• 3 Posts
  • 540 Comments
Joined 2 years ago
cake
Cake day: August 4th, 2023

help-circle


  • Nah that was Windows XP, where the hard drive was not encrypted by default, and the password was stored in a hashed file on the computer itself, freely accessible via any boot stick. Actually cracking it still took some time (below 7 characters a few minutes, 7 about 1h, 8 chars up to 24h, longer… LONG). But if it was a common word, then a dictionary attack with a long enough word list (most word lists have like 400k words or so) would get it in seconds either.

    The funny thing with Windows XP was that since none of the data was encrypted, you could simply delete the password hash and set a flag in the registry and you would boot right into Windows with no password at all, and were then prompted to set a new password. That didn’t work since Windows 7 anymore.


  • You can buy a hardware keystroke recorder for a few bucks. Just plug it between keyboard and computer and it logs all inputs. Once they have the boot password (and maybe a bunch of others), installing malware and exfiltrating data is pretty straightforward. Doesn’t require a lick of IT knowledge either.

    Bit more challenging on a laptop without external keyboard, but there are hardware solutions as well, though they’d require tinkering with your device.

    Phones are harder to gain access to. Honestly if I wanted to get into your phone, I’d probably try to set up hidden cameras in spots where you are likely to enter your PIN (bed, toilet) somewhere under the ceiling and angled straight down. I’d probably try to switch the phone off as well any chance I got (long press the start button) so that you’d be forced to boot up and enter the PIN at any given opportunity to max my chances.

    Actually hacking secure boot / accessing data from encrypted drives is beyond casual hackers, unless you don’t regularly update your devices and there are some active exploits published.

    But seriously, low effort password sniffing is still the biggest vulnerability out there.

















  • Yeah what I also saw in the terms was that they reserve the right to sell their company without informing users other than through an update in the terms & conditions, and based on play store reviews, they terminate lifetime accounts if they find that you upload copyright protected files, even if you don’t share them with anyone.

    Indexing my stuff and comparing it against external databases is a big no no for me.

    So far I’m quite happy with sync.com, been using them for well over a decade. Data is fully encrypted during upload, so no matter if the server is ever breached, they wouldn’t get anything useful out of it.

    I also got my own nextcloud instance up and running, but it’s with a shared hosting provider where I don’t feel as secure.