• 8 Posts
  • 124 Comments
Joined 3 years ago
cake
Cake day: July 13th, 2023

help-circle















  • Banks love to reinvent the wheel and definitely can’t trust Google to be part of their workflow, as Google will 100% change UI or steps or rename the app or discontinue the app while replacing it with an identical one but with a different name but less features with no advance notice. Relying on Google for banking workflow means that one day the bank user support will be overwhelmed by requests like “the button disappeared, where is it now”

    For the rest of stuff, this system IMHO has too much friction, the bounce rate will be too high. Businesses won’t like to pay for a bot detection system (it costs $1 per 1000 verifications) that will push humans away while bots pass it without problems (either by using the accessibility workaround or by using those smartphone farms in southeast Asia)




  • Did they vibe coded the backend?

    An hacker can get:

    • GPS position
    • Email address
    • Video feed
    • WiFi password
    • Root access to a Linux client in the same WiFi network of the victim which means can change the DNS servers in the router for a mitm Attack if the default password hasn’t been changed (and nobody changes that)

    And they demonstrated to the journalist…

    1. Get a list of every “smart” lawnmower nearby a nuclear plant
    2. Check the emails of the owner in LinkedIn or something like that to see who could work at that nuclear plant
    3. Have access to his home network and a video feed on a robot that can be remotely moved to other position to check the perimeter

    Scary


  • This is awesome news for scammers:

    1. Fake page will say “you need to scan this qr code to verify you’re human”
    2. Users normally dismisses this shit, but it has become normal nowadays, take out the phone to scan it
    3. Qr code opens a page on totallynotascam.com that say “you need to install this totally safe APK on your device for verification 😉”
    4. APK passes the new useless developer “verification” as the scammer either used a hacked dev account or just paid $25 with a stolen id + stolen credit card
    5. User see the message “APK verified by Google play protect” and would totally believe the bullshit, giving all the possible permissions to the app