Hacker Newsnew | past | comments | ask | show | jobs | submit | burna_aws_acct's commentslogin

Thinking about this too:

MAGNAT (Meta, Apple, Google, Netflix/NVIDIA, Amazon, Tiktok)

MAGNAM (Meta, Apple, Google, Netflix/NVIDIA, Amazon, Microsoft), if TikTok is cut...

MAGNAM-IT (Meta, Apple, Google, Netflix/NVIDIA, Amazon, Microsoft, Intel, TikTok), for the boomers' parents and the Southerners.


If the point is to increase security, isn't it counterintuitive to allow SMS?


IMO, a much-needed and long overdue improvement to the API. User privacy and security matters.


One random factoid I notice is that AWS and Microsoft just announced launch of Open Gateway. Noticeably missing from that list of Telecom Providers is... T-Mobile. I'm sure it's mere coincidence, albeit a noticeable coincidence.

" Initial carriers that have signed up to Open Gateway are América Móvil, AT&T, Axiata, Bharti Airtel, China Mobile, Deutsche Telekom, e& Group, KDDI, KT, Liberty Global, MTN, Orange, Singtel, Swisscom, STC, Telefónica, Telenor, Telstra, TIM, Verizon and Vodafone. "

Link: https://techcrunch.com/2023/02/26/mobile-carriers-team-up-wi...


Interesting... I had something similar happen to me, with minimal outward, acute damage (e.g., running up bills on random credit cards). It is reasonable to assume my entire identity is compromised. Sorry this happened.

How do you know T-Mobile was the entry point, and not say, Google (e.g., Google Chrome, Google Ads)? What type of phone did you have (e.g., Android or iPhone)? What is your browser and Search Engine on your smartphone?

Thanks!


I assumed it was T-Mobile after I wiped the phone and had the follow-up incident where a verification code via SMS was successfully verified.

I used an iPhone, Safari mobile, Google search engine.


There's also this giant vulnerability with Apple Webkit, across all devices, that was patched 13 February 2022: https://9to5mac.com/2023/02/13/macos-13-2-1-webkit-security-....


SMS in unencrypted, and Google SE has been compromised for much if not all of 2022. From what I can tell the issue persists. I officially reported it in December, and again in January, and again in February. Pretty wild, TBH. Think about the number of services that have Google SE and Ads integration. Makes me nauseous.

Did you happen to report to Apple and Google (for documentation)?


In what way is the google search engine compromised?


Ways which I shared with Google, because it's a very serious privacy and security vulnerability.

We need more robust security integration to catch things before they are pushed to results. I understand latency will increase, and some ads revenue will decrease. But like, isn't it also cool to have a customer base that is better protected against egregious attacks, attacks that could be prevented? IMO, yes. It's called "stewardship."


Agreed. The article is written as if it is not already our reality: https://tinyurl.com/amazon-onemedical https://tinyurl.com/amazon-rxpass


2FA via passcode and biometrics is quite nice. The solution you propose enhances privacy/security protection against "the criminal element" and law enforcement alike, as biometric indicators in isolation are fair game for the police. #acab


Relax, they have it... Oh wait. Maybe we're not supposed to know that part. I mean, can you check to see if you have a lingering session cookie or web token that could be used to verify you based on your previous interaction w/ your computer + browser + email (user-specific, sensitive profile info), I mean w/ Amazon (account-specific info)? Maybe also inspect both the email and the link, for good measure. I'm hoping, I mean assuming you're not using Chrome Browser?


Questions: (1) Will we have to pay for Spotify service, and also pay for NFT? Depending on where the NFT is hosted, this could get quite costly for customers and be prone to degradations (e.g., blockchain hacking +/or collapse).

(2) Does each playlist come with a human-authentication sticker? I understand there is an authenticity assurance with NFT-backed songs/albums/playlists, so the move by Spotify makes sense. I hope record labels and artists alike leverage this for themselves as we move into AI-generated <everything>. I want the option to know I am listening to music created by humans, not deep-fake hijacks.

(3) In cases where AI-generated songs are "recorded" and released, will AI be granted writer/producer credits? If no, there's the everlasting issue of "it will remember." Unlike humans, AI may be better positioned to reclaim its value (monetary and otherwise).


What in the David Eastman is all this?


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: