Be careful.

Exactly, copy requires a click but there's no rule that the copy button has to look like anything particular

Why isn't the default behavior for browsers to not allow access to the clipboard? Similar to how it prompts you for access to camera/microphone

Edit: On a per-site basis, like if you use the Zoom website it asks you for access to the webcam, would something like this work for clipboard as well or would it break stuff?

It opens the run dialog, which I’m sure the vast majority of Windows users have never heard of. This would trick a lot of people who just trust whatever their computer asks them to do.

Haha, god I loved doing this on Counter-Strike. “Did you guys hear about the hidden tit pics in counter strike? No shit, hold alt and press f4 and it shows the best tits I’ve ever seen. I don’t know how game developers get away with this stuff.”

Half the lobby is gone, the other half is laughing.

was funny when someone said "alt f4" and 3 people immediately leave LOL

The day of a new patch in WoW I said in general chat "wow, they finally put a confirmation when you type /gquit , crazy how long it took" and sit in town and watch peoples guild names disappear

Uber

Airbnb

Bitcoin?

LLMs?

What's the plagiarism machine, AI/LLM chatbots?

I can't even download and run the first two, those are business innovations! 🤮

Yup, I used to do that as a hobby, but now that I have kids, I just don't have the time. There's no way I could do it full-time, so I have a regular 9-5 that pays reasonably well for a cause I don't hate. For me, that's enough.

I hope I can make enough at my day job to go back to working on FOSS projects before I lose my ability to write competent software.

“To prove that you are human, adopt a pet from the local animal shelter.”

I've got 22 cats already, but I need to check my email!

To prove you are human, a turtle is upside down, or whatever the blade runner test thing was.

I've gotten legitimate calls and texts from my bank about fraud (Citi and Capital One in the last year or so), and it's usually a quick 5-min discussion (yes that was me, no that wasn't me, etc). They usually ask for confirmation of identity at the start of the call, so that wasn't out of the ordinary.

What I usually do is go to my computer and login to my bank to check transaction history, so I can verify what they're saying. However, I was out of town and wouldn't be back in town for a couple weeks, and it was a new phone so I hadn't set up the app yet. Even so, there were some red flags I should have noticed, but didn't (probably due to being somewhat exhausted from traveling the entire previous day):

• text number wasn't from my bank's normal notification number - should've been a huge red flag, but just looked at the content (was dealing with the kids at the time or something)
• phone call came from Tennessee, not the normal bank number - fraud departments often have weird phone numbers, so this wouldn't have helped much, but I should have searched the number (the fraud dept numbers are usually listed on their website somewhere)
• they asked for my authentication code before telling me some identifying information about the account (usually they specify the last 4 digits of the card or something); didn't notice since I had run through fraud alerts a few times recently on different accounts

Also, I usually just ignore numbers I don't recognize, which would have prevented the whole thing as well, but this was a new phone and I hadn't yet transferred everything, so I didn't want to miss something important.

I usually practice pretty good security, but I didn't notice until halfway through the call. However, at least I did notice and was able to prevent any actual harm.

Yup, I almost didn't enable it, but since I was on vacation and didn't want to go set up the app (I try to never set up security features when away from my desk), I let them set it up. They claimed it was AI-resistant, but I honestly don't believe them.

But I don't think enabling it alone would increase risk of anything, it just adds another barrier to impersonating me over a phone. I think they said it wouldn't bypass any other checks, it just increases the likelihood that the call will be dropped before getting to those other checks. But I'm not sure how it works in practice.

Note to self: scream uncontrollably when picking up the phone

This feature is extremely insecure now that there’s several AIs that can replicate voices. If a scammer calls you and you say a few words (like if you say “hello” and “sorry, I think you’ve got the wrong number”), a recording of that can be enough for them to replicate your voice.

It honestly wasn't really that secure to begin with, since the audio would have the daylights crushed out of it through the phone system. Though AI probably makes it easier by just letting you have a computer at the end of it spit out some words.

Someone could probably get away with it by sounding vaguely enough like the person calling.

Or just do the tried and true method of going through the in-person support. Voice recognition, at least in my experience, over the phone, has trouble with accents, so someone calling to get around that isn't uncommon. It never works with me, for example, it just goes "please try again" until it redirects me to an agent.

Yeah, I really hate the state of the banking industry. IMO, all banks should:

• offer TOTP 2FA, and have an option to disable all other fallbacks other than calling in or visiting a branch (Vanguard supports security keys, but it falls back to SMS 2FA, so it's useless); TOTP should be entirely under the user's control and never require a call to configure it
• never call the customer... ever... - send a text, email, and/or a letter asking the customer to call them back, but never initiate w/ a phone call; as long as I can opt-out of them initiating with me, I'm happy
• never take full SSNs over the phone - feel free to ask for a subset (last four, last five, first four, etc), but never the full SSN; you never know who could be listening in, especially since these lines are frequently recorded

So many banks are super insecure, and I'm absolutely willing to jump through a lot of hoops to make my accounts more secure. That's why I'm with my current bank, it's one of the few that can actually be somewhat secured, and I left my last bank because they removed email 2FA (I trust my email much more than I trust the SMS network).

App-based would be bad, as bank apps are notoriously unfriendly to people who don't own Google/Apple smartphones. Rather, a TOTP or Yubikey.

Implementing the open source TOTP system would cost them money! They'll rather keep paying SMS egress instead.

To be fair it's probably way cheaper nowadays.

How would that help in this case? "Sir, please accept the pop up from our app"

Yeah, I delayed setting up non-SMS 2FA because I didn't want to go through the hassle of installing and setting up Symantec VIP (requires a call to the bank). If they had supported regular TOTP, I would've had it configured when I set up the account years ago, and that would've prevented this issue since I know I'm never supposed to give out those codes. But SMS auth is used by phone agents to verify identity, as well as with automated systems, so it's easy to skim the message.

There are only a handful of banks that offer something other than SMS 2FA (and many don't even do that), and I picked this bank specifically because of that. However, I didn't realize they used Symantec VIP, so I put it off.

FWIW this isn't always true. A few months ago, I needed to add an email to my Zelle account on Chase, and had to call them. I initiated the call and they did issue a text message verification to the phone number in my account while on the phone to confirm.

Negative. Had to do that to cancel a cell phone plan recently. They sent the text to my other phone while I was on the line with CSR. Though I agree it should have been possible on the website.

Like the other guy said, it's not always true.

For example, even when you're physically in the store, a T-Mobile employee may require you to read back a code that their system texted to you for certain transactions like buying a new phone for someone on your account or something like that.

The problem is that there are two types of codes:

• sent by rep and is used for verification
• sent by system and is only used for login

They have different messages on the text, but since I would receive the first while on the phone, I tend to skim the message and get to the number.

For TOTP, yes, you only give your code when initially registering it to verify with the other end that it's working.

Idk, I think feeling like an idiot is important, because it shows that I should have known better and can do better next time. I only fell for it because I was in a hurry and away from my normal routine (I'd usually jump on my computer and verify pending transactions before giving any codes).

And that's all it really takes, you could be tired from travel (we had just driven the entire previous day) or whatever, and a few minutes later your money is already on its way out of your account. Something similar happened to Rachel Cruz recently (from Ramsey Solutions), and that's someone who would absolutely know better since she likely takes calls from victims of scams as well.

I guess my advice to everyone is, it can always wait a few days, almost nothing in life is so urgent that it has to be done today. If you feel like you're a little out of sorts, hang up and deal with it later. That would've prevented this problem entirely, and would also prevent most other scams as well.

Sometimes I feel bad for scammers because I know how long it takes just to freaking reset a password on legitimate support calls at work (and usually that's someone who's put in a vague ticket saying "software isn't working" so I emailed them a "I'm not a psychic" email with a link to schedule a call which requires one to schedule on the next business day just to finally talk on the phone and identify what they couldn't write out in their ticket 2 days ago) but then I remember that they're fucking scammers and often fully aware of what they're doing

Yeah I sent the screenshot to my parents right away, I think they would know better but better be safe than sorry.

Thanks for sharing.

I also added that website to my RSS reader.

That's probably why they "helpfully" include a little picture of the symbol on the key, so you know what it looks like.

Exactly. The moment you hit Enter, the computer becomes part of a botnet on every login.

Deploy a user-level payload that is auto started on login. The computer is now part of the botnet and can already be used for useful ops. Deploy a privilege escalation payload later if needed.

90% of users when they are presented with the UAC popup when they do something:

"Yes yes whateverrr" <click>

Shift-insert works too, one key less

I think more and more browsers are spoofing their UA to pretend that you're using windows, for fingerprinting resistance

I have fn lock on for volume and brightness, so that becomes Alt+FN+F2

The only issue I see with targeting Linux is the sheer variety of Desktop setups. Finding one keyboard shortcut and payload that will work on even just the majority of distros would be a challenge.

(Citation needed)

Its a lot harder and can do significantly less damage if it doesnt have root privileges, its like how putting a lock on the door to your house wont stop thieves but its better then not having one.

It should be default, its a good security practice and not every app needs super user permissions.