Hacker Factor / is on Nostr

I'm Neal Krawetz, a computer security specialist and forensic researcher. I run FotoForensics, Hintfo, and RootAbout. Sleep is not necessary.

Website: https://hackerfactor.com/?social=noc.social
Blog: https://hackerfactor.com/blog/
FotoForensics: https://fotoforensics.com/
Hintfo: https://hintfo.com/

Last Notes

2024-09-03 19:12:54

I keep hearing about AI being used to replace artists, writers, creators, editors, fact checkers, accountants, etc. How soon before AI replaces CEOs and other executives?

2024-08-30 02:44:58

- reply

Amazing how apt everything she says still is. And, OMG, she's incredibly funny!

2024-08-28 19:47:37

- reply

I had a manager tell me that my cubicle pranks were getting out of hand. People were afraid to take time off because they didn't know what they would come back to. (Imagine 100+ people in a department, and nobody taking time off.) 🤣

2024-08-27 22:53:31

Many years ago, I worked in a cubicle farm. We'd do pranks when people took time off. For one of my coworkers, I had the department fill his cubicle with pink and blue balloons, some said "It's a boy!" or "It's a girl!"
One coworker remarked: "I didn't know he was taking time off for a new child!" My reply: "Child? He's not even seeing anyone as far as I know! He's just on vacation." This is "2 gross bags" of balloons (almost 300).
https://noc.social/system/media_attachments/files/113/036/433/161/209/807/original/ebc430c7d70a4c27.jpeg

2024-08-25 23:27:14

- reply

The EU law you cited has the same problem. It defines the scope of the problem and what is forbidden (good). But never uses the word "CSAM" (or spelled out). So if the warrant required CSAM, then CSAM is not defined and the request can be ignored.

2024-08-25 13:48:54

- reply

Not trying to defend Telegram.
While "CSAM" is the preferred term these days, it is not well-defined and not in any legal statute. CSAM includes some content that may be disgusting, but is not illegal. The only legal definitions in federal law are in 18 USC 2251, 2251a, 2252, 2252a, 2252b, and 2260. None of these laws mention "CSAM".

2024-08-25 02:51:55

Oh no! One of my RAID hard drives just got 4 bad sectors. (Sudden bad sectors usually means the drive is dying.) How long has this drive been in continuous use? 13 years.

2024-08-25 01:19:50

- reply

"Greatest Hits from 1720" -- the entire album.

2024-08-23 18:50:22

The Hacker Factor Blog: Game of Life https://www.hackerfactor.com/blog/index.php?/archives/1041-Game-of-Life.html

2024-08-19 12:18:08

LinkedIn "download all of my information" doesn't download any of the media you have posted.

2024-08-09 16:17:38

- reply

I just posed a new blog entry showing how CBC/Radio-Canada's C2PA example fails to authenticate. Can you explain to me how CBC's example does NOT show a fundamental failure with C2PA?
https://www.hackerfactor.com/blog/index.php?/archives/1040-C2PA-and-the-CBC.html

2024-08-08 15:26:01

- reply

If you're going to be validating the authenticity using something other than C2PA, then why use C2PA?
C2PA is no more reliable than an EXIF comment or XMP text field containing the name and attribution. C2PA is added complexity for no added value. It keeps honest people honest, but does nothing to deter dishonest people.

2024-08-07 23:28:16

- reply

Or worse:
1. You think you trust Nadia.
2. Malory takes a Nadia photo and backdates it, claiming that Nadia plagiarized it.
Provide it wasn't plagiarized since both signatures are valid.

2024-08-07 23:24:58

- reply

1. Malory hates Nadia and buys a C2PA-equipped camera.
2. Malory sets it to claim to be Nadia and takes a photo.
3. Malory sends the fake Nadia photo to you (maybe even impersonating Nadia's email) and says that Nadia got a new camera.

2024-08-05 17:19:44

- reply

Oh, and a specific attack against your scenario? Sure!
https://hackerfactor.com/blog/index.php?/archives/1037-C2PA-and-Untrusted-Certificates.html. Scroll down to the section "See One, Do One, Teach One". There's an example that does it.

2024-08-05 01:26:49

- reply

Reading over your 2023 write-up, it definitely sounds like you've been drinking the Kool-Aid. You wrote that you're not a crypto expert. Here's a surprise for you: neither are the people who created C2PA. (If they were, then they wouldn't be trying to bypass the crypto security by using X.509 certs wrong, ignoring expiration dates, issuing their own root certs, etc.) They don't follow the X.509 standard and they don't follow industry best practices.

2024-08-05 01:17:25

- reply

You can disagree, but then how do you account for working examples of forgeries using tools provided by C2PA members? (I don't just say there are problems; I demonstrate the problems.)
Creating a forged signing certificates: https://www.hackerfactor.com/blog/index.php?/archives/1037-C2PA-and-Untrusted-Certificates.html
Altering "cryptographically signed" timestamps with nothing more than hexedit: https://www.hackerfactor.com/blog/index.php?/archives/1031-C2PA-from-the-Attackers-Perspective.html
And a long list of other vulnerabilities: https://www.hackerfactor.com/blog/index.php?/archives/1010-C2PAs-Butterfly-Effect.html
In my opinion, C2PA is nothing more than snake oil.

2024-04-28 14:07:03

- reply

[@BeAware](https://social.beaware.live/@BeAware)
If you don't like how your mastodon admin manages the system, then you can always switch to a different mastodon service operated by a better admin. (There's a simple "click to move" button.) Or you can run your own and be your own admin.
In contrast, if you don't like the TikTok admin (and their ties to China's government), well, suck it up. And if you want to use Twitter/X, then you must accept Musk and his spontaneous mood swings.