Hacker News new | past | comments | ask | show | jobs | submit | HackinOut's comments login

I wouldn't use a password manager system that doesn't have the ability to change the master password.

EDIT: You can't change any password really, without changing all of them (or having a separate master password). Seems unpractical as soon as, for example, site X gets its database hacked.



That is either by using the "connected version" or loosing the multi devices ability. BTW shouldn't the "connected version" be the one detailed on the home page? Sure sounds more attractive to me.


Or you have to remember the counter. Since most people just append a counter to their password for those sites that force them to change regularly, it's not really that different. :)


I can't believe Nigel Farage and a lot of pro Brexit campaigners have been calling it UK's "Independence day". Apart from being a very bad (purposeful?) analogy, it's seems to me pretty disrespectful to their own and to US history. I'm not from USA (or UK) but would love to hear how US and UK people feel about it?


Many countries have am independence day, not just America. Granted most are celebrating independence from us brits through.


"Independence day" is not exclusive to the US.


The film with the aliens and Jeff Goldblum made that particularly clear.


>I'm not from USA (or UK) but would love to hear how US and UK people feel about it?

I think it sounds like populist grandstanding. We've been hearing that sort of thing for a year now. We (the US) seem to have a lot of people buying into it though. We get to see first hand how stepping back from globalization looks like before we vote for it ourselves come November.


It doesn't seems to be iOS 8 only. Recent versions of iOS 7 seem to be fixed as well. (Tested my phone earlier this week)


How long did you test? I'd recommend sniffing for at least a few hours.


My iPhone do connect auto-magically to FreeWifi_secure networks which is the preloaded SSID for the other french operator listed by Skycure.

However it's supposed to connect with EAP-SIM [1]. Skycure mentions that "some of [those] bundles include SSID passwords". Do they mean that only those would make devices vulnerable? Could you let us know if SFR uses EAP-SIM or a basic PSK?

It could be that iPhones connect automatically only to EAP-SIM preloaded networks.

[1] https://mobile.free.fr/assistance/262.html


> (because iOS devices broadcast this when scanning for networks IIRC?)

Not anymore, Apple fixed that in recent iOS versions. Probe requests are not divulging SSIDs anymore. However WifiGate uses common SSIDs and network operators preloaded ones as honeypots.


Seems that wasn't fixed reliably. Still seeing lots of probe requests. Is there a https://support.apple.com/HT... talking about it?


Not aware of anything from Apple about this issue. It was just an assumption, sorry. What I did is test up to date devices (i think i even tested an up to date iOS 6) and couldn't get any specific SSID. The probe requests were still there, but SSID parameter was always set to Broadcast.

However I did see a lots of probe requests WITH a SSID parameter set but those were not coming from my devices :). I assumed they were not up to date.

I am very interested to know if the probe requests you're seeing are also coming from unknown devices: if they aren't, could you provide us with the iOS version you're using/testing with?


The devices I know are several iPhones 6/6+ running iOS 8.3.


Good point for Apple. But I wouldn't call having your computer fixed 4 times in ~2 months lucky... Every brand seems to be having reliability problems with their products nowadays (in software as well as hardware). More than in the past. Or maybe it's just me, unlucky as you are... I really have no idea what my next laptop will be...


Double standards are also seen in their "Removal Instructions" post on their forum. When uninstalling SuperFish, it seems suddenly important to remove the root certificate...

"It is very important to delete the certificate even though the application itself has been removed."

http://forums.lenovo.com/t5/Lenovo-P-Y-and-Z-series/Removal-...

Didn't seem that important earlier today: https://web.archive.org/web/20150219151726/http://forums.len...

"files in user directory will stay intact for the privacy reason. Registry entry and root certificate will remain as well. "


"We have thoroughly investigated this technology and do not find any evidence to substantiate security concerns."

http://forums.lenovo.com/t5/Lenovo-P-Y-and-Z-series/Removal-...

"This article will be updated with additional instructions on clean up of deactivated files and removal of certificate shortly."

This was just edited in, here is the post before that: https://web.archive.org/web/20150219151726/http://forums.len...

So, Lenovo, why should we remove this certificate after all? Any security concerns perhaps?


"This article will be updated with additional instructions on clean up of deactivated files and removal of certificate shortly."

This was just edited, here is the post before that: https://web.archive.org/web/20150219151726/http://forums.len...


Except if the adware just modify OS proxy settings, like madeofpalk mentioned. Firefox does not take those into account.


When taking Firefox into use, it imports the OS proxy settings, though. You get a warning but I guess about 99 % of people don't care about what that means.


Consider applying for YC's Spring batch! Applications are open till Feb 11.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: