90

The claim in the article that people who go to the Sci-Hub website are "very vulnerable to having their credentials stolen" is completely baseless, since Sci-Hub never asks for credentials or other personal information. I will instead address the question posed here, about the origin of the credentials obtained by Sci-Hub. The Sci-Hub website does ...


86

Yes those numbers appear to be correct. The Cato instituted published "Terrorism and Immigration A Risk Analysis" in September 2016. From that report: NPR article on the chance of winning the lottery from 2012 notes that it's more likely to be killed by a vending machine. The odds given : 1 in 112 million. And that means it's more likely, at least ...


81

His sources check out The only piece that makes this questionably true is because it's not just for Melania, but the entirety of the Trump family.. See below for the NBC citation. @Chapmanchapman claims his sources in this tweet CNN says Protecting President-elect Donald Trump and his family is costing New York City more than $1 million a day, according ...


79

According to US Citizenship and Immigration Service webpage Refugees & Asylum, last updated in 2015: Asylum status is a form of protection available to people who: •Meet the definition of refugee In other words, not all refugees are asylees, but all asylees are refugees. By not including asylees in the definition of "refugees" the Financial ...


65

It is true that you do not need numbers, special characters, etc for a strong password. If you instead increase the length of the password, the entropy will increase as well. See for example this entropy table. To get 64 bit of entropy, you could have a 14 character lowercase password, or you could have a 10 character password with all printable ASCII ...


62

You can find information about this on Wikipedia ATM SafetyPIN software is a software application that would allow users of automated teller machines (ATMs) to alert the police of a forced cash withdrawal by entering their personal identification number (PIN) in reverse order.1 The system was invented and patented by Illinois lawyer Joseph ...


50

No, this is nonsense. I found an article from The New Yorker, which explored that claim. They asked some lift specialists about it: “It’s just not so,” Charles Buckman, an elevator and escalator consultant in North Carolina, said the other day. “If it happens, it’s just happenstance.” He went on, “There’s no linkage in the control system between the door-...


37

Part 121 The United States Munitions List Enumeration of Articles Sec. 121.1 General. The United States Munitions List. ... Category XIII--Auxiliary Military Equipment ... (b) Information Security Systems and equipment, cryptographic devices, software, and components specifically designed or modified therefore, including: (1) ...


31

There was a similar question over on IT Security. I answer here as I answered there, based on my job experience in the alarm monitoring industry. The short answer is that the reverse-PIN system is documented as a possibility, but is not currently in use by any ATM network or manufacturer. The idea of the reverse PIN is the "duress code"; something that ...


31

This claim is currently unproven. According to a Snopes article written today, which rates this claim as unproven, Chapman cited the CNN article linked below as his source for the security cost and he cited the apparently-correct figure of $148 million as the budget of NEA. When asked for sources, Chapman cited a New York Times article estimating the NEA's ...


28

It's an optional extra. I've actually seen this working so I wasn't willing to accept the article linked. However I found the Specification for the Otis Elevator Company's GeN2 Regen elevator and on page 12 under the Special Functions section there is this: NSB - Non-stop button: Once the NSB is pressed, all calls outside will not be registered, and the ...


26

Here's an independent verification of the leak, analyzed in further detail: http://gizmodo.com/almost-none-of-the-women-in-the-ashley-madison-database-1725558944 While you can remain skeptical of this source, as well, you could also download the data leak yourself and analyze the data. Similar to faking the moon landing, it would take more effort to ...


20

Brian Krebs (noted and respected infosec analyst and blogger) reported this on 27th Jan. 27 Jan 18 First ‘Jackpotting’ Attacks Hit U.S. ATMs ATM “jackpotting” — a sophisticated crime in which thieves install malicious software and/or hardware at ATMs that forces the machines to spit out huge volumes of cash on demand — has long been a threat for ...


19

Actually, it looks like books with crypto algorithms were excluded from such exporting licensing requirements; in the Karn case: The ODTC [Office of Defense Trade Controls] determined that the book, which contained the algorithms in printed form, was not subject to its export jurisdiction because it was in the public domain. However, the information ...


17

It depends upon your definition of "off", "track", and "phone". Some phones will keep the baseband chip powered when the device has been shut down. In some cases, security agencies have "updated" the baseband sofware on a large number of phones in order to make them trackable when shut down. It's certainly possible to install OTA updates with almost ...


14

Evidence: There is an application for a search warrant documented in court by FBI that a US hacker named Chris Roberts hacked into the electronic entertainment systems of airplanes [1] and that he had taken control of an airplane’s engines mid-flight using his laptop and an Ethernet cable [2]. Chris Roberts had also earlier claimed that he had changed the ...


14

No, it's not legit (in the sense you used the word). Perhaps the file won't appear inside their application, but doesn't mean that nobody else will be able to open it again. “Favorite” files so you can access them offline Ok. You install their program in some computer, mark the file as favorite, and it's downloaded to that program. Then you disconnect from ...


14

The presidential alerts are part of a bigger system that also includes AMBER alerts and alerts for bad weather and "other threatening emergencies". These alerts are called Wireless Emergency Alerts (WEA). FEMA explains how it works: Does WEA know where I am? Is it tracking me? No. Just like emergency weather alerts you see on local TV, WEAs are ...


13

Evidence: Experts warn against the usage of internet voting in USA unless the vote data is transmitted in a safe, secure and verifiable process over the internet. In 2008, 32 respected computer scientists from universities across the country, including Stanford University, Princeton University, John Hopkins University, Carnegie Mellon University, Indiana ...


13

There is no single right answer to how much entropy a password has: the result will depend on the assumptions the attacker will make about it, and these are unknown. More or less reasonable guesses can be made about these assumptions, giving more or less reasonable entropy values. This article at explainxkcd covers the comic in question. It explains the ...


13

Have a look at the case Bernstein v. United States In the early 1990s, Daniel J. Bernstein created the Snuffle encryption system. He wanted to publish it in an international conference. However, after asking the appropriate US department, he was told by the Office of Defense Trade Controls: the information known as Snuffle 5.0 has been determined, under ...


12

Yes, the number comes direct from the 2012 Report on Security Clearance Determinations that was released by the Office of the Director of National Intelligence (Wikipedia). Table one on page three breaks things down as follows: As of 10/1/12: Conf/Secret Top Secret Government: 2,757,333 791,200 Contractor: 582,524 483,263 ...


12

The White House acknowledged that the tweets were made, calling them "pocket tweets." As for their content, WaPo speculates that they're two-factor authentication codes which he sent back to the SMS number that Twitter uses, rather than entering into the device he was using to log in.


12

Yes. Duo labs (security vendor) says on https://duo.com/decipher/labs-presents-whats-happening-with-rfid-blocking-gear It turns out standards for testing these RFID-blocking devices actually exists since the government wants to make sure these sleeves and cards actually work before buying them for government employees and contractors. There is an actual ...


12

Does Sci-Hub rely on stolen credentials from unwitting researchers? Yes, at least in part. This is confirmed by Alexandra Elbakyan herself, although she also claims that Sci-Hub isn't the one conducting the phishing attacks: "I bought some credentials from other people," she told Sky News. "Perhaps some credentials (out of thousands used by ...


11

There was a discussion at security stackexchange about this issue. The top rated answer says: Yes, it is possible. However, that runs the risk of destroying the device without getting the data off first, which is undesirable. It also does not achieve the political goals of forcing Apple to assist in decrypting the device, paving the way with precedent ...


11

There have been several experiments that measure the effectiveness of unsubscribing from spam, which concluded in favor of unsubscribing. For example, Kenneth Ladd Seldeen, a researcher with a Ph.D. in Biochemistry and Molecular Biology, has set up the following: Used in this experiment were two web based email accounts. Email accounts were tracked for ...


11

(With analysis thanks to Oddthinking) Assange seems to refer to this leaked email from Podesta's assistant Eryn Sapp to him, which contained an username and password for him to use. (This was not necessarily for his email account.) While sending a password through plaintext is bad form in general, it is entirely possible that this was meant to be a ...


11

Your title and body ask different questions, but in Somalia last year, a bomb disguised as a laptop was used to attack a plane: 'Sophisticated' laptop bomb on Somali plane got through X-ray machine


Only top voted, non community-wiki answers of a minimum length are eligible