Hacker News .hnnew | past | comments | ask | show | jobs | submit | daemonize's commentslogin

Similar approach taken for Amazon's Echo Dot exposing parts of setup process and some broken parts: https://medium.com/@dweinstein/amazon-echo-dot-explorations-...


Check out Frida (iOS and Android) http://www.frida.re/


Not to mention that one can tether via Bluetooth or USB in addition to WiFi hotspot. How are they to distinguish between someone using their hotspot via either of those two transports? I don't see them having a technical means that could distinguish someone USB tethered to cell phone using its data plan from just a cell phone using LTE data.


I recommend highland.js for node http://highlandjs.org


Even in a multiple-thread scenario?


As an aside, one of the really interesting ideas that's bubbling up from Rust is that it's not mutable state that's a problem, it's shared mutable state, and that you can make it safe by removing the sharing, rather than removing the mutability:

http://smallcultfollowing.com/babysteps/blog/2014/05/13/focu...

I have no idea if this is true, but it's going to be really interesting to see that idea tried.


If it doesn't leak out of the function (though a closure or a pointer), how can another thread see it? It's only on one stack.


Don't worry, each vendor will have an opportunity to screw up SE for Android policy. Additionally, many kernel flaws will be possible to use for disabling these mechanisms to once again get privilege sufficient to write to /system if needed.


I believe banks would be better served sending emails with links that open their mobile app instead of popping up a web browser.


Good luck groking that mess.


Banging on file descriptors looks pretty much the same no matter what language you do it in. I expect that a Python equivalent would be pretty much the same length.


It's hard to grok low-level code like this in any language. I'd take common lisp over heavily-templated C++ or freestyle Perl any day.


Not if the private key is stored in a secure hardware token.


Would you be willing to bet $147M that someone hadn't figured out a way around that hardware security? I wouldn't..


Can you tell the difference between a secure hardware token and a fake secure hardware token?

I suppose if you try to extract the secret key and the token destroys it, it's pretty secure. Of course, you just lost all your money. I can't think of a non-destructive test.


How does the key get into the token, and how do you know there wasn't a copy made before that?


For example Trezor hardware wallet ( http://www.bitcointrezor.com/ ) generates its private key when it is first initialized. This way, the key never exists outside of the wallet.


Not sure that solves he upthread probem. If I give you a Treznor hardware wallet containing a private key to $150million worth of bitcoins - would you trust me not to have anther copy of that key? Or would you transfer them immediately to a wallet with a private key I could never possibly have known?


Trezor supports exporting the key for backup purposes.


SIM card f.ex.


sounds like some bullshit to me... "we got hacked because we don't use our own shitty software." Security is a tough business. Just look @ hbgary.


Consider applying for YC's Summer 2026 batch! Applications are open till May 4

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: