Hackers accessed Telegram messaging accounts in Iran – researchers - <AUTHOR> http://www.reuters.com/article/us-iran-cyber-telegram-exclusive-idUSKCN10D1AM?sp=alcms <comment><USER2> Clickbait title. The correct title would be 'Exclusive: Hackers accessed Telegram messaging accounts in Iran - researchers' which itself already hides the fact that the problem lies not with Telegram infrastructure, but the interception of SMS by state telcos.

<comment><USER3> If Telegram relies on SMS for its authentication system, wouldn't the SMS network be part of its infrastructure, if indirectly?

<comment><USER4> Facebook relies on SMS. Whatsapp relies on SMS. VK relies on SMS. Viber relis on SMS.

Are we going to say that all of those have been breached too?

<comment><USER3> Potentially.

Of course, you won't see it too often in the headlines..

<comment><USER4> I know that some people here are suspicious of Telegram because they use their own encryption mechanism, but it's like there's an active campaign against it by the media. In my country the media has been calling it the "ISIS chatting app".

<comment><USER3> Nothing to do with that. Authentication is an essential pillar of a security app, and the ability to effectively authenticate is an important component of opsec. If SMS is compromised (and it is not hard to imagine given how protective govt is about SMS exploits/sigint) then the authentication aspect of any app that relies on SMS is also potentially compromised. Weakest link and all that...

</comment></comment></comment></comment></comment></comment><comment><USER5> [https://telegram.org/blog/15million- reuters](https://telegram.org/blog/15million-reuters) Stay calm and turn on 2-step verification.

</comment><comment><USER6> When an adversary intercepts a Telegram SMS authentication code, this gives them pretty much complete access to a user's entire Telegram messaging history. This is true because messages are not end-to-end encrypted by default. The Telegram servers will happily return perennially stored transcripts to any client that is even temporarily considered valid.

This is _not_ true for messaging applications that are end-to-end encrypted by default and that do not store plaintext on their servers. This isn't a subtle difference. Lots of comparisons in this thread fall victim to a sort of implied false equivocation.

Using SMS as a form of authentication may be a quality that Telegram shares with other popular messaging applications, but it is uniquely susceptible to all of the associated pitfalls.

</comment><comment><USER7> Authentication via SMS considered harmful.

<comment><USER8> I wonder why Telegram (and Twitter) doesn't allow the use of third party MFA providers just like LastPass.

[https://helpdesk.lastpass.com/multifactor-authentication- opt...](https://helpdesk.lastpass.com/multifactor-authentication-options/)

<comment><USER9> I'll never understand why LastPass requires you to be a premium user to use some forms of their 2FA (for example, I can't use my Yubikey if I don't pay for a premium, and I don't need a premium account for literally anything else).

</comment></comment></comment><comment><USER10> "Telegram breached", "Hackers break into Telegram", "Iranian Hackers Just Cracked Telegram". I didn't think any of these nonsense titles would reach the first page of Hacker News.

<comment><USER11> How about: "Iranian citizens pay the price for Telegram's weak security".

"Telegram's exaggerated security claims gave Iranian users false sense of security, now Iranian secret police have read their messages." isn't quite concise enough.

<comment><USER11> Alternatively: "News of Telegram hack contrary to user's strongly held beliefs, #offended by suggestion of problems with Telegram."

</comment></comment></comment><comment><USER12> Once again proving a) the security of a system, like a chain is only as strong as its weakest link and b) if something is theoretically broken now it will be actually broken tomorrow.

</comment><comment><USER13> _> The researchers said they also found evidence that the hackers took advantage of a programing interface built into Telegram to identify at least 15 million Iranian phone numbers with Telegram accounts registered to them, as well as the associated user IDs._

Me thinks that's more important than someone intercepting an SMS - at least in terms specific to Telegram. Is there more information on this? What evidence is it?

<comment><USER14> They acknowledge this in their blog post: [https://telegram.org/blog/15million- reuters](https://telegram.org/blog/15million-reuters)

It's part of their contacts API, where you submit the numbers you have in your contacts list and they let you know which numbers already have a telegram account.

They have since added rate limiting to prevent brute forcing it, but it sounds like the API itself is still available.

<comment><USER13> Ah, I see, thanks.

</comment></comment></comment><comment><USER15> Iranian here, as programmer and software security hobbyist, I always warned my friends against telegram. Sadly the local news is government used that bug and clone 15M person chat record/contacts/public data and etc.

This is pretty _huge_ , this can put many lives in danger, I know people who are gay and use telegram. If you are any kind of person who government does not agree with you , from now on , government has your personal communication record. For example when you applying for regular job(which 90% of jobs in Iran is related to government , because of state controlled economy)then you have absolute no chance, even if you are much better candidate than some stupid person who spend their lives defending government stupid ideas.

P.S. Replace all "government" with "regime". Government in Iran is actually good (in compare to regime) and Rouhani is our only hope. The problem is Revolutionary Guard.

<comment><USER16> Does SSL access to hacker news protect your identity in Iran? And do you think encrypted messages with telegram with 2 factor auth protects people? I think not, since they just have to get the messages of the people you chat with, the weaker link is the other side.

</comment></comment><comment><USER17> > widely used in the Middle East, including by the Islamic State militant > group

I understand the risk associated with rogue people using such a service, but is not the ability to determine who exactly is using the service counter productive? I.e. for journalists and personas non grata under oppressive regimes.

<comment><USER18> Are you sure it's being "determined", in a SIGINT sense? Perhaps ISIS have made public mention somewhere of their usage of the service. Or perhaps others (e.g. opposing forces) have just shoulder-surfed some ISIS members using it, or looked through their phones.

<comment><USER17> You are right, it totally skipped me. It is very possible that some of their personnel/phones were captured leading directly to this information.

</comment></comment></comment><comment><USER19> Anything that involves SMS, SS7 and the legacy PSTN phone network cannot be relied upon for anything crypto related... Sending auth keys/codes by SMS, really? I understand it was a decision made to have the system be easy to use, but it's foolish in my opinion.

<comment><USER20> If the crypto is solid the transport is irrelevant. This points to deeper vulnerabilities. IP networks are no safer than SMS.

<comment><USER19> I realize this was a use of sending short authentication codes by SMS, but at 160 characters the crypto can't be solid, if somebody decided to implement proper public/private key over it. So the transport is definitely a problem.

<comment><USER11> Signal was originally TextSecure, there was no problem with its message security. Plenty of meta data problems though. If you still need to send secure SMS there is a fork at [https://silence.im](https://silence.im).

</comment></comment></comment></comment><comment><USER21> One might suppose that because login relies on the cellular network it's implicitly part of the app's infrastructure. In that sense the technical failing of Telegram was relying on one method of authentication (when multi- factor should be the default). I think it far-fetched to extrapolate that into 'Telegram got hacked', though.

I understand the want to share the article, but a concerted effort to amend the original title to reflect the actual content would have been appropriate here, methinks.

Edit: fixed some speling.

</comment><comment><USER22> Telegram has had 2FA since years!

</comment><comment><USER23> Newb question: why Telegram does not use Google Authenticator ? Why so few app use it ? Is it more secure or completely useless ?

<comment><USER24> I do not know why not more services use it but i want to point out that the Google Authenticator app is just an implementation of [0]HOTP and [1]TOTP.

There is also a free implementation of the same feature set available called [2]FreeOTP.

[0] [https://tools.ietf.org/html/rfc4226](https://tools.ietf.org/html/rfc4226)

[1] [https://tools.ietf.org/html/rfc6238](https://tools.ietf.org/html/rfc6238)

[2] [https://fedorahosted.org/freeotp/](https://fedorahosted.org/freeotp/)

</comment></comment><comment><USER25> Well, the problem lies more with the de-anonymization of ~15 million users in Iran, though, which Telegram didn't deny.

</comment><comment><USER26> Strictly, this isn't a breach in Telegram, as it relies on the adversary being able to own the cell network you're on, but that may not bring much comfort to many of the people who feel they might need to use Telegram.

What other systems would people suggest to do this initial setup?

<comment><USER11> This is precisely a breach of Telegram, they are essentially sending auth keys to the adversary when the adversary asks them too.

New devices should only be authorised with the use of an authentication token from an existing client device; one needs to decide if the new device should have access to old messages. Ideally it would be clear to all parties as to which devices and identities have joined a chat.

</comment></comment><comment><USER27> Only public phone numbers are collected, no account is compromised, according to Telegram:

[https://telegram.org/blog/15million- reuters](https://telegram.org/blog/15million-reuters)

</comment><comment><USER28> Is there a way to know how many devices are linked to an account and which devices they are? That would let people check if they've been eavesdropped and possibly cut off the hacker by removing the extra device. Then add a password.

<comment><USER29> Yes. It's in the settings screen. You can remove any or all devices (bar the current one), too.

</comment></comment><comment><USER30> Yet in this case all the encrypted secret chats are still kept private. Because even gaining access to the user account, doesn't allow you to read messages from secret chats.

</comment><comment><USER31> How does migration to a new phone work with Signal?

</comment><comment><USER32> This is as bad as a breach

</comment><comment><USER33> two step verification would be guard of this Achilles' heel

<comment><USER34> You mean Two Factor yeah? Because telegram already relies on two step.

<comment><USER35> SMS is the first factor in the case of Telegram. The 2-step authentication Telegram provides is through email.

<comment><USER36> Nope, the second factor is a password you must type in after inserting the sms code.</comment></comment></comment></comment>


John L. Sullivan Fights America - <AUTHOR> http://publicdomainreview.org/2014/04/30/john-l-sullivan-fights-america/

<comment><USER2> So this appears, on the face of it, to have nothing to do with "Hacker News". It is historical. It has to do with startups or wireless web applications.

But I learned something from it. The guidelines state that an appropriate article is "anything that gratifies one's intellectual curiosity". And I found that this tale of how America's first "sports superstar" (as the article classifies him) was enabled by changes in technology (particularly the railroads), not just social changes, that this tale was somehow intriguing. Made me stop to think what kinds of social changes our current technological innovations may bring (are bringing) and where these will wind up.

So, one up-vote from me.

<comment><AUTHOR> History certainly does have to do with Hacker News. So does any other topic of intellectual substance. That's always been the case.

Glad you enjoyed this one!</comment></comment>


Ask HN: Side projects to generate leads for mobile app projects? - <AUTHOR> I run a mobile app agency, sales is always challenging. It's difficult to get leads about projects. People suggested that I try paid lead services - I didn't and it is actually 0% effective.
I have come to realize that cold emailing doesn't work. Also the work that our agency has got till now has all been through client references and from personal network. I do keep tapping these for leads but they are not very frequent.
I came across few strategies where the agency works on few side projects which can generate leads. A good example is by crew.co - they've create two such side projects:
1. How Much To Make An App - http://howmuchtomakeanapp.com/ 2. How to Build an Online Business - https://crew.co/how-to-build-an-online-business/
I am leaning to spend time building such a project. Could anyone recommend any similar ideas for such side projects?
Thanks! <comment><USER3> Sales is challenging for every business. If all your work has come through client references and personal networks, talking with clients and references is likely to be a fruitful path to more work.

Well established and known consultants may occasionally get work solely off their internet presence. But mostly their websites support their other marketing channels: their websites provide more information to potential clients that have heard of the consultant by other means (not via Google SEO'd search).

Good luck.

<comment><AUTHOR> Thanks for replying.

> If all your work has come through client references and > personal networks, > talking with clients and references is > likely to be a fruitful path to > more work.

I do that already. I talk to my past clients frequently - I do believe that they would recommend me whenever they get an opportunity - they've done so in the past. But it looks like I'm facing a dry spell right now for about last 2 months - which is a really long time for me. I think I'm wasting my time :-/

That is why I think building side projects which generate leads for me can be productive. Do you have any creative ideas for my side projects? I can build mobile apps and web apps.

<comment><USER3> My advice is to identify potential clients and cold call even though cold calling is harder than doing something less effective. One way I've heard to make dealing with the rejection it entails easier is to measure the number of rejections rather than the number of leads.

In terms of what to build, build something that solves someone _else 's_ problem. Essentially, build a product. 'How much does an app cost' websites don't do that because they're focused on solving your problem (getting clients) rather than the clients' problems in their business domains.

To put it another way, build something that shows people that you have the skill and knowledge to solve one of their business problems rather than building something that generates leads.

<comment><AUTHOR> Thanks for the reply. I'll try to keep doing cold emailing, though sometimes I feel that I'm just emailing a wall who never replies. I've read tons of books and courses on how to write best emails and I do follow them - it's just that clients already have a dev team or they are not looking to outsource at that point of time - which boils down to unresponsiveness.

'How much does an app cost' websites do solve a problem - they give the customer instant quote or estimate for their app. And it does also solve the 'getting clients' problem.

Ideally, I want to do something that's a win - win for both.

<comment><USER3> I am not advocating cold emailing. I am advocating cold calling with a phone or in person.

<comment><AUTHOR> Ok, I've never actually done cold calling. I don't like being on the receiving end of cold calls - so I figure others wouldn't like it either. But in person would be much better.

<comment><USER3> People usually do not like it, that's what makes it hard work. It's also more effective because it allows collecting more intelligence. The decision maker's personal assistant knows something about the company and can provide valuable insight to the organization and its pain points. The receptionist knows the org chart.

</comment></comment></comment></comment></comment></comment></comment><comment><USER4> Originally I did [http://canyoumakeanappfor.me/](http://canyoumakeanappfor.me/) as satire and surprisingly it brought me few freelance small task from other developers who want to divide some smaller task to others.

<comment><AUTHOR> Thanks for sharing. How exactly did this bring your freelance tasks? I mean you do not have any of your contact info on that page - so how would leads be generated?

Another follow up regarding this, did you market this page? If yes, on what channels and did you get a good response?

I do like the domain that you choose and the satire.

</comment></comment><comment><USER5> Develop a prototype app for your targeted customer. We developed prototype android app with data in JSON included in apk. We showed it to prospective clients and landed project.

<comment><AUTHOR> Thanks for the comment. I try to make my proposals in detail - include designs of the app that we're going to build. I haven't tried the prototype approach - I might try it next time. Just to be clear, you develop the prototype for the client's app, right? You would need access to the client's APIs, etc. which you might not have in a sales phase. I think using mock data is another way around this,

Follow up question, when you develop this prototype - In cases where the app is not very big, doesn't the client think that almost 50% of the work is done and hence may try getting this done in cheap?

<comment><USER5> We hardcoded the data in the JSON. Just show the potential. They may not know the exact requirements for the app. Also showing running app in real phone opens lot of opportunities. My email is in profile. Ping me if you want to chat.

<comment><AUTHOR> Sure, but I didn't find your email id in your profile.

</comment></comment></comment></comment><comment><USER6> we are develop Androd app develop for grow your business [https://www.freelancer.in/u/phpMaestro.html](https://www.freelancer.in/u/phpMaestro.html)

</comment><comment><AUTHOR> Why doesn't anyone comment on my posts :(

<comment><USER7> Your previous two submissions probably weren't interesting enough—they read more like requests for favors. People come to HN to gratify their intellectual curiosity ([https://news.ycombinator.com/newsguidelines.html](https://news.ycombinator.com/newsguidelines.html)), so you need to offer them something in that spirit. This one does a much better job of that!

<comment><AUTHOR> Thanks dang for commenting. I would like to see my past contributions - <USER2> there a way to see them? I can't seem to find that option.

<comment><USER7> See the links at the bottom of your profile page: [https://news.ycombinator.com/user?id=npankaj](https://news.ycombinator.com/user?id=npankaj).

<comment><AUTHOR> Thank you, I got it!</comment></comment></comment></comment></comment>


Beware Keyloggers at Hotel Business Centers - <AUTHOR> http://krebsonsecurity.com/2014/07/beware-keyloggers-at-hotel-business-centers/ <comment><USER2> Assume that all computers that aren't yours are keylogged. When I _must_ enter a password into an untrusted machine, I use the mouse to help me. My passwords are long non-words that I know well so I type part of the password, mouse to a different location, type some more, mouse some more, etc. _(1)_ This should defeat key loggers and screen picture captures (if the password is starred) but still wouldn't defeat an out and out video of my session combined with keylogging. I figure that last scenario is a whole lot more rare.

 _1) My usual technique is to type the last three chars, mouse to the beginning of the field, type the next to last 3, mouse to the beginning, next 3 repeat till done._

<comment><USER3> While defense in depth is never wrong, please be aware that even moderately advanced trojans will simply capture the contents of any form fields in most browsers. Neither your "skipping" technique, nor (partially) using an on- screen-keyboard will help against that.

Using a second factor for authentication provides some extra security, but a well-configured trojan might intercept your logout request, display a fake logout confirmation and store your session data for their botmaster to peruse.

If you need to regularly use untrusted machines (and have access to usb ports or a cd drive), you could bring a hardened browser with you. That should defeat most "Man-in-the-Browser" tricks. Or, even better, a live CD or USB drive. At this point, you should still assume your keyboard and screen to be compromised, but the OS should be safe enough to cautiously use.

<comment><USER4> In this scenario, if I login to my own server, if I control the login on the remote end, I set it up to support one time passwords. It would be nice if this would be something that can be set up by default for credentials.

Maybe this should be a feature request to the web-app devs.?

<comment><USER5> 2FA with one-time codes is basically a one-time credential.

Use this site to support web apps with 2FA, or request 2FA for unsupported sites: [http://twofactorauth.org/](http://twofactorauth.org/)

</comment></comment></comment></comment><comment><USER6> This is news? For grins and giggles I booted a liveimage of the norton recovery / scan tool on a hotel business center machine and the thing had viruses that had been detected and cleared 6 years earlier. Not to mention it was running XP and that version of XP wasn't patched at all (there was a service that was blocking windows update, the PC couldn't actually get to the Microsoft IP addresses) I pointed it out to the management, got yelled at for booting a different OS, and a surly 'promise' to have their 'IT guy' look at it.

I've also found machines at VRBO rentals that were compromised. So far I've not found any that had their wireless routers replaced with MiTM routers but I expect that isn't too far down the road.

</comment><comment><USER7> Beware, also, of public WiFis. Even the ones that are not open. Beware, actually, of connecting to any network where you don't know all of the devices you can communicate with directly. Ancient attacks such as ARP or DNS spoofing still work, by and large. It's surprising how few people are actually aware of them.

</comment><comment><USER8> How is that even remotely a surprise?

You should assume any computer you don't own is keylogged, period.

<comment><USER9> That's good advice.

However, as "Who is surprised!" has become a standard meme in security/privacy related threads, I want to point out a few things that may be interesting:

\- the actual extend of the threat (numbers?)

\- the extend to which the general public has come to terms with this problem

\- the reactions around the web and proposed solutions ("use this kiosk linux distro")

\- discussion of similar/related threats (like "also watch for public wifi")

<comment><USER10> Extent: [https://www.google.co.in/search?q=define%3AExtent](https://www.google.co.in/search?q=define%3AExtent)

Extend: [https://www.google.co.in/search?q=define%3AExtend](https://www.google.co.in/search?q=define%3AExtend)

They are not the same.

<comment><USER10> Why the downvotes? Do you disagree?

<comment><USER11> Probably because carping about word choice diverts the conversation, with no benefit in this case because the meaning was clear. Please stop.

</comment></comment></comment></comment></comment><comment><USER5> Note that a keylogger is a completely different threat than modern identity- theft malware.

A keylogger just "logs" keystrokes, either locally or remotely, for later use. While this is a valid threat, using two-factor authentication basically makes this a non-issue. On the other hand, malware that targets specific login fields is usually smart enough to also steal session cookies, or with most banking trojans, inject requests into your live browser session.

The latter is used to literally transfer money in/out of your account, or make automatic purchases, _while you browse the web_. There is no protection from these trojans. If you're infected, you're fucked. The only thing 2FA saves you from here is repeated attacks once your session expires. (Luckily i've never personally seen a trojan like this built for Linux, but that's just a matter of time/market share)

<comment><USER12> Great summary of the current state of malware.

I am starting to think that security people should stop using the term "keylogger" altogether. It is unhelpful, and damn right dangerous.

When people read "keylogger" they often envision malware which sits there and grabs your keystrokes, so then people assume (see posts elsewhere in this HN thread even) that using on-screen keyboards or jumping back and forth between fields saves them.

Classical literal "keyloggers" are now mostly gone. Grabbing a long series of keystrokes is extremely hard to automatically utilise (which is the goal now). Instead malware will either inject itself into the TCP/IP stack, HTTP stack, or directly into the browser (most popular) itself to steal credentials after the form is submitted but before it is encrypted and sent over the network.

The advantage to the "bad guys" of doing things this way is that they get contextual information (e.g. form name, form destination URL, as well as username/password). Once you have login information AND contextual information you can automate it entirely and ignore a lot of stuff you aren't interested in (e.g. steal Google accounts, but ignore Hacker News accounts).

Other than spouses spying on one another or a parent spying on their kid, a "keylogger" is pretty much dead in the classical sense. No organise crime gang wants a few gigabytes of keystrokes they have to sort through in order to get to the good stuff.

</comment></comment><comment><USER13> I can't wait for Steve Gibon's SQRL [0] to take off... Would hinder keyloggers useless.

[0] [https://www.grc.com/sqrl/sqrl.htm](https://www.grc.com/sqrl/sqrl.htm)

<comment><USER14> [http://security.blogoverflow.com/2013/10/debunking- sqrl/](http://security.blogoverflow.com/2013/10/debunking-sqrl/)

Sqrl looks to have some pretty bad flaws.

<comment><USER15> That may be the most convicing bit in this article : [http://attrition.org/errata/charlatan/steve_gibson/](http://attrition.org/errata/charlatan/steve_gibson/)

</comment></comment></comment><comment><USER16> Since people are mentioning their workarounds, I will share mine.

I often have to print something from my email from untrusted computer (boarding pass, some documents, etc). When it's possible, I save the thing to print to PDF, upload to S3 and make a memorable short URL using bit.ly. Whenever possible, works very smoothly :)

<comment><USER17> If you're using gmail / google drive, a good option is to make the google drive file public and use goo.gl (or bit.ly) to shorten it!

The added benefit is that you can do this from mobile, which may not be possible with S3!

</comment></comment><comment><USER18> To add to the collection of work-arounds posted here, most hotels seem to have reasonably modern/common printers. Often, they are connected to the untrustworthy hotel PC by a USB cable. It seems faster to unplug the printer from the hotel PC and install drivers on one's own laptop than it is to figure out how to gain access to the hotel's crappy computer. Hotel printers connected to hotel computers via ethernet/WiFi also likely have working USB ports, so one simply could bring his own cable with a "B" plug. I'm sure there are ways a malicious person could install rogue printer firmware, etc., the likelihood of such threats existing in the wild is 1/1000th that of the sum total likelihood of evil existing on hotel PCs.

I suppose the relevance of my entire comment hinges on the presumption that anyone reading HN only uses hotel PCs for printing stuff. Valid?

</comment><comment><USER19> It is very hateful for the hackers to put keylogger on the hotel PCs. However, there are some real and legal keyloggers and you have to pay for them. I have used Micro keylogger. Before I bought it, I had compared many keyloggers. Except for slight differences, many of them work the same way. However, Micro keylogger is the cheapest as well as the most full-featured. After having tried the free trial of kinds of keyloggers, I chose Micro keylogger. It is really a good choice at present. [http://download.cnet.com/Micro- Keylogger/3000-2162_4-7537529...](http://download.cnet.com/Micro- Keylogger/3000-2162_4-75375292.html)

</comment><comment><USER20> Related story: When I was in high school the library computers had a filtering firewall that blocked a lot of useful content. If you needed access you'd have to ask someone with the password to turn it off for your computer. That was annoying so we installed key loggers to get the password for ourselves. One of my friends ended up buying a hardware key logger that was even easier than trying to bypass the install protection software they used. Sometimes we'd leave the logger on all day just to see what we'd get. There were lots of email and AIM logins.

</comment><comment><USER21> Also beware of hotel wifi's. I have been on some where everyone is on the same subnet and tons of people have file sharing enabled.

<comment><USER22> Even with client isolation, if you're on wireless, everyone is on the same 'subnet'.

<comment><USER23> That doesn't have to be true. Many good systems support VLANs and subnets (OpenVPN style) per client, though you'll rarely encounter networks like this.

</comment></comment></comment><comment><USER24> I'd also like to chip in here and say keep an eye out for loan laptops. My HDD broke down and I received a loan laptop while they fix my one.

While installing Go, I found Prey Anti-Theft on my HDD. Nice little bit of camera snapping, location and such. Was never told about it, which also annoyed me.

In short, if it's not your machine, assume it's compromised. LiveUSB's FTW.

</comment><comment><USER25> If you're worried about keyloggers, you should also be concerned with other types of spoofing, even on machines you control (by software you do not).

If you're building a website, you can help mitigate keyloggers with One Time Password support, eg login via cellphone app (which doesn't have to have a signal but can store a million random codes a la the RSA dongle) unless that's somehow patented - is it?

But fake auth forms are equally egregious. For this, you simply need the user to enter (or receive) a relatively unique (1 in 10,000) phrase or icon that they remember when signing up. Then show this phrase when one of your input fields in your domain security context (iframe or popup) is focused. There is no way for other websites to grab that phrase or icon, and therefore the user is trained to check that YOUR field on YOUR domain is the one receiving keyboard focus.

I once wrotr a letter to Steve Jobs saying the iOS should also have something similar - that the system dialogs where you enter your admin username and password to authorize something should show you a familiar phrase or icon which userland apps can't screenshot, similar to how they protect copyrighted video. But he never replied or implemented it.

After all, Vista did it by darkening the screen... Any app can do that!

</comment><comment><USER26> In response to the hardware keylogger comments. Aren't those fairly expensive? I can't imagine they would be used very often except in targeted attacks against specific computers.

<comment><USER27> There are devices that sell for less than $50 and could be programmed for, when plugged in a computer take controll of it and log whatever you want.

Specialized keyloggers ought to be cheaper.

</comment></comment><comment><USER14> OP makes no mention of hardware keyloggers. These are cheap and easy to use - requiring a few seconds access to install and a few more to retrieve.

Keyloq make a range of products.

</comment><comment><USER28> Well.... duh.

Any computers that allow access to the public are going to be keylogged, if not with software then with physical keyloggers.

Same as LAN Centers use to be all keylogged as well.

<comment><USER29> Why should that be a given? Why can't people just stop being jerks?

<comment><USER30> > Why can't people just stop being jerks?

While that's a noble question, you might as well ask why can't the universe simply not advance to its entropic heat death... or why cars and homes are still sold with locks on the doors.

</comment></comment></comment><comment><USER31> Not just business centers. Pretty much any public access point/terminal. Especially when traveling abroad.

</comment><comment><USER32> This is what happens when you don't have real competition in the operating system market. Shameful.

<comment><USER33> I could easily install a keylogger on any non-Windows machine in about five seconds. Hint: keyboards and USB are pretty much OS-agnostic.

</comment></comment><comment><USER34> Windows has a Guest account that automatically resets the profile when logging off, erasing any software keyloggers etc. Likewise you can look at processes using Task Manager or Process Explorer.

<comment><USER14> That does nothing against hardware keyloggers.

Exploring process names is sub-optimal on modern OSes.

<comment><USER34> I know that these does nothing against hardware ones.</comment></comment></comment>


What's more important: Form or Function? - <AUTHOR>

Recent news surrounding popular blogging platforms has focused on their ability to help users "design" their blogs. And it made me wonder, how much will the availability of themes influence the choice of which platform to use? Is it one of the first things you look at, or do you look into designs only after finding all the other features you want?
Below is an assortment of theme selection pages for various platforms.
TypePad: http://www.typepad.com/go/design-assistant/
Movable Type: www.movabletype.org/design/assistant/
b2Evolution: http://skins.b2evolution.net/
WikyBlog: http://www.wikyblog.com/Special/Main/Templates <comment><USER2> Is that an exclusive or?</comment>


The React Bootcamp – Become a Professional React Developer - <AUTHOR> https://scrimba.com/g/greact <comment><USER2> Just enrolled in! I appreciate Bob for a great job while working on this ReactJS course.</comment>


OC Help us make Relax the best open source CMS for everyone by being our patreon - <AUTHOR> https://www.patreon.com/relax <comment><AUTHOR> Hello all!

I'm Bruno Mota the creator of Relax CMS and I need your help to take the project to bigger grounds. If you don't know Relax, it is a CMS built with the latest technologies that enable a complete visual way of creating a website and its respective content types.

I've worked on Relax for over 6 months full time, but got to a state where I needed to get a part time job to basically live, which slowed down its development speed. With your contributions I'd be able to get back to it full time and even hire more people to help with the project.

Relax has not been released yet, but the beta should be done in around 2 months.

You can check Relax GitHub repo here: [https://github.com/relax/relax](https://github.com/relax/relax)

And check Relax's staging deployment (unstable) here: [http://staging.getrelax.io/admin](http://staging.getrelax.io/admin)

Also I'm always seeking for feedback and people interested in talking/contributing to the project, join us on Relax's slack [http://slack- relax.herokuapp.com/](http://slack-relax.herokuapp.com/)

Feel free to leave your opinions here as well :)

Cheers!

<comment><AUTHOR> Credentials for the demo are:

user: demo

pass: demo</comment></comment>


Green Lights Forever: Analyzing Security of Traffic Infrastructure (2014) [pdf] - <AUTHOR> https://www.usenix.org/system/files/conference/woot14/woot14-ghena.pdf <comment><USER2> I've said it for years. If there were any technology that needed to be radically upgraded, it would be traffic lights. We are still using technology from over 60 years ago and it simple is one of those hidden, never to be thought about dream upgrades. Can you imagine the significant differences life would be made with the updates and upgrades to traffic lights could be made?</comment>


Ask HN: What's wrong with Safari? - <AUTHOR> I'm hoping to quit Chrome in the next couple of months and migrate to Firefox or Safari. Is there any reason not to move to Safari? <comment><USER2> I've found Safari to have masssive start time (time from open app to home screen shows up). This seems to be related to extensions. I only use a few extensions, but I found myself waiting for several seconds for my very simple, locally hosted, homepage to load. During this time I got the spinning mouse wheel in Safari. After disabling extensions it was better, but I'd rather not disable extensions.

</comment><comment><USER3> Best alternative options: 1) Brave: [https://brave.com/](https://brave.com/) 2) Firefox: [https://www.mozilla.org/en- US/firefox/channel/desktop/](https://www.mozilla.org/en- US/firefox/channel/desktop/)

</comment><comment><USER4> I actually use Webkit Technology Preview, which you can find on the app store - it's pretty much Safari but with some extra goodies, and I find it comparable to Chrome in a lot of ways. Would recommend.

Safari = my personal browsing Firefox = a lot of work stuff

<comment><AUTHOR> I've used Webkit Tech Preview before, but had some bugs a year or two ago. I'm trying it again after your suggestion.

</comment></comment><comment><USER5> If you don't use browser extensions, it may be a good choice. Most power users I know avoid it because its customizability is poor.

It's not a bad little browser. I often use it for sites that perform poorly in Firefox.</comment>


Atlassian - helping large companies compete with open source - <AUTHOR> http://hoisie.com/post/atlassian__the_next_billion_dollar_software_company

<comment><USER2> "Atlassian is changing the game. They [big companies] can just acquire all the benefits of open source, the community collaboration and transparency, by using Atlassian."

The whole article can be summarized by the above quote. Is this guy on Atlassian's payroll?</comment>


Venture capital goes short-term - <AUTHOR> http://www.nytimes.com/2009/01/05/technology/start-ups/05venture.html?_r=1

<comment><USER2> "Cisco was founded two weeks before a stock market crash. Oracle was founded during the Reagan recession," Mr. Holland said. "In bad times, that's when the best opportunities come up."

<comment><USER3> most successes have a back story. Its my understanding that oracle's first customer was the CIA. It doesn't matter if there is a recession if your client is the government. It probably helps.

</comment></comment><comment><USER4> "'Big-ticket enterprise ideas that take $50 million to $100 million to get to market are going to be few and far between,' said Dana Stalder, a general partner at Matrix Partners."

Is it just me, or did they mislabel the section "Enterprise is Back"?

<comment><AUTHOR> I was puzzled by that heading as well.</comment></comment>