Hacker Newsnew | past | comments | ask | show | jobs | submit | Urd-'s commentslogin

How do you access the phishing site when your computer is locked?


On your phone


Use password manager on your phone?


I don't store my passwords on the phone. Phones are fundamentally less secure than desktop, which can use strong virtualization [0] for security.

[0] My daily driver OS is https://qubes-os.org


Not much harder. The state of the art of phishing right now is proxy based setups like evilginx which pass along credentials in real time. Then you just save the session cookie or change/add the 2fa mechanisms so you can get in whenever you want with the stolen credentials.


>Unlawful presence on US soil is a civil offense. It's literally the same class of offense as a parking ticket.

Overstaying a visa is a civil offense, 'improper entry' e.g. jumping the border is criminal.


Yes. Jumping the border is a misdemeanor if you don't immediately self report to request asylum.

But the majority of people getting rounded up right now are for unlawful presence.

And a lot of them have no idea that their presence was marked unlawful until ICE gets them. There's a reason civil offenses are supposed to be handled with proper notification and court summonses instead of this shit.


Because a crazed gunman will (A) go through the scanner and (B) will not open fire when their weapon is detected.


Gun and weapon detection is still useful to stop shootings and stabbings that arise out of fights, where one member may suddenly present and use a previously concealed weapon.

Agreed that the usefulness against a crazed gunman is less clear, although crazies do not always have a rational plan. If the weapon was concealed in a backpack or something the security may be able to tackle them before they access it. If they’re carrying it in an easily accessible, concealed holster, that’s less effective and they might be able to draw and use it after being detected.


> Gun and weapon detection is still useful to stop shootings and stabbings that arise out of fights, where one member may suddenly present and use a previously concealed weapon.

Which might be a reasonable thing to aim for? It was mentioned up thread there's >100 school shootings/yr. The vast, vast majority (>>90%) of those are not the "crazy person randomly shoots up school" type, but rather the "two people in a fight / two groups in a fight / targeted revenge on single person".

The former is tracked as an active shooting incident, by the FBI. In 2023 there were 3 such incidents: https://www.fbi.gov/file-repository/2023-active-shooter-repo... (10 year average is a bit higher).

Of course the downside with the latter is that simply weapons checking at the school won't stop it from happening right before / after school, or otherwise outside of school.


I'm still sad about having so many scanners preventing things like pocketknives in public spaces though. I generally carry a pocketknife with me everywhere I go, and there have been a number of times where I just haven't even thought about the fact it's on me when I end up going to a sporting event. They're pretty useful things; I probably use mine a few times a day.

Luckily some venues are nice about checking it with security, but still a pain to have to remember to go back and pick it up when leaving.

Wouldn't it be nice of people would just quit shooting and stabbing each other at things like sporting events :(


You can make the scanner a condition of entry. Disclose that it’s happening and it’s a deterrent. Better for crazy people to do crazy at the front door.


(C) crazed gunman neutralized by good guy with gun. In this case it was 3 minutes after the fact (Median Police Response Time to Active Shooter Attacks) rather than immediately as there were no available Good Guys with Guns due to gun policies.

I would never ever choose to be involved in an active shooter situation but if I were I’d surely want to be armed rather than not.


https://en.wikipedia.org/wiki/Uvalde_school_shooting#Timelin...

11:30am: First 911 call.

11:31am: Officer arrives at school.

One minute police response time, by your metric. ~80 minutes later, the ~400 very well armed cops on scene managed to finally go in.


Well the "good guy with a gun" argument presumes the good guy is willing to use his gun and probably risk his own life doing it. This would happen more easily if he's already inside and under direct threat by the bad guy(s).

A cop outside is not obligated or expected to put his own life at risk. He's expected to show up for work tomorrow.


Yup agree 100% with the first statement.

I do not agree with the second at all. Law Enforcement are both obligated and expected to put their own life at risk protecting the public. That said they are also expected to show up for work tomorrow! It’s a sad day when they don’t.


Ok, but in the US they are not obligated to do that. It's been put forth to the Supreme Court at least once.

A cop can be at the scene of you getting actively murdered and do nothing about it, and legally the cop is ok.

Morally, you could definitely argue they're not okay.


> Supreme Court

1981 Warren v. District of Columbia

2005 Castle Rock v. Gonzales


Yeah that was horrible and a bad day for everyone. I was referring to instances where LE does their job correctly.


How would they get the private key? Or would this CA only allow using certs with private keys they generated instead of using CSRs?


It would allow all EU governments to intercept everyone on the planet if that CA is root in every browser install.


There are industries where you have no choice but to use FIPS compliant crypto. Or do they just not get to have pure rust crypto?


>Then fraudsters would have to buy additional devices

Which a lot of them already do: https://www.youtube.com/watch?v=hsCJU9djdIc

Or just use a botnet to steal use of someone else's hardware, which is also very common for malicious bots.


Even less so since this is a proposal for a javascript api.


>It'll end DDOS by botnet.

Not even remotely. This proposal is adding this attestation to one of the last network layers, most DDOS methods won't be touched by this.


It will help a lot of services like Cloudflare, basically stopping most of spamming/ddos on sites behind it. Big cloud vendors will probably implement similar solutions in which you will be able to only allow attested traffic to your site.


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: