_ have been allowed in the address bar or even inline in an href. The first time I learned about this feature of a browser, I was thinking 'security defect'.

<comment><USER46> It's not Javascript, it's a data URI that renders an HTML page.

<comment><USER47> which contains JavaScript

</comment></comment></comment><comment><USER48> This is a lesser-known benefit of password managers that autofill (or at least auto-look-up) passwords in web pages. I might fail to notice a wonky address bar, but 1Password will notice.

<comment><USER49> 1Password is great, but it solves a problem that we should get rid of.

It converts the n-websites-n-passwords situation into one where passwords become random tokens unlocked by a single client-side secret.

We need to make U2F more widespread.

</comment></comment><comment><USER50> Why would you need to sign in if you're already in your gmail? Not to say there's anything obviously wrong, one could easily go there.

It does point out a major problem. Email used to be text only. Then we added attachments that needed to be saved as a file and read with whatever app. Then we went to automatically displaying attached images and having live HTML links. All of these things we do for convenience make this sort of attack more possible.

<comment><USER51> > _Why would you need to sign in if you 're already in your gmail? Not to say > there's anything obviously wrong, one could easily go there._

I can't tell you _why_ , but I'm pretty sure it happens - I have a recollection of having to reauthenticate every few weeks or so when opening a Google Drive attachment from my Inbox window. So I would not be surprised if I saw a login screen after clicking on such an "attachment".

</comment></comment><comment><USER52> The closest I ever came was a Nigerian scam where a crown prince had been one of the first people on a space station in the 90s, but his return seat was taken up by cargo when they decommissioned the satellite, so they just left him in orbit.

After 15 years alone in space he was "in good spirits" but wanted to come home and would share his overtime flight pay of $15M with me.

Seriously where do they find these stories.

</comment><comment><USER53> I actually did get phished by this. I think I just got lucky I had 2fa on and they didn't phish that too

[http://blog.greggman.com/blog/getting- phished/](http://blog.greggman.com/blog/getting-phished/)

The worst thing is I don't know how to help my less technical friends not fall for it. They are unlikely to use 2fa I think

</comment><comment><USER54> Hm, a give-away would be that the image would most likely not be interactive like it is now for me (Chromium). I.e. a PDF attachment footer "icon" renders the preview, and then action buttons when hovering the mouse over it. The buttons are then changed to darker colours with alt text when hovering over them again.

Or did they manage to embed the JS to simulate these actions with the attack?

</comment><comment><USER55> Use 2-Factor Auth. If you are a sysadmin make it required. Block image downloads by default. Turn on log in notifications for unknown devices. If you are a sysadmin in a controlled network and serve content via proxy block bit.ly. This is a clever and dangerous attack, but can still be avoided by following the above.

<comment><USER56> The 2FA token is valid for up to 1 minute and the attacker could easily ask for it as well...

There were no image downloads, it was embedded within the message itself.

<comment><USER55> Ok that's valid. Other than blocking bit.ly and other commercial link sharing services this seems to be a human hacking problem. It's hard to get people to be careful about checking the URL on a login page.

</comment></comment></comment><comment><USER57> A reminder that U2F essentially prevents phishing attacks:

[http://security.stackexchange.com/questions/71316/how- secure...](http://security.stackexchange.com/questions/71316/how-secure-are- the-fido-u2f-tokens)

</comment><comment><USER58> I've seen this before and nearly fell for it myself. If I didn't have auto fill for google account logins I would definitely fall for this. I noticed immediately when it made me type in my email and password and had no records of my other accounts.

</comment><comment><USER59> Some further reading on the subject by lcamtuf (from 2011): [https://lcamtuf.blogspot.com/2011/12/old- switcharoo.html](https://lcamtuf.blogspot.com/2011/12/old-switcharoo.html)

</comment><comment><USER60> One of my users was hit by this recently. Another interesting tactic they used was a redirect to the fradulent login page. This way, as soon as it was reported as phishing to google, they just incremented a number in the URL and could continue harvesting.

</comment><comment><USER61> The aim of EV certificates is to reduce such risks and highlight to the user the legitimacy of such websites.

HTTPS alone only provides encryption. Google doesn't use EV anywhere but I feel it should on login pages especially given it is a high phishing target.

<comment><USER62> EV certificates don't work. You're relying on the user to spot a change in the address bar, which is no different than relying on the user to notice that the domain is not "gmail.com".

HTTPS is meant for preventing MITM attacks, but it isn't meant to validate the identity of the entity you're speaking to; even though some people try doing that, it's just a game of pretend.

<comment><USER63> I totally agree that EV certificates don't work. I know the difference between EV and DV, but I'm glad I don't have to rely on that knowledge very much. I don't trust myself that I would notice if an EV site would suddenly have a slightly different looking DV-style lock icon. I don't even trust myself to remember which sites use EV in the first place.

As many other commenters here, I mostly rely on password autocompletion. If autocompletion doesn't recognize the site, then I'm extra careful. The point is that this is rare enough so that it is actually feasible for me to be careful on those occasions.

</comment></comment></comment><comment><USER64> If google still disabled images by default this would of been defeated

</comment><comment><USER65> how about use 3-step auth?

1\. you input your username

       google send back an msg/pic which you saved in google at last login

       confirm then goes to step 2

2\. you input password

3\. google ask you input auth code

<comment><USER66> So then they use a botnet to input your username on google.com to get your image, then stream it to you.

</comment></comment><comment><USER67> Correct me if I'm wrong, but that embedded image (pretending to be an attachment) redirects you to a (fake) Gmail login page. How is that supposed to trick anyone? I mean, isn't it unusual (i.e. never happens) for attachments to take you to a Gmail login page? So that's suspicious behaviour right there. How is it a serious phishing attack that's getting so much attention on a platform like HN where people are used to much more sophisticated hacks? Unless you're implying that visiting that website (fake login page) itself could harm the user's device, is there some detail that I'm missing here?

<comment> et-al Part of why we're impressed (and dismayed) is that they use a data URL to look like "accounts.google.com" and to load a remote script out of sight to the right of all the spaces. Maybe the URL protocol didn't fool you, but I think there are a good number of users out there who have been "trained" to check the URL to see that it says "accounts.google.com" and think it's fine.

And while clicking on an attachment shouldn't sign out a user, being automatically signed out has happened enough to most people that it seems like a fairly innocuous event, especially since this is _supposed_ to be an attachment, not a link, and you just need to sign back in. So one does.

<comment><USER67> Yes, getting automatically signed out is a normal thing. And of course, the user wouldn't suspect that it was the attachment that caused that. So yes, I see it now how this is a legitimate concern.

</comment></comment></comment><comment><USER68> One of my clients got hit with this yesterday. Google suspended the account but only after a round of emails had gone out.

Seems like at this point the perps are just harvesting credentials.

</comment><comment><USER69> This guy has an interesting YouTube channel

[https://www.youtube.com/user/enyay](https://www.youtube.com/user/enyay)

</comment><comment> jim-jim-jim I started using mutt to avoid image tracking, but dodging clever stuff like this is an added bonus.

I probably would have fallen for this.

</comment><comment><USER70> Just addressing this attack in particular, is there any legitimate reason to have consecutive white spaces in a URL bar?

<comment><USER71> If you accept that someone is allowed to embed text documents into a URL then you also need to either allow people to link to text documents containing large runs of white space, or introduce some very weird restrictions to the kind of documents that can be embedded that way.

</comment></comment><comment><USER72> This could be prevented by using physical keys instead of passwords. People are weak in deciphering URL bar contents.

</comment><comment><USER73> Cool to see Tom Scott on hackernews.

</comment><comment><USER74> Wow. Imagine if they had just used a few hundred extra spaces.

</comment><comment><USER75> This is why I disable images by default in my email client.

</comment><comment><USER76> Pretty. Damned. Clever. ...And, scary too.

</comment><comment><USER77> Serious question. Does having a chromebook anyway help? How often is the google safe browsing checked?

Wondering if I should do all internet activities inside chromebook only.

<comment><USER78> A Chromebook won't help anymore than Chrome for phishing.

</comment></comment><comment><USER79> To save the click:

Follow

Tom Scott (@tomscott):

This is the closest I've ever come to falling for a Gmail phishing attack. If it hadn't been for my high-DPI screen making the image fuzzy… [https://pbs.twimg.com/media/C0W-dCCWQAAl0cn.jpg](https://pbs.twimg.com/media/C0W-dCCWQAAl0cn.jpg)

<comment><USER80> Thanks for posting the image. Twitter's mobile site does not allow you to zoom the image. Very annoying how mobile sites do that.

<comment><USER81> The most important image IMHO is the following, be sure to check it: [https://pbs.twimg.com/media/C0XB_c8WIAAtEF8.jpg:large](https://pbs.twimg.com/media/C0XB_c8WIAAtEF8.jpg:large)

</comment></comment></comment><comment><USER82> Twitter blocked in my location. Is there a mirror?

Edit: thanks all for help below. Yes very cunning.

<comment><USER83> I don't know of a mirror but the email had an embedded image that looked like a pdf attachment in gmail. The embedded image led to a fake google sign in page when clicked

</comment></comment><comment><USER78> To stop being phished always check the domain name and for HTTPS before entering passwords.

<comment><USER84> Don't trust HTTPS, any malicious site can get certificate very easily. I once almost fell for a smart Airbnb phishing attack. At some point, I was directed to [https://www.airbnb.com.eubook.net/en/instant/rooms/2685603?c...](https://www.airbnb.com.eubook.net/en/instant/rooms/2685603?checkin=08%2F26%2F2016&checkout=08%2F31%2F2016&currency=€&guests=10) to complete my booking. Website had perfectly valid SSL cert (doesn't anymore) and more importantly, check out the domain name ! Almost missed the .eubook.net part!

<comment><USER81> HTTPS only means "you are securely accessing this particular domain" not "the operators of this domain are nice people".

</comment></comment></comment><comment><USER85> Luckily I always pay attention to the URL and I consider myself being pretty safe from all sorts of phishing attacks. There have been quite a few clever ones.</comment>


An Ayn Rand Acolyte Selling Students a Self-Made Dream - <AUTHOR> http://www.nytimes.com/2016/05/08/business/an-ayn-rand-acolyte-selling-students-a-self-made-dream.html <comment><USER2> I sure hope it's better than the delusion...er...dream... Greenspan sold us, but alas, I didn't RTF to find out.

<comment><AUTHOR> It's much more ironic. Someone who made his fortune on government backed loans that pitches Ayn Rand's philosophy of individualism and anti-govt.</comment></comment>


How an Inmate Serving a Murder Sentence Made a Math Discovery - <AUTHOR> https://www.popularmechanics.com/science/a32502357/inmate-math-discovery-prison-continued-fractions/ <comment><USER2> This echoes the story told in Francis Su's talk, then essay, then book, on "Mathematics for Human Flourishing". He starts by talking about Christopher Jackson, who is also a guest of the penal system.

[0] [https://www.francissu.com/flourishing](https://www.francissu.com/flourishing)

[1] [https://bobonbooks.com/2020/02/07/review-mathematics-for- hum...](https://bobonbooks.com/2020/02/07/review-mathematics-for-human- flourishing/)

[2] [https://yalebooks.yale.edu/book/9780300237139/mathematics- hu...](https://yalebooks.yale.edu/book/9780300237139/mathematics-human- flourishing)</comment>


Promiscuous Django Models  - <AUTHOR> http://tech.matchfwd.com/promiscuous-django-models/

<comment><USER2> Arguably a better approach would be to use something other than pickle for serialising.

<comment><USER3> I've done it myself by using a very simple JSONField class, but I'm looking into using PostgreSQL HStore for a next iteration, as it allows me to search the models by attributes, something the JSON field doesn't.

</comment></comment><comment><USER4> With so much outrage over sexism in tech, I wouldn't title a blog post this way.

<comment><USER5> promiscuous |prəˈmiskyo͞oəs| 2\. demonstrating or implying an undiscriminating or unselective approach; indiscriminate or casual: "the city fathers were promiscuous with their honours." • consisting of a wide range of different things: Americans are free to pick and choose from a promiscuous array of values and behaviour.

Hardly sexist. In this context I was referring to the more flexible and less restrictive use of models. See the comment threads on the original post for additional detail.

If you really want to raise that subject I can highly recommend a few good E3 video game trailers for you to comment on. ;P

<comment><USER4> Touché.</comment></comment></comment>


TransferWise - <AUTHOR> http://www.bloomberg.com/news/articles/2016-06-13/london-s-lonely-unicorn-two-frugal-expats-and-their-billion-dollar-startup <comment><AUTHOR> 30s in to the video the narrator explains how TransferWise works. Am I correct in thinking that this problem is very NP-hard?</comment>


Urgent Security Update Regarding Your Bitly Account - <AUTHOR> http://blog.bitly.com/post/85169217199/urgent-security-update-regarding-your-bitly-account

<comment><USER2> Typically, @homakov is holding some of the cards: [https://twitter.com/homakov/status/464568812583800832](https://twitter.com/homakov/status/464568812583800832)

<comment><USER3> That guy is an absolute machine

<comment><USER4> Seriously! I would love to spend one evening in that guy's brain.

<comment><USER5> I had drinks with him in Bangkok. He is at least as awesome as you'd expect.

</comment></comment></comment></comment><comment><USER6> We have no reason to believe == we have no way of knowing?

</comment><comment><USER7> I haven't used my account and don't care about it, am I at risk if I dont do this?

<comment><USER8> If you don't reuse that password anywhere else, and you don't have anything else depending on bitly, then the worst case is that someone could post links as you.

</comment></comment><comment><USER9> Anyone got a link to the delete account page? Is there one?

<comment><USER10> Looks like there is no way - [http://support.bitly.com/knowledgebase/articles/105373-how-d...](http://support.bitly.com/knowledgebase/articles/105373-how- do-i-delete-my-account)</comment></comment>


Ask HN: Identifying The Anonymous User  - <AUTHOR>

Hello Hacker News, it's been a long time since I've asked you guys something and I figured this place was the best place to ask this question:
What are the best or most efficient method to identifying a user without the use of accounts, destroying privacy, or demolishing anonymity?
If the question is too hard, how about if you're just limited to no accounts?
EDIT: I should have specified "Anonymous in the way that 4chan users are anonymous to each other."
EDIT2: The thing that got me thinking about it was this https://panopticlick.eff.org/ <comment><USER2> I tinkered once with hash of a user's passphrase, salted, and then using 4 digits from the middle of the resulting hash as a username. I then used a different 4 digits as a cookie token so they only had to enter it once per sesssion. It's not terribly secure, it's not collision-proof, etc, but you may find some use from the basic principle - it's quick and easy and was useful on the scale I needed it for :)

Edit: Point of note: The same people who wouldn't type 16 characters of username and password would happily type 30 or 40 character passphrases... There's some novelty to it, apparently :)

</comment><comment><USER3> I gather that UA info is surprisingly close to unique - mix in installed fonts and I think you're there.

</comment><comment><USER4> What's the context? When they use your website?

What do you mean by "identifying a user"? Simply knowing that they're the same person who performed a specific action earlier?

<comment><AUTHOR> I edited to clarify: I should have specified "Anonymous in the way that 4chan users are anonymous to each other."

And yes, as in "same person who performed a specific action earlier".</comment></comment>


Digg Caught Manipulating It's Own System To Benefit Advertisers - <AUTHOR> http://www.reddit.com/r/digg/comments/dwfxv/digg_caught_manipulating_its_own_system_to/

<comment><USER2> Why did you submit a reddit thread instead of the linked article?

[http://ltgenpanda.tumblr.com/post/1403230157/did-digg- game-i...](http://ltgenpanda.tumblr.com/post/1403230157/did-digg-game-its-own- system-to-benefit-publisher)

</comment><comment><USER3> Apostrophe's and they're use's.</comment>


Updating your phone apps has never been more important - <AUTHOR> http://www.news.com.au/technology/online/hacking/updating-your-phone-apps-has-never-been-more-important/news-story/cdf406f5d9c40b973bededdc57368df9 <comment><USER2> I found out that my 3-year-old Moto G (1st gen) that has got a gradually weakened battery suddenly regained its long lasting charge when I performed spring cleaning on the system apps by disabling them. Disabling in this context means that you cannot uninstall a system app but for some reason you are allowed to uninstall all subsequent updates and disable the app from running.

I did that for most every system app that I know I don't use and suddenly my phone is able to go 5-6 days without a charge instead of the ~48 hours before my spring cleaning.

It's sad that I can't really have both.</comment>


U.S. Federal Railroad Administration Legalizes Lightweight Train Cars - <AUTHOR> https://usa.streetsblog.org/2018/11/23/u-s-finally-legalizes-modern-european-style-train-cars/ <comment><USER2> The first time I saw a Caltrain pulling into a station I thought it was an armoured Soviet ballistic missile train, rather than a local commuter service.

<comment><USER3> As ugly as it looks now, the previous colors (Peninsula Commute era) looked worse. It was all dark gray with a red "bloody nose":

[https://commons.wikimedia.org/wiki/File:SP_3193_with_Train_1...](https://commons.wikimedia.org/wiki/File:SP_3193_with_Train_149_at_San_Mateo,_CA_in_August_1980_\(32938025271\).jpg)

<comment><USER4> That was a systemwide thing for Southern Pacific, not specific to the peninsula. It was fairly ugly but was a known low-cost transition to deal with a tightening belt when railroads were still private (and struggling)

</comment></comment></comment><comment><USER5> Recently moved to Europe.

I have to say the trains are ubiquitous and frequent. They seem very safe.

It's a hugely better experience.

</comment><comment><USER6> Iunno, maybe railcar windows in the US should continue to be able to resist a .22 round.

Yes, that is a test:

[http://www.hpwhite.com/ballistic-testing/railway-glass- testi...](http://www.hpwhite.com/ballistic-testing/railway-glass-testing/)

<comment><USER7> Why is that useful? Who is able to shoot at a train without being able to either board it or spawncamp a station?

Are cars and buses tested against that standard? (Certainly bikes, ferries, streetcars, and pedestrians are not required to pass this test.)

<comment><USER8> People take potshots at trains in the Midwest and West all the time. Bored teenagers with .22 rifles, mostly.

<comment><USER9> Passenger trains?

If so, does this happen as often for highways? If not, why not?

<comment><USER8> No, not passenger trains. Freight trains.

</comment></comment></comment></comment></comment><comment><USER10> Bring on the light rail revolution. North America desperately needs more light rail options. High speed as well, but one step at a time.

<comment><USER11> Where's the funding going to come from? USA has no money for infrastructure. MTA is struggling in NYC. Seattle's light rail is going to be completed in 2041+ and is being paid through a regressive car tab tax. I think it's a pipe dream that rail or transit will ever be improved other than very modestly in the USA.

Plenty of money and land for pipelines though [https://i.imgur.com/IdwIHQB.gif](https://i.imgur.com/IdwIHQB.gif)

<comment><USER12> In other words, if we can become less dependant on oil / natural gas (i.e. pipelines for them) we'll have more money for mass transportation. The irony is, our love of personal transportation is foregoing our transition to trains and such.

<comment><USER13> >if we can become less dependant on oil / natural gas we'll have more money for mass transportation

how do you figure that?

<comment><USER12> Bump up to the comment I commented on. That said something along the lines of "but there's plenty of money for pilelines."

I wasn't figuring. I was summarizing and contexting.

</comment></comment></comment></comment></comment><comment><USER14> The smooth ride is great, but does anyone know how this is going to affect speed?

Would be very interesting to hear how much this would affect the Acela time (I know there are a lot of other issues affecting train speeds in that case, such as zoning).

Similarly would be cool if the upshot of this is that in 10 years, Metro North and LIRR are significantly faster.

<comment><USER15> The current Acela rolling stock is already slated for replacement with European-style cars that are lighter and faster. [1]

But you're right. For the most part the bottleneck on Acela speed is the tracks, grade crossings, overhead wires and lower speed passenger traffic, not the trains.

[1] [https://en.wikipedia.org/wiki/Avelia_Liberty](https://en.wikipedia.org/wiki/Avelia_Liberty)

</comment></comment><comment><USER16> Is this why so many city metro subways have flat faces? I've always wondered why so many are not aerodynamic in the slightest.

<comment><USER17> They don't move that fast, so saving space is more important. Not perhaps at the stations but at rail yards and transfers that might be underground.

<comment><USER18> In the UK most trains are fairly flat faced, however trains travel relatively slowly (compared to Europe) at a typical maximum of 100mph.

[https://en.m.wikipedia.org/wiki/British_Rail_Class_450](https://en.m.wikipedia.org/wiki/British_Rail_Class_450)

<comment><USER19> That's essentially a local or regional train. Attaching multiple trains together and still allowing people to walk through is important.

Many local trains in Europe have a similar design, and a similar top speed.

The long distance trains in the UK do go faster and have an angled front.

It's presumable a trade off between aerodynamics and walk-through ability when connecting trains.

<comment><USER18> This specific configuration is for a commuter train, but similar trains (which can be coupled to other sets) are used on long distance routes in the UK.

As I said, the UK isn't really high speed compared to Europe. Other than the Eurostar line/HS1, all other lines throughout the UK are limited to 140mph (225km/h) or less.

</comment></comment></comment></comment></comment><comment><USER20> I just learned about another three letter federal agency I don't care for... Sigh

<comment><USER21> I'd bet a lot of the agencies you don't care for have a very important historical reason for existing. Don't like the FDA? Read "The Jungle." Don't like the FRA? Then you're leaving the safety of billions of tons of steel and coal crossing the paths of millions of Americans over 150,000 crossings to the whims of a half dozen companies.

</comment></comment><comment><USER22> Can say the same about American automobile crashworthiness standards. American standards make cars few hundred kilograms heavier in exchange for few percents higher chance for one to survive a highway collision, but this itself makes almost every other collision case more lethal, simply because there are more potential collision megajoules on the road.

<comment><USER23> It's more than a few percent improvement. 2018 car models are far more survivable than what we had 20 or even 10 years ago. Check out the injury and death statistics. For a given size the weight increase in that time hasn't been anywhere near a few hundred kilograms. And with modern high-strength steel or carbon fiber the weight can actually go down, although that drives up prices.

<comment><USER24> At the same time SUVs are killing more pedestrians due to being taller than previous car models. [https://www.freep.com/story/money/cars/2018/06/28/suvs- killi...](https://www.freep.com/story/money/cars/2018/06/28/suvs-killing- americas-pedestrians/646139002/)

<comment><USER25> Here is an idea: if there is a side walk, the speed limit is automatically capped at 25mph (unless there's a sign that says the speed limit is lower).

Thoughts?

<comment><USER24> I'm sure it's like with cyclists, only when you have a critical mass of cyclists on the road, the car drivers take notice and caution. The US isn't gonna reach a critical mass of pedestrians except in dense areas where using a car isn't economic or a necessity.

</comment></comment></comment></comment></comment><comment><USER26> "modern" doesn't mean better.

Now we get flimsy aluminum cans just like Europe has, so we can die in crashes just like Europeans do. This is thought to make trains more appealing.

The impact hazards are different. Europe mostly doesn't have freight rail, at least nothing like the USA does. Here in the USA, our rail is almost exclusively freight. We even have a train service just for orange juice. Freight is everywhere.

Europeans take the risk, and it isn't too crazy because there is no freight. That's nice for them. We have freight.

<comment><USER27> Looking at 2017 in [https://en.wikipedia.org/wiki/List_of_rail_accidents_(2010%E...](https://en.wikipedia.org/wiki/List_of_rail_accidents_\(2010%E2%80%93present\)), I count 10 train passengers (not counting the 6 students on board of a school bus that collided with a train) that died in train accidents that year in Europe.

I think that is a pretty good example of a risk worth accepting. The US seems to have ~6 billion rail passenger miles (~10b km) per year based on [https://www.bts.gov/archive/tet/2016/tables/ch1/fig1_16/text](https://www.bts.gov/archive/tet/2016/tables/ch1/fig1_16/text)

[https://ec.europa.eu/eurostat/statistics- explained/index.php...](https://ec.europa.eu/eurostat/statistics- explained/index.php/Passenger_transport_statistics#Rail_passengers) claims that "Based on the latest data available (generally for 2016), there were 401 billion passenger-kilometres travelled on national railway networks in the EU (including 2015 data for Denmark and 2014 data for Hungary; excluding Belgium and the Netherlands). This figure was considerably higher than the 22 billion passenger-kilometres travelled on international journeys (based on the same data availability)"

If a full freight train crashes into a full passenger train at speed, I doubt armoring the cars is going to help much.

What will help is systems that make collisions less likely, and a system that makes passenger rail feasible in the first place (not sure if that's possible in the US, because the typical distances are just so much bigger).

<comment><USER19> I actually count 7 (1 LU, 1 BE, 3 GR, 1 FI). If you discount the crew, who face a higher risk than passengers, it's 3 (0 LU, 1 BE, 1 GR, 1 FI).

There are some worse recent accidents involving head-on collisions at significant speed [1], [2], but to see whether the resulting investigation concluded that differently-designed trains would have reduced injuries, the report (for me) needs to be in English.

For that, since the UK has the safest railway in Europe (the world?) we need to go back to 2001 [3], with a closing speed collision at 142mph / 229km/h and 10 deaths. The investigation report [4] concludes (12.10) "The crashworthiness displayed by the passenger coach body shells, when subjected to end impact, was adequate. The first five coaches had some of their survival space reduced by roof, floor and side impacts, or penetration by large missiles or other vehicles. Impact with the underside of the road bridge was responsible for roof damage. The ability of the vehicles to protect their occupants was compromised by the loss of some roof sections and window glass."

[1] [https://en.wikipedia.org/wiki/Andria%E2%80%93Corato_train_co...](https://en.wikipedia.org/wiki/Andria%E2%80%93Corato_train_collision)

[2] [https://en.wikipedia.org/wiki/Bad_Aibling_rail_accident](https://en.wikipedia.org/wiki/Bad_Aibling_rail_accident)

[3] [https://en.wikipedia.org/wiki/Great_Heck_rail_crash](https://en.wikipedia.org/wiki/Great_Heck_rail_crash)

[4] [https://webarchive.nationalarchives.gov.uk/20130904004318/ht...](https://webarchive.nationalarchives.gov.uk/20130904004318/http://www.rail- reg.gov.uk/upload/pdf/incident-greatheckfinal-optim.pdf)</comment></comment></comment>


For DNSSEC - <AUTHOR> http://blog.easydns.org/2015/08/06/for-dnssec/ <comment><USER2> The authors of this post missed the fact that there's an FAQ linked to the top of the post, where I rebutted all of these objections (and many better ones) 8 months ago. Rather than tediously recapping the same points again, I'll just direct their attention to the link:

[http://sockpuppet.org/stuff/dnssec- qa.html](http://sockpuppet.org/stuff/dnssec-qa.html)

Dan Kaminsky, speaking at the Black Hat CSO Summit this Tuesday, attempted to advocate DNSSEC to the room. I wasn't in room yet to see it, but I'm told the suggestion was met with loud, sustained laughter. DNSSEC is not going to happen. There is absolutely no chance that, in the wake of the Snowden leaks, we are going to forklift out piece of core Internet infrastructure so that the security of .COM, .CO.UK, and .NET can be permanently and irrevocably signed over to the US Government. Move on.

<comment><AUTHOR> I tried to address all the major points in your FAQ and Adam Langley's follow- on blogpost as well, but I will take another crack at it.

<comment><AUTHOR> Hey, I mistook the QA for your FAQ post, my overall thesis hasn't changed but I will follow up on the new info in your QA post : )

</comment></comment></comment><comment><USER3> With the current CA system, you have to worry about far more than just the CAs.

An attacker just needs to MITM the connection between the target website and a CA of his choosing, and the CA will give the attacker domain-validated certificates for the target website.

So the current SSL in browsers can be compromised not just by the 600+ CAs, but also by anyone who can launch MITM attacks on the internet (e.g. the thousands of ISPs who can publish BGP routes).

For email-based domain validation, the attacker doesn't even need MITM capabilities -- catching the domain validation email in passive bulk data collection is sufficient. The NSA can trivially get valid certificates for arbitrary domains even without the cooperation of any CA! And if the attack on the target website is discovered, it would look like $RANDOM_CA is to blame, even when the CA did nothing wrong (unless you consider the whole idea of domain-validated certificates to be wrong).

DNSSEC+DANE has the potential to be much much more secure than the status quo. The problem is that no one wants to be the first to implement client-side DNSSEC validation and get blamed for failing to connect to incorrectly configured domains.

<comment><USER4> Is there a way to see if any CA has issued a cert for a site? If all CAs posted the certs they sign to some database, then there could be services that alert you and you'd know right away and raise an alarm. If such a system doesn't exist, why not?

<comment><USER5> Certificate Transparency ([http://www.certificate- transparency.org](http://www.certificate-transparency.org)) is a Google initiative working on just that. It's already required for EV certs in Chrome.

<comment><USER4> Have any CAs publically committed to submit all their generated certs to that?

Does [https://pki.google.com/](https://pki.google.com/) do that?

<comment><USER6> Chrome currently requires that all extended-validation certs with an issuance date of 1/1/2015 or later be submitted to the CT logs. (Otherwise it will not show up in the UI as an EV cert.)

As with all browsers, only a subset of CAs are trusted to provide EV certs in the first place, regardless of whether they include the EV bits in the certificate. And this policy only applies to EV certs, not to all certs by an EV-capable CA.

<comment><USER7> With some exceptions, at least. For example, twitter.com shows up as an EV green bar while my browser tells me there's no CT information available. The CT website mentions a list of exceptions would be generated but I haven't been able to find any public list, and there's been no update to their rollout plans in over 7 months[1].

Oddly enough I noticed the other day that certificate-transparency.org isn't even accessible over https.

[1] [http://www.certificate-transparency.org/ev-ct- plan](http://www.certificate-transparency.org/ev-ct-plan)

<comment><USER6> The twitter.com cert I see in my browser was issued on 9 September 2014, which is before the 1 January 2015 threshold.

(Eventually this should go away because a compromised CA key can obviously just lie about the time, but this is just a migration step.)

<comment><USER7> You're right, I missed that at the top of the doc. I assumed all of the details would be in the numbered list.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER8> This is unconvincing. For instance:

"There are methods to prevent leaking" isn't the same as "leaking is prevented by default." This sounds like a protocol design flaw that will end with implementors being blamed.

I think the way forward is a protocol like Stellar, not one like DNSSEC. Also, EdDSA or GTFO

<comment><AUTHOR> > "There are methods to prevent leaking" isn't the same as "leaking is > prevented by default."

This is from the zone enumeration section and plain DNS doesn't do anything to prevent zone enumeration by default either.

> EdDSA

We are working on standardizing EdDSA, but it takes a long time to get to deployment.

<comment><USER8> Good, come back when it's standardized. Until then, _stamps [REJECTED] on the DNSSEC folder_ death to 90's crypto

<comment><AUTHOR> > Until then, stamps [REJECTED] on the DNSSEC folder death to 90's crypto

If you read TFA you would see that we are transitioning to P-256. FWIW, ECC crypto is really slow and we will need to transition to post-quantum crypto in another 10 or 15 years.

<comment><USER2> "ECC crypto is really slow"? Please explain what you mean by that.

<comment><AUTHOR> ECC signature verification is slower and big resolvers are complaining about it. Ed25519 is faster than the equivalent P curve but it's still slower than log-based crypto.

<comment><USER2> The alternative in DNSSEC to ECDSA isn't "log based crypto".

</comment></comment></comment></comment></comment></comment></comment><comment><USER9> So as I read #1, I'm trying to figure out what angle they're trying to argue here. The fact that the current TLD and CA systems are baked around the concepts of central authorities who are controlled either directly or indirectly by governments is known, and it's not a valid justification for DNSSEC also having that same pitfall. We're already well aware of the threats to security that come from centralized control like that, lets not build a new system that puts all our eggs in the same basket.

<comment><AUTHOR> The argument is that if you choose a traditional TLD your eggs are in the centralized basket. All of the mitigation techniques proposed by Marlinspike for HTTP can be applied at the DNS level as well.

And even if you choose a decentralized DNS solution, you still need DNSSEC.

The point is that DNSSEC has little to do with the centralization issue and that it can do a lot to improve the security and privacy of the Internet as a whole.

<comment><USER10> > And even if you choose a decentralized DNS solution, you still need DNSSEC.

But that's not true. DNSCurve does provide a decentralized trust mechanism. If you are willing to embrace the pitfalls and advantages of such an approach, you don't need DNSSEC.

<comment><AUTHOR> As covered in TFA, DNSCurve provides encryption between a DNS resolver and the client. It doesn't allow domain owners to sign their records.

Dan Kaminsky did a good job taking DNSCurve apart back in 2011: [http://dankaminsky.com/2011/01/05/djb- ccc/](http://dankaminsky.com/2011/01/05/djb-ccc/)

"I observe this is essentially a walk of Zooko's Triangle, and does not represent an effective or credible solution to what we've learned is the hardest problem at the intersection of security and cryptography: Key Management. I conclude by pointing out that DNSSEC does indeed contain a coherent, viable approach to key management across organizational boundaries, while this talk — alas — does not."

<comment><USER10> "If you are willing to embrace the pitfalls and advantages of such an approach, you don't need DNSSEC."

That was in reference to Zooko's Triangle. You have to choose one of the other two if you are doing decentralized. The obvious choice being that you can't trust the human readable host names.

<comment><AUTHOR> cbsmith: I'm not sure what you mean ... using a traditional TLD means that you made the choice to add third party trust to your system. Adding the CA system just adds additional third parties that you have to trust.

</comment></comment></comment></comment></comment></comment><comment><USER11> _SSH relies almost exclusively on the first connection to a server being correct and an attacker being unable to perpetuate a MITM attack against a given host._

Do _you_ rely almost exclusively on the first connection to a server being correct? Apparently. Does SSH? No.

<comment><USER6> In practice, I have few ways of verifying SSH fingerprints that don't involve trusting the SSL PKI.

</comment></comment><comment><USER12> What does "moving on to ECC" in HTTPS have to do with the weak crypto in DNSSEC?

It seems to me like they're brushing this issue aside, especially with their "but seriously, you don't _really_ expect the NSA to spend tens of millions of dollars to crack a server's security, do you?" comment.

Um, if it's a site that serves millions of people I most certainly do! I'd also expect them to spend that much on any tens of thousand to hundreds of thousands of users Lavabit-like service, too.

<comment><USER13> Where do you see that? The article seems to only talk about moving to ECC in the context of better DNSSEC security and message sizes that are an order of magnitutde smaller than RSA's.

</comment></comment><comment><USER14> DNSSEC got PKI wrong, but what it got right was building authentication (DANE, etc) on a standard protocol (DNS) for exchanging key/value data.

Like DNSSEC, whatever protocol comes next ought to support offline signing of k/v data, so that it can be served securely by organizations that can't afford HSMs. And it should be used in a similar way to DANE -- for bootstrapping other protocols in a general way.

<comment><AUTHOR> > DNSSEC got PKI wrong, but what it got right was building authentication > (DANE, etc) on a standard protocol (DNS) for exchanging key/value data.

~~Huh? That is what a PKI consists of....~~

> Like DNSSEC, whatever protocol comes next ought to support offline signing > of k/v data

~~DNSSEC was, from the outset, designed to support offline signing.~~

Update: Whoops, I misread what you wrote! : )

<comment><USER14> > Huh? That is what a PKI consists of....

How do you sign a key/value data set with a certificate from Verisign? Are there tools that can automatically follow this delegation?

In DNSSEC once your zone is signed, you can upload an entire signed tree of subdomains. With current CA's, you get one certificate signed for xxxxxxx.com, and have to go back to Verisign for any subdomains (keys) you decide to add later.

I can't add a signed value for __custom_protocol__._wellknown.me.com that uses the existing x509 infrastructure. If I add another server, I can't delegate to it.

> DNSSEC was, from the outset, designed to support offline signing.

Yes... that's what I said. The replacement should support it, too.

<comment><USER15> > How do you sign a key/value data set with a certificate from Verisign?

If your domain root is signed by Verisign, you get your domain key signed through your register. The actual procedure varies with the register, from impossible to fully automated. DNS is exactly a key/value dataset.

I just don't understand the point of your other questions:

>Are there tools that can automatically follow this delegation?

Just list the domain. You'll see all delegations there.

> In DNSSEC once your zone is signed, you can upload an entire signed tree of > subdomains. With current CA's, you get one certificate signed for > xxxxxxx.com, and have to go back to Verisign for any subdomains (keys) you > decide to add later.

> I can't add a signed value for __custom_protocol__._wellknown.me.com that > uses the existing x509 infrastructure. If I add another server, I can't > delegate to it.

Are you arguing that the specific certificates are better? Why?

<comment><USER14> > Just list the domain. You'll see all delegations there. > Are you arguing > that the specific certificates are better? Why?

We seem to be having a communication issue.

From [1]: "Delegation problem: CAs cannot technically restrict subordinate CAs from issuing certificates outside a limited namespaces or attribute set; this feature of X.509 is not in use. Therefore a large number of CAs exist on the Internet, and classifying them and their policies is an insurmountable task. Delegation of authority within an organization cannot be handled at all, as in common business practice."

With DNSSEC this is not a problem. Once I have a DS key pointing to my zone, I can delegate as much as I want. This allows a great deal of flexibility, as I've already mentioned.

[1]: [https://en.wikipedia.org/wiki/X.509#Problems_with_certificat...](https://en.wikipedia.org/wiki/X.509#Problems_with_certificate_authorities)

<comment><USER6> Ah, I think the delegation problem with the X.509 / HTTPS PKI is a (fairly massive) implementation facepalm, not anything inherent to a PKI itself. So I think that's why people were confused by your statement "DNSSEC got PKI wrong" \-- that doesn't seem _wrong_ , it seems like a _good thing_ for a PKI to support this. Do you think that a DNSSEC replacement should match the X.509 PKI in this regard?

<comment><USER14> Ah, that makes sense. Sorry for the confusion I created. I meant that DNSSEC PKI is wrong in the sense that it is hierarchical, and the root keys are centrally controlled by a biased party. A better PKI would probably look like Convergence [1], where trust is derived from a hybrid CA/"web of trust" system formed by a network of notaries.

The delegation implemented in DNSSEC is a good thing. I didn't think about how that feature would quite reasonably be lumped in with "PKI".

Oops.

[1]: [http://convergence.io/](http://convergence.io/)

<comment><AUTHOR> Marlinspike abandoned convergence a year after it was debuted. It's currently broken on most (all?) platforms.

As covered in the article, Convergence-style triangulation of cryptographic information is application/protocol neutral. Indeed, a DNS-level implementation would be much more powerful than what can be accomplished with HTTPS.

<comment><USER2> He moved from Convergence to TACK, which is on hold during the rollout of HPKP, which is like 80% of the value proposition of TACK.

<comment><USER16> What's in the missing 20%?

<comment><AUTHOR> It's still vulnerable to MITM attacks on the first connection.

<comment><USER16> Ah. What is TACK's proposal to prevent that from happening?

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER17> Personally I think a new DNSSEC2 based on for example online signing might be a good idea.

<comment><USER18> What do you mean?

<comment><USER17> DNSSEC has several problems some of which is in the design, as tptacek likes to mention.

<comment><AUTHOR> This post directly addresses each point that Ptacek raised in his "Against DNSSEC" blogpost and FAQ.

<comment><USER19> Poorly and unconvincingly addresses. Same argument we've seen over and over -- now in a nice clean FAQ!

Doesn't change the design problems. Just tries to hide them behind half-truths and "but there's nothing better..."</comment></comment></comment></comment></comment>


How Should Atheism Be Taught? - brian-armstrong https://www.theatlantic.com/education/archive/2018/01/how-should-atheism-be-taught/551885/?single_page=true <comment><AUTHOR> Here in Italy, supposedly a Catholic stronghold, I have absolutely no problem and no repercussions whatsoever declaring myself an atheist. I could easily run for public office and not be penalised on account of that (not that I would expect to win). Quite honestly nobody gives a shit.

And yet, in my few, brief visits to the US, I've learnt to avoid the topic or outright lie. I've noticed, according to an informal and unscientific survey, that I can declare myself to pretty much any religion (including Zoroastrianism, excepting Satanism) and get nodding approvals or at the very least tolerance. If I let slip that I'm an atheist on the other hand and I'm usually in for it.

</comment><comment><USER2> > Appignani contends that atheists are one of the few minority groups in the > country to still be widely ostracized by society.

What is a "minority group"? Drug Dealers are a minority group that are ostracized.

Yes we should be very open to different beliefs and different cultures. Yes we should embrace diversity. Some politically correct terms hold almost no meaning and their ambiguity can be exploited.

<comment><USER3> Atheists, unlike drug dealers, are a constitutionally-protected minority group. That's what most people mean when they use "minority" as shorthand: a minority group defined by a protected class.

<comment><USER2> Is there a list of protected classes? Seems ambiguous to me.

<comment><USER3> I can't tell if you're being sarcastic or not, so I'll answer as though you're sincere.

Yes. Those classes are literally in the Constitution of the United States. They are: race, religion, and sex. These are the basic federal protections that apply to all states.

There are statutory federal protections for people with disabilities (Americans with Disabilities Act being the most important), as well as to prevent discrimination based on age in some contexts.

Some states have chosen to add additional protections, e.g. sexual orientation and sexual identity.

Regardless of where the protections come from, they are spelled out in black and white in documents available for anyone to read for free.

<comment><USER4> The protected classes you're referring to are not in fact in the Constitution; you're thinking of the Civil Rights Act, which is a federal law, but not a Constitutional amendment.

</comment></comment></comment></comment></comment><comment><USER5> "tells a compelling story about his conversion to atheism"

Conversion to atheism? That sentence doesn't make any sense, atheism is not a religion. It would be more correct "deconversion from religion"

<comment><USER6> > Conversion to atheism? That sentence doesn't make any sense,

Yes, it does.

> atheism is not a religion.

That doesn't matter, as it's clearly a belief, and the relevant sense of "conversion" is (from Google Search's integrated dictionary) "the fact of changing one's religion or beliefs or the action of persuading someone else to change theirs".

<comment><USER5> > as it's clearly a belief

Atheism is a lack of belief, not a belief.

Saying that atheism is a belief would be like saying that bald is a hair color.

Also, I think that the title is loaded to convey that atheism is like another religion, which has to be taught.

The idea of "teaching atheism" is silly. Just teach to reason and think for themselves, and form their own opinion based on facts rather than blindly accepting what someone told them to belief, let everyone think freely and provide the mental tools to do so instead of indoctrinating children.

Education is the worse enemy of religion. Religion preys on the ignorant.

<comment><USER6> > Atheism is a lack of belief, not a belief.

Even granting that, changing to atheism is a change of belief and thus comfortably fits within the definition of conversion.</comment></comment></comment></comment>