Philip answered him, 2 books is not sufficient for them. And Jesus took the books; and when he had given thanks, he distributed to the disciples, and the disciples to them that were set down. Therefore they gathered them together, and filled twelve baskets with the new copies, which remained over.

  • 40 Posts
  • 58 Comments
Joined 3 months ago
cake
Cake day: April 5th, 2024

help-circle







  • Mullvad’s response a day after the article. Come on proton, at least a “we saw the article and are looking into it”.

    https://mullvad.net/en/blog/evaluating-the-impact-of-tunnelvision

    Evaluating the impact of TunnelVision

    May 7, 2024 Security

    We evaluated the impact of the latest TunnelVision attack (CVE-2024-3661) and have found it to be very similar to TunnelCrack LocalNet (CVE-2023-36672 and CVE-2023-35838).

    We have determined that from a security and privacy standpoint in relation to the Mullvad VPN app they are virtually identical. Both attacks rely on the attacker being on the same local network as the victim, and in one way or another being able to act as the victim’s DHCP server and tell the victim that some public IP range(s) should be routed via the attacker instead of via the VPN tunnel.

    The desktop versions (Windows, macOS and Linux) of Mullvad’s VPN app have firewall rules in place to block any traffic to public IPs outside the VPN tunnel. These effectively prevent both LocalNet and TunnelVision from allowing the attacker to get hold of plaintext traffic from the victim.

    Android is not vulnerable to TunnelVision simply because it does not implement DHCP option 121, as explained in the original article about TunnelVision.

    iOS is unfortunately vulnerable to TunnelVision, for the same reason it is vulnerable to LocalNet, as we outlined in our blog post about TunnelCrack. The fix for TunnelVision is probably the same as for LocalNet, but we have not yet been able to integrate and ship that to production.













  • I kinda like the baseline security advantages. Not that android can’t be better in security, but none of my friends give a shit, and so my iphone friends walk around with better baseline security.

    https://old.reddit.com/user/ghostinshell000

    hello ,

    ok, here is more than a few posts on this. that said: both have made alot of strides recently, basically the order of consensus is:

    • a google pixel flashed with graphaneos
    • iphone
    • pixel
    • samsung and use adb to remove everything you can.

    also, how the devices are setup and used matter alot. other than a pixel + graphaneos, iphones tend to be better at privacy but the devil is in the details. iphones are also more “hygienic” in alot of ways, that you cant see. BUT android is open source for the most part, and are HGIGHLY configurable. and hardware wise has wider variety of choices.

    security wise also pixel + graphaneos tends to be top shelf. but iphones, tend to have decent track record. and with proper setup and some addons, it really locks down pretty decently. for other androids, the proper addons, and adb mode to remove all the junk.

    support wise? pretty much apple kills it, and everyone else is second and in some cases really distant second or even worse. also google does csam scanning and has blocked folks in false positives and the support structure does not have any way for manual review to get your account back it takes months of fighting them from the reports I have read.

    this is all part of the really bad support model thats google. while, google one support of easy things is decent, when it gets real your chances get dicey…

    apples support is decent on all levels, not great but decent and in almost all cases better then googles.

    data protection? its an apple game now, you can enable adp and the key that encrypts your data is yours and apple documents what key encrypts what data. google, on the other hand, says they encrypt things but the dont really have any good documentation on whats encrypted and whos key encrypts what noor do they allow you to use a key you create like apple does.

    backup and recover? while they both do it, apples backup and restore is light years better, googles works, but app level stuff the app devs must create a manifest which tells the backup process what to backup etc. so, over all they both work, its just that apples works better.

    applepay vs googlepay, they both work and both are secure, but apples doing full tokenization and googles doing virtual credit card numbers to front for your real card, googles nebales more compatibility with banks easier, apple requires actual setup and key exchanges to onboard each bank. but in the long run while both are considered good, apples is the better way.

    IOT and automation, both have a ton of automation, tho googles probably ahead here. but for the iot and home stuff a new standard “matter” will standardize it all so future state wont matter what device you have.

    thats it for now.