<awygle>
azonenberg: thinking of rack mounting my test equipment. Think I can get away with a two post desk rack or do I need a full four-post?
<azonenberg>
I have a 2-post rack for all of my test equipment
<azonenberg>
on my desk
<azonenberg>
nothing super heavy though
<azonenberg>
Down the road i plan to move to two racks because i expect to get more gear
<azonenberg>
and one rack high enough would put some stuff out of easy reach
indy has joined ##openfpga
<awygle>
Arright cool
<awygle>
Two post racks make me nervous so I wanted to double check lol
<azonenberg>
mine has a pretty big and solid base plate
<azonenberg>
its not going anywhere short of an earthquake
<azonenberg>
and once i move to the new location, it's going to be bolted to the table
<azonenberg>
Which will be bolted to the concrete floor
<azonenberg>
so it would take a pretty substantial quake to knock over :p
<awygle>
my apartment won't take kindly to lag bolts in their floors
<awygle>
rack mount kits are stupidly expensive for what they are..
<sorear>
dissolvable glue? suction cups?
<azonenberg>
yes they're expensive
<azonenberg>
and thats one of the reasons i bought a place
<azonenberg>
If i really wanted to go all the way i'd jackhammer out the concrete
<azonenberg>
then cast threaded rods into the floor
<azonenberg>
but at that point i might as well re-cast the entire floor
<azonenberg>
which is a bit further than i want to go at this point :p
<rqou>
azonenberg: have time to peek at the xc9500 stuff linked above?
<azonenberg>
Nope, actually about to call my bank
<azonenberg>
Somebody's been using "my" CC to buy things in Boston
<azonenberg>
they flagged a $900ish nightclub charge as fishy but there were a couple of smaller ones for food and parking that went through
<azonenberg>
Wonder how it got pwned
<azonenberg>
gas station skimmer and/or POS malware are the obvious guesses
<rqou>
typical
<rqou>
no matter how upset brian krebs gets, I've basically given up on us banking security
<azonenberg>
Yeah, i'm waiting for the day when we have EMV readers on PCs
<azonenberg>
or better yet emv-ng or whatever they call its successor
<azonenberg>
i want amazon to get a signed blob from the secure element on my card every time i buy something
<azonenberg>
or have the charge not clear
<azonenberg>
maybe allow you to sign a blanket authorization for recurring charges up to $x or something
<azonenberg>
but certainly it should not be possible to make a purchase with only the account number
<azonenberg>
the us banking system confuses identification and authorization and this leads to all kinds of problems that PKI was designed to solve
<azonenberg>
one account number for checks, ACH deposit, ACH withdrawal
<azonenberg>
one account number for any and all credit card purchases
<sorear>
i wonder if MITM fraud will be much harder to reverse than current forms of fraud
<azonenberg>
any time you give that info to a merchant, they have all the info they need to clone your card
<azonenberg>
this is a fundamentally broken system
<sorear>
next-gen endpoint malware waits for you to visit amazon, then inserts itself between the browser and the EMV reader so that the card signs a malicious transaction instead of your amazon cart, because trusted displays are apparently still too expensive for a card that $hundreds of fees will be paid over
<azonenberg>
Yes but that's a win
<azonenberg>
it requires the endpoint to be compromised
<azonenberg>
i.e. your pc
<azonenberg>
or amazon's server but that's a hard target
<azonenberg>
current gen, compromise of any merchant anywhere is a win for the attacker, and lets them siphon up zillions of cards at once
<azonenberg>
rather than this, which requires pwning client PCs one at a time
<azonenberg>
And i keep things pretty locked down in virtual machines, my actual PC doesnt even access the internet at all
<azonenberg>
I'm talking to you guys over VNC to a VM in the DMZ that is only used for irc
<azonenberg>
i have another vm for online banking, another for general browsing, another for social media, etc
<azonenberg>
If we ever got credit card stuff to the point that it actually required a card present for transactions on a PC, i'd have a dedicated VM just for that and probably revert it every day or two to keep it clean
<azonenberg>
My goal was, and continues to be, to be a hard enough target that if my cc/banking info ever got pwned it would be somebody else's fault and not mine
<awygle>
I am continually surprised ive never had this problem
<azonenberg>
me too, i'm surprised it took so long
<azonenberg>
I have a suspicion as to what it was too
<awygle>
I take almost no precautions besides jiggling suspicious readers
<azonenberg>
a couple weeks ago we started buying bulk building materials from the home depot
<azonenberg>
And when we did that, we rented a truck from them
<azonenberg>
Which had to be returned full of gas
<azonenberg>
So i went to the nearby gas station several times when we were renting the truck
<azonenberg>
I think one of the pumps there has a skimmer
<azonenberg>
The new generation gas pump skimmers live inside the pump, they're invisible on the outside
<azonenberg>
they MITM the signal between the magstripe reader and the modem/brain card
<azonenberg>
its not a second reader head like the atm shim skimmers etc
<azonenberg>
without taking the pump apart there's no way to know it's there
<azonenberg>
Other possibility is malware on a POS system, which does happen but i havent been going to any different retailers than usual
<azonenberg>
and this must be a recent leak (not an old one that got dumped ages ago and recently got exploited) because i just got issued a new card like a month or two ago
<azonenberg>
b/c the old one expired
<sorear>
seems like if I can install mitm hardware in gas pumps, it can redirect 1 in 10 EMV scans to fraudulent transactions
<azonenberg>
sorear: yeah i dont know much about how emv authenticates merchants etc
<azonenberg>
But the good news is, if you did that
<azonenberg>
it would only affect that scan (in theory)
<azonenberg>
i.e. you wouldnt have to throw away the card
<azonenberg>
just reverse that charge
<sorear>
my big question at this point is "are EMV-signed transactions still reversable?"
<azonenberg>
I believe any charge can be disputed but emv-signed ones take a bit more work and i think there's some shift of liability to the merchant?
<azonenberg>
either way the consumer always has the ability to back out
mumptai has joined ##openfpga
<awygle>
i knew someone once who thought using credit cards was dangerous but using debit was fine
<azonenberg>
yeah, thats the exact opposite
<azonenberg>
i generally compartmentalize things pretty well though
<azonenberg>
like, i have a checking account that i only use for wire transfers
<azonenberg>
it's kept basically empty
<azonenberg>
i move stuff to it then ach it out
<azonenberg>
or vice versa
<azonenberg>
So if the account is pwned, the damage is massively limited
<awygle>
I have one of those for sending money to and from my parents
user10032 has joined ##openfpga
m_t has joined ##openfpga
pie_ has joined ##openfpga
pie___ has quit [Ping timeout: 260 seconds]
mumptai has quit [Quit: Verlassend]
wpwrak has quit [Read error: Connection reset by peer]
wpwrak has joined ##openfpga
RaivisR has joined ##openfpga
RaivisR__ has quit [Read error: Connection reset by peer]
rohitksingh has joined ##openfpga
pie_ has quit [Ping timeout: 264 seconds]
eduardo__ has joined ##openfpga
eduardo_ has quit [Ping timeout: 265 seconds]
nickjohnson has quit [Ping timeout: 256 seconds]
nickjohnson has joined ##openfpga
rohitksingh has quit [Quit: Leaving.]
digshadow has joined ##openfpga
gnufan has quit [Ping timeout: 260 seconds]
pie_ has joined ##openfpga
gnufan has joined ##openfpga
gnufan has quit [Ping timeout: 264 seconds]
gnufan has joined ##openfpga
gnufan has quit [Ping timeout: 264 seconds]
gnufan has joined ##openfpga
ym has joined ##openfpga
pie_ has quit [Ping timeout: 240 seconds]
Wallbraker has quit [Quit: removing from IRC because user idle on matrix for 30+ days]
pie_ has joined ##openfpga
ZipCPU|Laptop has joined ##openfpga
AlexDaniel` has quit [Changing host]
AlexDaniel` has joined ##openfpga
RaivisR_ has joined ##openfpga
RaivisR has quit [Read error: Connection reset by peer]
plaes has quit [Ping timeout: 240 seconds]
plaes has joined ##openfpga
plaes has joined ##openfpga
m_w has joined ##openfpga
pie_ has quit [Read error: Connection reset by peer]
ZipCPU|Laptop has quit [Ping timeout: 256 seconds]
finsternis has quit [Ping timeout: 256 seconds]
finsternis has joined ##openfpga
digshadow has quit [Read error: Connection reset by peer]