173
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
this post was submitted on 08 Apr 2024
173 points (96.8% liked)
Comic Strips
25493 readers
2915 users here now
Comic Strips is a community for those who love comic stories.
Rules
-
π Be Nice!
- Treat others with respect and dignity. Friendly banter is okay, as long as it is mutual; keyword: friendly.
-
ποΈ Community Standards
- Comics should be a full story, from start to finish, in one post.
- Posts should be safe and enjoyable by the majority of community members, both here on lemmy.world and other instances.
- Any comic that would qualify as raunchy, lewd, or otherwise draw unwanted attention by nosy coworkers, spouses, or family members should be tagged as NSFW.
- Moderators have final say on what and what does not qualify as appropriate. Use common sense, and if need be, err on the side of caution.
-
𧬠Keep it Real
- Comics should be made and posted by real human beans, not by automated means like bots or AI. This is not the community for that sort of thing.
-
π½οΈ Credit Where Credit is Due
- Comics should include the original attribution to the artist(s) involved, and be unmodified. Bonus points if you include a link back to their website. When in doubt, use a reverse image search to try to find the original version. Repeat offenders will have their posts removed, be temporarily banned from posting, or if all else fails, be permanently banned from posting.
- Attributions include, but are not limited to, watermarks, links, or other text or imagery that artists add to their comics to use for identification purposes. If you find a comic without any such markings, it would be a good idea to see if you can find an original version. If one cannot be found, say so and ask the community for help!
-
π Post Formatting
- Post an image, gallery, or link to a specific comic hosted on another site; e.g., the author's website.
- Meta posts about the community should be tagged with [Meta] either at the beginning or the end of the post title.
- When linking to a comic hosted on another site, ensure the link is to the comic itself and not just to the website; e.g.,
β Correct: https://xkcd.com/386/
β Incorrect: https://xkcd.com/
-
π¬ Post Frequency/SPAM
- Each user (regardless of instance) may post up to five (5 π) comics a day. This can be any combination of personal comics you have written yourself, or other author's comics. Any comics exceeding five (5 π) will be removed.
-
π΄ββ οΈ Internationalization (i18n)
- Non-English posts are welcome. Please tag the post title with the original language, and include an English translation in the body of the post; e.g.,
SΓ, por favor [Spanish/EspaΓ±ol]
- Non-English posts are welcome. Please tag the post title with the original language, and include an English translation in the body of the post; e.g.,
-
πΏ Moderation
- We are human, just like most everybody else on Lemmy. If you feel a moderation decision was made in error, you are welcome to reach out to anybody on the moderation team for clarification. Keep in mind that moderation decisions may be final.
- When reporting posts and/or comments, quote which rule is being broken, and why you feel it broke the rules.
Banned Artists
The following artists are banned from the community.
- Jago
- Stonetoss
- GPrime85
It should be noted that when you make reports, it is your responsibility to provide rational reasoning why something should be removed. Saying it simply breaks community rules is not always good enough.
Web Accessibility
Note: This is not a rule, but a helpful suggestion.
When posting images, you should strive to add alt-text for screen readers to use to describe the image you're posting:
Another helpful thing to do is to provide a transcription of the text in your images, as well as brief descriptions of what's going on. (example)
Web of Links
- !linuxmemes@lemmy.world: "I use Arch btw"
- !memes@lemmy.world: memes (you don't say!)
Other Comic Communities of Interest
- !bloomcounty@sopuli.xyz
- !calvinandhobbes@lemmy.world
- !cyanideandhappiness@discuss.online
- !exo@discuss.online
- !foxtrot@slrpnk.net
- !garfield@lemmy.world
- !moomin@sopuli.xyz
- !oglaf@discuss.online (NSFW)
- !outland@slrpnk.net
- !pbf@discuss.online
- !peanuts@discuss.online
- !smbc@discuss.online
- !theboondocks@slrpnk.net
- !thefarside@sh.itjust.works
- !xkcd@lemmy.world
- !NoseEars@lemy.lol
founded 3 years ago
MODERATORS
Such a shame - I've followed his work for years
So the rest of us can be wary of similar scams, does any one know what exploit this likely was? Would it be something like seeing a session ID in the website URL?
"Oh you are logged in on your phone? Lets zoom there"
This is the exploit.
The technical details dont really matter. Webservices are extremely difficuly to make secure if you cannot trust a legitimate users computer who is legitimately authenticating.
The key extraction could be seen as a vulnerability. Likely an oauth token that the webservice passes to the browser, which passes it to the auth service, then the auth service passes a new token to the browser, which then passes to the webservice which verifies the token then starts an authenticated session.
There will be a reason that keys are (im guessing, as this is the only way it can be leaked to screen sharing) passed as query parameters. Likely load balancers operating on SNI, or its to rely on basic browser/headers to control the authentication flow, instead of having to have specific browser code (ie javascript) to take the key and pass it as body data in a post request without the users intervention.
Unfortunately it is probably the most secure way of doing it given the restrictions of http, browsers and ease-of-use-for-users.
The lesson is "if you are dealing with a stranger and : you have a bad feeling, you are put under emotional stress, time deadlines, any kind of pressure. STOP."
Thats how scam/phishing etc works. It engineers you to dismiss any red flags that would normally make you stop.
Sometimes scammers get really lucky and hit you when you are expecting legitimate contact.
Yeah, the stress is key. I'm reminded of how Cory Doctorow recently wrote about how a scammer got him because of lucky (for the scammer) timing because Doctorow was travelling and in a rush, or something similar.
I'm also reminded of how irl predators utilise a similar pressure to the scammers - they leverage our instinct to be polite and avoid violating social norms, in order to keep pushing boundaries. Often the key to avoiding risky situations is to recognise and validate an uncomfy feeling as soon as possible, and get yourself out of that situation rather than talking yourself out of your discomfort.
Also, any legit interaction would cause such a tiny blip from anything you do to protect yourself.
"Hello, im phoning from the IRS. We are going to issue an arrest warrant if you dont pay your outstanding bill"
"Oh my god. Can i have a reference number? I want to phone the IRS back to make sure this is legitimate"
"Sure, its {whatever}".
Find the IRS number via a legitimate website (probably irs (.) gov?) and phone them. The operator isnt going to care. A scammer will apply more pressure
Thats what a normal interaction with a safety check will go like.
And thats absolutely fine.
I guess its worth extending that to screen sharing.
"Oh, i have to sign in. Let me just stop screen sharing".
It fucking sucks that there are people that leverage, exploit and scam.
Its bullshit this has happened, and im glad that this story is being told.
It raises awareness, hopefully other people can learn from this. And i hope they get their account back (im surprised that suppory channels didnt give access back, or at least restrict the account)