• 0 Posts
  • 313 Comments
Joined 2 years ago
cake
Cake day: June 19th, 2023

help-circle

  • It is impossible. CPV is only going to allow the attacker to know that the device is probably not located next to the VPN server. It can only prove a positive, not a negative.

    The second method you’re describing is only possible for people who control internet infrastructure and are able to infer correlations data going into your VPN server with data going out of your VPN server, which is both easier and more difficult than you’re suggesting. The attacker does not need to most of the internet routers because they only care about the data going into and out of the VPN server (it’s onion routing where the attacker needs to control many routers), but the attacker does need to have a powerful enough device to be inferring (hopefully) encrypted network flows on the public network to the packet sizes of encrypted VPN traffic for all of the traffic that is passing through that VPN server at the same time.


  • The latency to your VPN server is a constant added to the latency between your VPN server and whatever servers you are connected to. As long as the user’s VPN service doesn’t use different VPN servers for different destinations, it is impossible to determine the location of the user behind the VPN based on latency, and in general it is impossible to determine how far a user is from their VPN server because of varying latency introduced by the user’s own network or by bad infrastructure at the local ISP level. You can only know how far they aren’t based on the speed of light across the surface of the earth.

    But, without a VPN, this is a real attack that was proven by a high school student using some quirks of Discord CDNs. Even without using Discord’s CDNs, if somebody wanted to locate web visitors using this technique, they could just rent CDN resources like nearly every big company is doing. Of course, if you have the opportunity to pull this off, you normally have the user’s IP address and don’t care about inferring the location by latency. The reason why it was notable with Discord was because the attacker was not able to obtain the victim’s IP address.



  • It’s not just anti-LGBTQ+. This is going to be bad for everyone. We’re just years away from banks and insurance companies factoring in your social credit score based on your activity on sites where you had to verify you’re not a legally considered a child.

    You verify your age on Discord. Discord doxxes you through negligent handling of user data. Your account is found to be a member of a server that might suggest you are less responsible. Your rates are increased. Even if you know this is the reason, you cannot sue Discord because you were coerced into waiving your rights. The shareholders are happy because the line goes up. Is it already happening? I doubt any companies are rushing to tell us that they’re doing it, but the data is available to them.






  • It’s so user friendly. It tells you exactly what to do to solve the problem. Switch to a tty (if that even works on your system) and log in, type this long command from memory, making sure not to mistake those 0s for Os or the Unicode left single quote for back tick, restart your lockscreen, which of course you know how to do, and then come back. If that doesn’t work, start terminating some processes and praying.

    It says you can return using “ctrl+alt+F[N] where N is the tty number in the top left corner.” I can’t find my F0 key.



  • Some Unity games may be launched with a parameter that causes them to execute arbitrary code. It seems like it only makes sense on Android. Windows and Linux games can normally only be launched by a process with the same or greater privileges than the process being created, but on Android you can elevate privileges by invoking another app. In practical terms, another app can access the save data of your mobile games.

    There was also something about games that register to be launchable directly from a webpage, which would allow web sites to escape the browser sandbox, but it didn’t sound likely.