Spyke

Replies

ich_iel

Comment on

ich_iel

Reply in thread

Ich glaube die größten Probleme im Spanischen haben die Menschen mit ser und estar

Es ist beides sein, aber eins (ser) ist permanenter als das andere (estar)

Soy feliz ist eine Person die nie traurig ist während estoy feliz ein Mensch sagen würde, der gerade ein Eis isst.

Klingt leicht, aber man vergisst es schnell beim Reden. Und die unregelmäßig Konjugation (zB yo soy/era/fui) hilft vermutlich auch nicht.

dach

Comment on

How widespread is the use of pkpass in Germany for public transport documents?

When I cross the Atlantic I pdf or screenshot the plane ticket. Never had a problem. Why can't this be like that?

I had this discussion with someone checking my ticket once. The argument being, that you could share the screenshot with multiple people.

The TL;DR is, that this is not true and comes from a lack of digital understanding.

For the long explanation: copying the ticket with a screenshot does provide a smaller hurdle for "copying" tickets, but the alternative is downloading the ticket on a second phone which is no hurdle at all. Even if it were restricted to one phone, I could backup my apps and restore the backup on a different phone. For every 10 ft wall there will be a 12 ft ladder, because: you can't trust the users phone. They have full control of it.

Which is why the tickets have a UIC918.3 Aztec Code on them (what people call QRCode), which has a digital signature. Basically there are pairs of public and private keys (one per issuer of tickets), and the list of public keys is on the device checking your ticket. Without the knowledge of a private key, signing a ticket is statistically impossible (else there would be a lot of bigger problems worldwide)

That is why every control should check your id regardless. Because the Barcode does not identify you! Their assumption, that a valid ticket means you are the owner is not reasonable! And yet they do.

In another comment a user claimed that changing the name on the ticket would be thinkable, it is not. What has happend in the past with issuers of "fake" tickets is that someone got access to the private key of a local train company and was able to sign tickets in their name. (Don't confuse "normal" signatures with digital ones: this is not like forging a signature on a cheque, but more like finding a chequebook full of presigned cheques)

After this discussion, I made a test. I saved the online (HTML) version of the ticket, changed the text around it to say I was the owner of the rail network (instead of the owner of the ticket) and changed my birthday to 69.69.420. The barcode I would download once a month, and replace it in the ticket (because again, that is the only unfakable part and in case someone would scan it I would like for it to be valid)... And never had issues with it again.

So basically I made an obviously fake but elaborate screenshot, and because something moves on it I never had issues with it. Which sucks, because in the end, it is the illusion of security that is the biggest danger to actual security.

Comment on

Next-Level-Kopfrechnen bei Penny: Wie einfach müssen Bonusprogramme sein? - Supermarktblog

Der Signup braucht ja auch nur Name und Email Adresse... Ach und Zugriff auf deinen Standort und AdId. Tracking passiert wie immer basierend auf DSGVO Abs. 6.1 (weil deren Interesse die App besser zu machen wichtiger ist als euer Interesse eure Daten nicht in den USA zu haben).

Dazu kommt noch

Dazu dürfen wir auf der Grundlage mathematischer und statistischer Verfahren diese Daten zusammenführen, auswerten und in einem Profil speichern, statistische Zusammenhänge, Wahrscheinlichkeiten und Muster erkennen und auf dieser Grundlage deine Interessen und Vorlieben ermitteln, um klar abgegrenzte Zielgruppen zu definieren und die werbliche Ansprache auf die jeweilige Zielgruppe zuzuschneiden.

Und

Eine Verarbeitung von Daten zum Zwecke des Profilings gemäß Art. 22 DSGVO findet nicht statt.

Du wirst also profiliert (nach DSGVO 4) und es wird die Werbung darauf basieren ausgespielt, nur wirst du nicht benachteiligt.

Am Ende steht noch

Du hast das Recht, die Löschung deiner Daten zu verlangen. Bitte beachte, dass ein Anspruch auf Löschung von dem Vorliegen eines legitimen Grundes abhängt

Das stimmt so nicht ganz nach meinem Verständnis. Soweit ich weiß benötigen alle freiwilligen Angaben keinen legitimen Grund zur Löschung.

Ach und wenn sie denken, dass du was geklaut hast dürfen sie den ganzen Datensatz der Polizei geben

Bei dem Verdacht einer Straftat können wir deine Daten an Strafverfolgungsbehörden (bspw. Polizei, Staatsanwaltschaft) weitergeben

Wie der Artikel zu Recht fragt, wie viel sind eure Daten euch wert?

Wie immer relevantes xkcd

Comment on

Polish outdoor equipment

Reply in thread

Have had a sleeping bag from them for 8 years and a quilt for 6 or so. Great products!

The only complaint I have is their prices have increased quite a bit. My sleeping bag was 240 and now it would cost 360. Still an extremly good price for sleeping so warm at night, with that volume and weight, but not as afordable to super broke people like I was.

The tents they sell (MSR) are from the US, in case that is relevant.

dach

Comment on

How widespread is the use of pkpass in Germany for public transport documents?

Reply in thread

This is untrue.

The idea to manipulate the name is not feasable. And if it were it would not be used to fake Deutschlandtickets, but rather anything else that needs cryptography and brings extremely more money.

People are either selling tickets that are not scannable, scan on the wrong name, or in one case, got access to the private key of a regional provider and had the possibility to legally sign tickets. These tickets were then undistinguishable from legal ones, because they were legal ones (for the purposes of the system). But these tickets would also have been valid if they were not screenshots.