eevBLAB 110 - Linus Tech Tips HACKED! - Page 1
Forum section: electronics / general

author: Ed.Kloonk
author_rank: Super Contributor
timestamp: March 24, 2023, 09:56:04 am
content: 2FA stuff and login timeouts aside, how come a nearly 20 year old platform doesn't support multi-user/shared access to accounts by now? Seems like a lot of effort has gone into making sure nobody can say anything mean in the comments or lest the creator themselves play more than 3 seconds of Start Me Up..This is why Tiktok is winning.

author: SiliconWizard
author_rank: Super Contributor
timestamp: March 24, 2023, 09:30:17 pm
content: Using hardware security keys has become a definite must these days.And don't use a phone app to replace a hardware security key. May be better than nothing, but there are security flaws all over the place with smartphones.Now of course, the more employees you have and the greater the risk. LTT is not your average YT channel, I think they have nearly 100 employees?

author: EEVblog
author_rank: Unknown
timestamp: March 24, 2023, 10:13:59 pm
content: Quote from: SiliconWizard on March 24, 2023, 09:30:17 pmFYI, this forum supports 2FA via Google Authenticator, which is very common with crypto exchanges and the like.For hardware keys I recommend the Yubikey

author: EEVblog
author_rank: Unknown
timestamp: March 24, 2023, 10:41:21 pm
content: Woah! Who knew this?

author: DavidAlfa
author_rank: Super Contributor
timestamp: March 25, 2023, 03:06:05 pm
content: I expected it to be another silly video about enabling the file extensions, wasn't expecting that at all!

author: SiliconWizard
author_rank: Super Contributor
timestamp: March 26, 2023, 05:22:03 am
content: https://xkcd.com/1137/Always scan files you receive by e-mail. Even if they look like PDF.

author: ataradov
author_rank: Super Contributor
timestamp: March 26, 2023, 06:27:36 am
content: Quote from: DavidAlfa on March 25, 2023, 03:06:05 pmThis LTR/RTL stuff was also successfully used to inject security holes in the source code that easily passes regular human review.With C and other older languages you need to be creative, but many modern languages accept Unicode in the main language part. There are lot of Unicode tricks work and can easily pass reviews.For code editors and review tools, display of hidden characters should be a standard feature.

author: SiliconWizard
author_rank: Super Contributor
timestamp: March 26, 2023, 08:26:19 pm
content: That's one of many reasons for being ultra-cautious before accepting Unicode in a programming language. It's fine in string literals, but I for one am not convinced for anything else.Of course you can always restrict Unicode support to avoid all these weird "characters", but I'm not so sure it's even possible, given the gigantic number of Unicode characters available.And of course same should be done for file names if possible.Anyway, "interesting" that Unicode be a potential source of security holes.And that said, the core point with session IDs is a freaking disaster. Good thing if it makes more people aware of that.Google is particularly bad with this actually (even if it's far from being the only one.)Take your Google accounts - you can stay connected to them almost indefinitely. On your mobile phone, it's always connected. You enter your account password ONCE when configuring your phone, and that's it. It never asks for it ever again. In a web browser with gmail, almost the same thing. I have a tab opened with one gmail account. It stays open almost all the time, and it almost never gets disconnected on its own. Sure that's convenient for users, but that's a disaster security-wise.

author: EEVblog
author_rank: Unknown
timestamp: March 26, 2023, 10:09:43 pm
content: Quote from: DavidAlfa on March 25, 2023, 03:06:05 pmme too. Totally wasn't expecting that, had no idea it was possible.

author: EEVblog
author_rank: Unknown
timestamp: March 26, 2023, 10:11:21 pm
content: Quote from: SiliconWizard on March 26, 2023, 05:22:03 amGmail always does that for me, and if it detects something sus then it doesn't import it just leaves it on my server and sends me an email. It's got a built in viewer for PDF too, so I don't need to open an external PDF viewer.

author: thm_w
author_rank: Super Contributor
timestamp: March 27, 2023, 09:16:15 pm
content: Quote from: EEVblog on March 26, 2023, 10:11:21 pmFrom the other thread, the fake pdf file was zero-padded to be 700MB. Which meant gmail did not scan it for viruses (100MB limit).

author: EEVblog
author_rank: Unknown
timestamp: March 27, 2023, 10:58:29 pm
content: Quote from: thm_w on March 27, 2023, 09:16:15 pmEven if it didn't scan it, would code actually be able to exectue using the internal gmail PDF viewer?

author: thm_w
author_rank: Super Contributor
timestamp: March 27, 2023, 11:12:59 pm
content: Quote from: EEVblog on March 27, 2023, 10:58:29 pmNo, it wouldn't execute using the internal PDF viewer.But it was also zipped. Gmail won't let me read the PDF if its in a zip file. It only lets me see the file names in the zip, and then download said zip file. Maybe there is a way around it but its not obvious."Hey heres our sponsor package, please see terms inside: sponsor_docs.zip" something like that.