I want to believe yet NSA really does spy on everyone, "smart TVs" really do record everything you watch and facebook really does sell your data to the highest bidder(s).

As a technical matter when developers link to an SDK underlying support library would be capable of calling home to facebook injecting bullshit and or spying on the environment... it is possible to concurrently present an open interface while reeking of the consequences of selling out.

Laura, welcome to Slashdot. It is great to see such a positive outlook from a first time poster.

Sometimes it's better to pull early than live with the consequences.

The baseband processor is a fully self-contained system with its own processors, memory and operating system. While there are devices sharing system memory to reduce BOM you start by selecting hardware with physically separate resources.

Given a sane interface design the operating systems of baseband and smartphone have full control over what it does with data transmitted by each party. Sure a satanic baseband can exploit a weakness in the smartphone ... squarely the smartphones fault within the smartphones power to prevent.

Every time something new comes along which does not suck some rich asshole swoops in at the last minute and turns it all to total shit.

Can't wait for version 3 of the developer kit with "cloud" and "facebook" ads and stalking built in.

"WaffleMonster just got his head chopped off in a virtual guillotine"

"WaffleMonster rode the roller-coaster-of-terror and screamed like a little girl"

File -> Options -> Trust Center ... First thing any sane person should do after installing word is turn off all macros and activex/vba without notification.

As long as baseband has its own isolated memory and can't physically subvert the OS I can live with trusting the baseband as much as I trust the carriers. (e.g. not at all)

I don't get it. If you are going away from satellite the signal is red shifted. If you are going toward the signal is blue shifted.

Why would there be any change in observed shift if you are going away from geo stationary satellite to the north v away to the south? What explains preferential outcome?

I could understand subtle timing differences due to ionospheric delay or polarization measurements. Ideas?

Clients can ask user to provide a password to access/decrypt private key required to authenticate client to server. The "account" component is client identity (e.g. name of public key)

I've been pushing vendors for 10+ years for a usable solution and they don't seem to care.

All most people want is passwords without all the worry about brute force attacks. Users and Operators alike don't want to deal with certs at all ..there is no *good* reason they should have to.

You fight like Nali.

If you learn about acceptable behavior from online games or feel insulted by the gibberish spewed by random teenagers your the one with issues.

It depends on resolution of the timing data they have. I wish they would share raw data. Could have been recording clocking of sat link or some such to determine prop delay.

Also need to keep in mind sat is at geo.. length of actual light path between plane and sat depends on angle/location as well as speed/alt.

The main problem is not so much CA validation but lack of a global namespace.

When I type https://www.securesite.com/ into my browser the only certificates my browser accepts are the ones explicitly for www.securesite.com... certs for www.someothersite.com don't work.

With EAP authentication no such check is done automatically by default. To be secure the client must explicitly select a CA **AND** certificate identity (e.g. www.securesite.com) ... otherwise you might well be presented with a valid certificate.... yet you won't know if it is one legitimately assigned to an attacker. Attackers after all can buy SSL certs the same as you or I.

In too many cases the extra work is simply asking too much of the user... some mobile clients are not even able to provide necessary configuration options to secure it.

I would say in practice "enterprise" password authentication via TLS (PEAP-* and TTLS-*) is the least secure authentication method for the simple reason virtually no client is configured properly to validate both certificate and identity.

The end result TLS is effectively subject to MITM attack for the overwhelming majority of clients...leaving squishy inner PEAP/TTLS authentication protocol (all completely worthless)

In my view EAP-TLS with mutual certificate authentication is still the most secure authentication option available.

Stanford's SRP protocol would be awesome to protect WPA passwords I believe it could be implemented with minimal changes to existing TLS stacks ... simply do TLS-SRP via EAP-TLS EAP method instead of the cert auth ... you get secure password authentication without the offline attack vector, or having to implement a new EAP method from scratch.

If you write in Turkish is it more like 70 characters after Unicode conversion or does everyone get 140 characters?

Even if everyone was forced to upgrade to the current version of everything I doubt it would have much impact on "hacked together shit that runs their business"

What does "doing it right" even mean? Says who? You? Objective function of any business is nominally to make money. Not everyone has the same set of problems, not everyone benefits equally from application of the latest and greatest technology. At some juncture you may reach the point of diminishing returns after which platform "improvements" become a liability negatively effecting the business by introduction of unnecessary risk and expenditures.

Depressingly little has materially changed in the last decade aside from the ebb and flow of annoying fads promulgated by marketeers and the legion of lemmings following in their footsteps.

While I hope to be proven wrong I fully expect all "advancements" from here on out to be incremental and of questionable or even negative value.

In the real world it (really) matters how much each option costs. Given use of term "nanofabrication" and lack of available energy density likely this costs more than anyone is willing to pay into foreseeable future.