CIRCLE WITH A DOT

@arstechnica will it also get better at not replacing the working drivers with outdated buggy drivers

@EregLoch If you have an actual counterargument (i.e. not another non sequitur) then now is the time to present it

@EregLoch @aral seems i need to make my argument explicit as youve clearly misunderstood

We know that the client is not guaranteed to be trustworthy from the perspective of the server. We assume that the identity verification is done on the client only as stated. Per this assumption that means that the result of the verification is sent back as some form of yes/no (coupled with a name to be matched on the server, in case of success) or similar, without any other data that would allow the verification to be repeated on the server being sent back. As the client may be untrustworthy, it may manipulate the verification process or just send back modified data from a recorded successful verification with the attackers preferred values. Therefore, we can conclude that it is trivially possible to create fake accounts unless the assumption is false.

Whether or not the server is trustworthy is irrelevant to this attack.

@EregLoch @aral this is of course assuming they arent just lying and doing the verification remotely anyway

@EregLoch @aral @lain@lain.com if the verification is entirely on-device then it is likely trivial to spoof with some work in ghidra.

rule 1 of computer security: the client is untrustworthy

@deviantollam my main advice for getting a TV is to get an old panel second-hand, ideally from family or friends who recently "upgraded". Smart TVs and those stick-type devices that go in a HDMI port and provide a smart tv interface on a generic display are a pain to deal with in my experience, filled with ads, input latency of like half a second, etc etc.

My family has my grandparents old TV and it works nearly flawlessly, even if the size and picture quality leave something to be desired. Its some panasonic LCD panel that they had for years. We mainly use it with a fire tv stick since our tv antenna got dislodged in a storm years back and nobody has been bothered to fix it, although when I use it I am generally plugging something else in (as mentioned above, ads and massive input latency are not things i am fond of).

Alternatively, I think you can get TV tuner cards that connect to a PC (via pcie or usb or whatever depending on the model) that take coax and contain radio hardware that can be controlled via the computer (either an actual tv tuner that has channel selection controlled by the computer, or a full-blown software defined radio). Im pretty sure VLC has an option to take input from these under media -> open capture device. You can then use this with a standard computer monitor which lacks all that crap at the cost of a small size (although better resolution than those old panels) and (almost always) having to physically get up to hit the power button (i have seen some computer monitors on pcpartpicker that advertise having remote controls, alternatively you could rig up a microcontroller with some servos, plus a relay to connect in parallel with the computers power button pins on the motherboard so you can do that too, plus an ir detector and any disused ir remote with a reasonable button layout. some microcontrollers can even act as a usb keyboard and mouse for controlling the computer itself, or you can get a cheap wireless mini keyboard + trackpad).

@deviantollam its a hacked website. thats a fairly common malware tactic

@deviantollam im pretty sure theres also an option in the general android app settings to disable opening supported links in an app, which would probably also work here for preventing the share.google links from opening within google to begin with (although google would still be able to track you with them)

@SuperDicq quick question: do you know if this includes the apk distributed on their website? i know it complains about lack of google play services but is that just a hardcoded thing on that build or does it actually have google play services (i assume its probably the latter)