> EV certs would still satisfy nonrepudiation, in a way. You'd have to be pretty bold to run a phishing site under a company registered in your targets' country under your legal name.
I don't think that would be the failure mode. It'd be a phishing site that uses a compromised EV cert issued for an obscure small bank in a far away country purporting to be a major brand bank in your own country, taking advantage of the asymmetry in cybersecurity budget between those two entities. Users would have to actually check the EV cert DN every time (unlikely so successful for a phisher then) or rely on things orthogonal to EV certs like pinning.
If we showed the EV cert DN in the the address bar next to the domain instead of hiding it in a place that takes two mouse clicks to reach we could expect at least a portion of victims to notice. I vaguely recall some browsers might have even been doing that once upon a time?
Additionally, the browser could show a warning if a ccTLD is served with an EV cert of an entity outside that country. Doesn't help the US because of the obscurity of .us, but useful for the rest of the world
> If we showed the EV cert DN in the the address bar next to the domain instead of hiding it in a place that takes two mouse clicks to reach we could expect at least a portion of victims to notice.
The article covers this. Apparently research demonstrated that the number of users who would notice is not significant.
> It'd be a phishing site that uses a compromised EV cert issued for an obscure small bank in a far away country purporting to be a major brand bank in your own country
EV certs when they were around showed a big green badge by the URL with the entity's legal name. Presumably this would work similarly, so you'd see ObscureBankInc and not Chase or Citi or whoever.
It'd probably make sense to add a flag indicator, or otherwise warn when the cert is from a country other than the users' own.
Fedora uses LUKS where your backup key can just be a regular passphrase. A key derivation function is used internally to help with mitigating brute force attacks.
> To your point, it was briefly possible to buy them for under $100 until word spread that they make decent steam machines, so I'm guessing that Sony doesn't need to sell any games to turn a profit.
I don't follow your logic. If the BC-250 was made from PS5 quality control failures, then why would their pricing have any bearing on the PS5's profitability, except as an effort to increase margins? Does cost not remain independent of pricing?
As far as I cam infer from what you said, it could be that the PS5 was sold at a loss and still is even with the BC-250 helping, or that it was sold at a profit and is still is with the BC-250 helping. What am I missing?
No it implies that å ps5 hardware wise wouldnt be ordets of magnitude of å bc250 to produce, and it therefore probably dosent have negative margins at least.
Exactly, that's what I was getting at. It's similar to Intel chip production and binning. Take Skylake for example: if a 4 core i7 chip had a core that didn't pass testing, they would disable the bad core and one more and process the chip as an i3. i5 chips were just i7 silicon with hyperthreading disabled. Same chip fab, same production cost, but the failed chips became a lower tier that sold for 35% and 70% of the top tier product. In the case of the PS5 chips, the performance difference between binned and pristine chips was even less, it still had 75% of the cores usable.
I always assumed that if I add other Google accounts to my Android phone then they'd be linked together, so I avoided doing it. It's a pain because Google apps require it. For example I can't join a Google Meet from my phone for this reason because I've always kept the Google account I use for email separate from the Google account I use for Android (and then K-9 Mail via IMAP to access it to avoid connecting them there).
Ironically this means that my experience with Google apps on my Android phone has always been poor but other vendors' stuff work fine. For example I use Fastmail for some key email addresses and this works well for me whereas I cannot use the Gmail app.
> Just bear in mind that if they don't like how often you return or the circumstances, they will issue you a sudden lifetime ban
I think that if I had to return frequently, I'd find a different vendor well before Amazon would decide they don't want me as a customer.
On the rare occasion I want a return, I've assumed that the reason they handle it without any issue is because they can see my lifetime purchase value vs. my return rate.
Maybe they don't care about my stats I guess but whichever way I'm currently happy in that regard.
I do worry that the competition is being wiped out, but I don't believe in boycotts for idealistic antitrust reasons.
> if the judge says that the transaction must be reversed, you get it reversed, even if that means delivering cash in briefcases or something like that
So if I pay cash for something, I can get it back if a judge orders the counterparty to do so.
Why is cryptocurrency not the same? Can I not go to a court and get an order, exactly the same?
Of course I may not know the counterparty's identity or they may be in a hostile jurisdiction, but how is that different to cash that has escaped my jurisdiction?
This may be a joke, but it's notable that the EU has the Cyber Resilience Act, which makes producing devices with this kind of lack of security illegal. Broadly speaking it takes effect from December 2027.
I work in embedded security. CRA and RED are game changers. We can argue this is years late but at least EU is giving security requirements teeth. Very expensive teeth.
I haven't seen US enterprise data teams sit up and do something as quickly as they did when GDPR rolled out very often. Regardless of other issues, the toothy part seems to work.
I don't think that would be the failure mode. It'd be a phishing site that uses a compromised EV cert issued for an obscure small bank in a far away country purporting to be a major brand bank in your own country, taking advantage of the asymmetry in cybersecurity budget between those two entities. Users would have to actually check the EV cert DN every time (unlikely so successful for a phisher then) or rely on things orthogonal to EV certs like pinning.
reply