it's what happens when there hasn't been regular 'twice a year' cleaning since before the dental hygenist was born. We had a laugh about that, she asked how long it had been since my last cleaning, and when i told her she laughed and said 'So, longer than I've been alive." So, it took about twice as long as the 'twice a year' variety.
There are two tricks to mostly avoid flossing. Before you brush your teeth, use a interdental brush in the gaps between your teeth. Depending upon the shape of your mouth and tooth placement, there might be one or two gaps that you cannot reach. Next, brush your teeth. Finally, one or twice a week, after you brush your teeth, floss the gaps that your interdental brush cannot reach. Why after brushing? So your flossing won't smell bad. That is one of the biggest complaints about flossing when people are surveyed.
No, this was a couple of decades ago, I didn't have a blog back then and I have zero evidence. But I can tell you some of the details: the device was a Philips 'Marc' CB transceiver. They made only one model both for the US and the EU market so there were 22 channels available in the EU and 40 iirc in the United States. But the rotary channel selector did have all 40 positions. That made me wonder... what if? So I opened the device and there was this very large plastic blob in the middle of the circuit board with obviously a large (40 pin iirc) chip underneath it. I realized that if I tried to physically remove the blob that I would most likely break the chip so that wasn't going to work.
But it was clear what it did: as soon as the channel selector went to a forbidden channel the blob sprung into action to disable the chip underneath. I measured the effect on the pins underneath that were accessible from the other side of the board and noticed that a whole bunch of them got shorted to ground. That was the hint I needed. A friend ran a laser game company and they had a nice little IR camera with built in display, that was used for calibration of the IR beam collimators in the laser guns (the laser doesn't actually do any of the shooting, the thing is basically just a very powerful remote control with a lens that sends out a relatively narrow beam). I set it up above the the blob and set the channel selector to a good channel and let it warm up. Had a look with the camera. Then set the channel selector to a bad channel, let it warm up again and had another look with the camera. The difference was pretty obvious, there was a hotspot right in the middle of the blob. I marked the spot and made a drill jig, then it took me a few days to gather courage and stick the drill in, it worked on the first try. That gave 18 nearly empty channels to play with. Once I had it figured out the second one was a lot easier :)
RSA and the government were extremely tight lipped about it, including refusing to confirm what data had been exfiltrated. At the time news stories recited that some evidence pointed to the PRC. There may have been some followup after media attention moved on.
I'd be curious if anyone on HN could confirm whether RSA quietly reissued new keyfobs. The safe assumption was the intruders got access to the TOTP secrets, but strictly speaking that was conjecture, unless that was later confirmed directly or indirectly.
This may have been a different incident, but at some point there was chatter about a possible physical intrusion targeting a TOTP backend server for DoD or defense contract systems (Lockheed Martin?).
I think really serious incidents tend to be more vigorously suppressed, unlike humdrum PII exfiltration, for the same reason that during wartime states don't want the enemy to have unequivocal confirmation about how successful an operation was, e.g. whether the secrets exfiltrated included credentials to specific systems.
I briefly tried to keep a list of these types of hardware-based authentication systems hacks. But it's a chore, especially following up.
As I understand, they recovered quite a lot in the FTX bankruptcy. The guy running it now ( John J. Ray III ) is a bankruptcy legend. What was your recovery rate(%)?
The reason why traditional works is the fraud can be reversed. If money is stolen from your accounts, as long as you are not the cause, in most cases the institution or govt will make you whole.
It is reinvented by 'crypto' in the form of 'subjectivity' (as opposed to the hard objectivity of 'your keys your coins' and the absolute acceptance of all objectively (though perhaps fraudulent or thieving) valid transactions.
One example of subjectivity is if, and this happens, a bug is found which can drastically increase the supply of coins beyond the intent of the creators; everyone comes together and removes those state transitions manually despite their objective validity. A more practical notion would be some type of "this transaction was fraud, someone has authority to reverse it." Of course, this is a hard tradeoff, but users should be able to make it.
reply