I didn’t mention it in that post but that is _exactly_ the attack vector I had in mind also- even if someone stole my phone, Touch ID should stop them from getting at my passwords.
Summary- Google has added a “match the numbers in the app” style 2FA to YouTube. Makes sense- their video monopoly means that for many iOS users like myself it’s the only Google app they’ve got. Except…
1) It’s the default, and there’s no apparent way to change it, or even turn it off. This is annoying- I prefer TOTP since it’s more secure. There’s a Google Prompts section in the 2FA settings, but it says that I don’t have any supported devices. This actually makes sense, because
2) It doesn’t f*king work! Ever since they changed it from “press yes” to “match number”, the screen opens in the YouTube app and then loads forever. Which means I’ve got a spurious notification on my phone, a screen to dismiss next time I open the YouTube app (or several, because for some reason they can stack), and two extra clicks every time I log into Google on a new device.
Actually, I lied earlier- there is one way to disable it, and it’s to DISABLE ALL 2FA, as you can see people doing in that support thread. I honestly don’t blame them, but clearly less 2FA was not the plan of whoever’s idea this was. Speaking of support forums- I don’t think anyone at Google reads them, but they do read HN :))))
Wow, that link is such a great example of Google's "support."
"This channel is for troubleshooting Google devices. It is best to report this with YouTube support for better assistance. [...] I'll be locking this thread after 24 hours."
...just because the initial report contained the keyword 'YouTube', presumably. The reporter clarified the situation, and a different "support" team member comes in and regurgitates the same canned response! On Google's side, why even bother replying at all if that's all you're going to do?
Just an FYI here: Google's community support forums aren't well named as their intended purpose is for users to answer other user's questions. For the community to support each other.
For actual support you need a paid account to reach out to.
You could argue that it's badly named and should just be called Google's community forum instead, which is what it really is.
Have you seen answers.Microsoft.com, the most useless support community on the internet full of „independent advisors“ aka Microsoft simps just sending links to irrelevant documentation?
While we're at it, have you seen the Apple ones? 3 year old threads with 100 messages of people saying 'I have this same issue' and zero response from Apple.
Some examples of the subjects of these threads:
- SD Card readers in original M1 Macbook Pro not working
- Bluetooth headphones balance getting messed up randomly (so old someone created an application to automatically center balance)
- Specific Intel Macbooks crashing after using a Thunderbolt dock exactly twice.
All of them with no response from Apple at all and no fixes in sight.
Very fair replies. I didn't mean to call out Google + fans of Google in particular, but rather "Bigco"s and fans thereof in general.
Out of all of them I guess I'm more disappointed in Apple because they have cultivated this aura of superior UX (so that emphasis on UX should extend to when people have problems).. but then again it's largely just an aura.
Even better is this comment by another support team member:
> I'm chiming in to ensure you've got the answer you're looking for. Feel free to let us know if you have more questions about this.
Totally void of any helpful information or even remotely understanding of the issue. Of course at the time the comment was posted, no useful answer had been given by any support team member.
But to be fair though, the support team did follow up a few month later:
> Thanks all for your patience on this post, and sorry for the confusion. I originally pinned a response by @knewland397 as a helpful workaround for some folks on the thread, but I understand that it didn’t answer the whole question. Happy to shed some light on the situation here!
> Prompts like this are intended to be easier than entering a verification code to log in, and you can receive them from not only the Youtube app, but the Gmail app, Google Photos app, and more. To learn more about prompts and how they help keep your account safe, stop by our Help Center [1].
> To answer your question of why your Nest Community account is impacted, our community uses the same Google Account authentication as the rest of Google services.
> For future reference, our friends over at the Google Account Help Community are best equipped to help you with these types of questions. This forum is meant to host discussion about apps and accounts as they relate to Google Home and Nest.
The help center [1] indeed documents the apps (under the "iPhone and iPad" tab):
> Gmail App, YouTube App YouTube, Google App, Fotos App Fotos, AdWords App or Smart Lock App.
I don’t know if it’s just me, but it seems like for the last couple years the products from the FAANG companies have been rotting on the vine. It seems like all the people that made these have moved on and have a b-team barely making them work.
Google's TOTP is not as good as it could be being HMAC-SHA1 of a symmetric secret and Unix epoch. WebAuthn with a hardware device is less prone to losing and compromising secrets.
I use all 2FAs allowed.
Tangent on passwords. What the world needs is a path to automated, interoperable secret management in 3-4 RFCs:
User-operable, standardized password change REST API that:
0. Sends a session token/nonce
1. Describe the password policy declaratively and precisely, to be validated client-side with boilerplate client code
2. Offer a list of supported PBKDFs and their required and allowed parameter values
3. Includes both client- and server-side PBKDF hashing with minimum values for a given risk type AND adjusted with the "inflationary" Moore's Law costs of tech resources (CPU, GPU, RAM, ASIC, FPGA, QC) over time
---> This would then permit a password manager app to automatically change every password perhaps every day. I'm thinking the future should be like this but use user certificates as a primary AA mechanism and passwords as a break-glass-backup.
GitHub has a similar problem, where the GitHub mobile app can’t be disabled as an 2FA factor. They implemented an option to make other factors as the “default” without the ability to completely disable mobile, and then falsely closed the discussion [1].
If such insecure factor can’t be disabled, what’s the point in setting up TOTP and / or hardware keys?
The YouTube mobile website is intentionally crippled. For example, the video refuses to play in a video popout, even though the same browser feature works for me on other mobile websites and on desktop YouTube. Personally I just avoid browsing it on mobile as a result, but I could see someone being convinced to install the app.
On iOS, installing vinegar sorts this. You get video pop outs and no ads to boot. It’s much better that the app and seems to give longer battery life (hardware acceleration?)
It breaks integration with the YouTube app, and it's a bit of a maintenance keeping up with the latest version, whether to use youtube-dl or yt-dlp or another fork, etc.
I paid $1.99 for Vinegar and on my iPad (and Mac) I get ad blocking, videos playing in the background, etc. It can be a little clunky because autoplay of the next video doesn't seem to work and there are times I'd like to use a music playlist. It's probably my fault but a quick glance at settings didn't resolve it.
I use the web one exclusively. Other than the video pop out feature missing and once in a while scrolling bugs on shorts, it actually works perfectly fine.
I refuse to use the YouTube app because they disabled playing in the background or with the screen locked . They Want your eyeballs on the screen for the ads. It so blatant.
I think this is one of the few things Prusa actually gets right- it takes serious gall to carbon copy something (there are plenty of cheap, mostly Chinese printers out there, but the vast majority are fairly different to the Mk3, not outright clones)- but not even the cloniest of cloners would dare to call it an Original Prusa i3 MK3s sold by Prusa Research by Josef Prusa.
My _favourite_ part of searching on AliExpress is that, when you’re logged in, 90% of any search results have nothing to do with, you know, the search query, and are just (related to) products you’ve previously looked at. Why?!?
To annoy me enough to send me to second-tier retailers I wouldn't otherwise use?
It never makes sense to intentionally return inapplicable search results. Think about it: product search is the ultimate advertising opportunity. A customer with money to spend is proactively telling you exactly what they want to spend it on. And you're going to go out of your way to piss this customer off?!
Bold strategy, Jeff, let's see how it works out for you.
> product search is the ultimate advertising opportunity
To me, this is what lends confidence to the idea that the results are hardly "inapplicable". The results may be quite applicable from Amazon's perspective.
This is just a guess, but it seems unlikely that all Amazon cares about is returning the exact perfect set of results that lead you directly to what you're intending to purchase. They may know that showing seemingly random results increases impulse sales of high profit items they have in local "get it today" warehouses. Or they know that people who search for the thing you searched for are n times more likely to buy Product X impulsively, but only if they show it to you on the first Monday morning of the month.
Or maybe they've lost their minds, and have tried to optimize and maximize profits from their recommendations that they're blind to much simpler approaches.
(Shrug) Well, their "applicable" search results cost them a four-figure order yesterday, when I was shopping for parts for a new PC build. It's not the first time I've given up in frustration when looking for something on Amazon.
Then there's the business of repeating the same search in a private browsing window and getting substantially different results. Another great way to flush business down the drain.
Brit here- I usually send money to friends and family using bank transfers with internet banking- it’s instant, there’s no fee (AFAIK) and all you need are someone’s account number, and sort code, which everyone has.
Is this just not an option in the states? It’s insane to me that y’all use (need??) third party apps for something as simple as sending money around.
Zelle is basically the US attempt at instant bank transfers. You can set it up and use it through your participating bank's app or through their online portal.
FedNow is no different from Zelle; it seems to me banks could still mess it up, and most of the complaints here (that you can't reverse a transaction you sent) would still apply to it, since that's kind of the point.
"FedNow Service features will help participating financial institutions conduct investigations and provide returned funds connected to fraud and errors. Beyond mitigating fraud through the design of the service, Stanescu noted that the Fed is exploring opportunities to collaborate with the industry on consumer education and outreach programs to help identify and prevent scams and promote strong enrollment and authentication processes. In the meantime, the value proposition inherent in irrevocability remains intact: receivers have protection and a guarantee that good funds have hit their account and can be used immediately."
My biggest complaint with Zelle is my bank helps me by including Zelle in my bank account with easy setup. Some banks it's just included. I'd like a hard lock out on it.
Wow this is the first I've seen of this, amazing it hasn't come across my radar. Seems like a major consolidation, tied closely to a government institution (or whatever the FRB technically is).
Can you explain what you mean by consolidation? It's essentially a standards-based collaborative approach not unlike other large payment networks like in the UK, Europe and India.
Apologies for the armchair commentary. "Consolidation" meaning commerce regulation and oversight more tightly consolidated than possible with technology (including paper notes) currently used.
> ...standards-based collaborative approach...
You have not said this explicitly, but for myself it is notable that this is not peer-to-peer, with both parties collaborating based on a standard. Instead it is clearinghouse. Unlike peer-to-peer standards, this would give the Fed Reserve at least a large dataset or at most a large control lever. From the linked article:
> Through financial institutions participating in the FedNow Service...
> Consistent with the Federal Reserve’s historical role of providing payment services...
There are a few bank-to-bank mechanisms (ACH, wire transfers) but they're slow (often multiple business days) and often have fees associated with them ($20+ for wires).
The lack of good transfer mechanisms is what has led to a proliferation of alternatives (e.g. Venmo, Cash App). Zelle has emerged as a bank-approved mechanism for "instant" funds transfer.
> had wires come in over the years and never participated in a conference call
Same. That said, if your transaction history is sketchy (e.g. large cash withdrawals following international wires) or the wire is coming from or going to a high-risk place, e.g. Russia or Turkey, your bank may opt to do this as an anti-fraud / anti-money laundering measure.
Sending an ACH is nearly free, banks just don't expose it because of the very poor experience when you get one of the numbers wrong. You can ACH people all day with Transferwise.
This is possible if both people use the same bank (Bank of America, Wells Fargo, Chase), but even with the relatively consolidated finance sector, the odds of this are not super high.
Woof. Adafruit + Raspberry Pi in a shipped product screams to me that they did not have a real electronics guy on their team.
https://ukdepartureboards.co.uk/ is the British equivalent of this, and it seems to do everything right (don’t own one, but have seen on Twitter)- optional subscription, and nice looking hardware (seems like they contracted out for that). Though at the minute I suppose there are barely any trains running here :)
This is all too common in my experience, "oh we could just use an arduino/pi and a hat and a peripheral" rather than "Design a system that does <x>". As an EE who spent their primary career programming (horrors I know) and in systems analysis, I see it as the logical extreme of "why use a 555 when I can program an ATTiny to be a timer and do other stuff too!"
The allure of having one be able to add features "with just a bit of code" is catnip to product managers. They seriously cannot seem to resist going there.
A attiny might not make sense, but you can get something like the PMS150C for around ~5ct, where it makes more sense to use a single MCU than a 555 with all the extra needed BOM Items.
The Code Quality section in the article also listed software red flags that point to the product being Amateur Hour. From the archive.org About Us link OP provided[1], there seemed to be plenty of "coders" but maybe not much embedded SW experience? They couldn't even agree on what language to use, whether to use tabs or spaces, and couldn't manage to produce a pristine Micro SD image without bash_history and a git repository littered onto it.
Kind of reminds me of a small company I used to work for where I noticed shortly after joining that they 1. had no source control or reproducible builds, and 2. ship Debug builds with symbols and no optimizations to customers, because they couldn't get the Release configuration to run without crashing.
Additionally, the composition of certified products does not lead to a certified product. Even adding an enclosure around a certified board implies the recertification.
That's an indescript rectangle that could just show anything and could be from anywhere. They are selling a specific shape of rectangle that shows stuff about London and aesthetically signals that it is from London.
> All implementation examples and reference designs contained within this Specification are
included as part of the limited patent license for those companies that execute the USB 3.0
True, though I imagine the agreement you’re thinking of isn’t the one they’re talking about here.
https://www.usb.org/document-library/usb-30-adopters-agreeme... is the agreement- it’s royalty free, basically “sign here, don’t patent our stuff”. Not “open source”, but it’s pretty reasonable for what you get IMO- we live in a world all about IP. Many international standards are worse. Plus, it’s not like they’re gonna sue you if you don’t sign it, unless you attempt patent shenanigans.
The $$$$ agreements for VIDs and trademark rights on the other hand… can’t say I’m too fond of those ones.
Encrypted iCloud! Never thought I’d see the day- figured intelligence agencies wouldn’t be a big fan- I guess it’s only optional though. Still won’t be using iCloud on my iPhone, but I could at least consider it.
I do wish someone would put up the paid for magic documents that allegedly contain the actual reasoning behind the choice of the E-series. I think this SE answer coould be true, but it feels a little contrived- and, at least to me, this is one of electronics history’s greatest mysteries.
The standards docs don't give you the reasoning behind decisions, that's all in the closed door meetings. And most of the time it's "because that's the way it is."
except in this case, given its title, the document almost certainly does exactly that: "ISO 497:1973, Guide to the choice of series of preferred numbers and of series containing more rounded values of preferred numbers" (mentioned in the answer on the post that was used to close the one HN links to).
The fact that ISO documents aren't just free PDF files with all rights past "viewing" locked down, charging businesses money for hard copies, is still one of the most blatant ways in which the ISO has held, and continues to hold back the world.
I'm not saying that standards shouldn't be freely viewable, but this isn't that big of a problem or unique to the ISO. There are hundreds of standards for manufacturing split across dozens of publishers and industry organizations (just for electronics you have JEDEC, IPC, ISO, and then 2-3 more depending on specific application domains).
If you're working in industry your company pays the pittance for membership as an organization then you pay the (relative) pittance for the doc and shove the PDF into your company's network store (unless they're jerks and lock it to a device).
Are you responding to something completely different? I was remarking on the "The standards docs don't give you the reasoning behind decisions" claim, which is almost always true, but in this case seems incorrect, given that there is a standards whose sole purpose is to give the reasoning behind the decisions.
I didn’t mention it in that post but that is _exactly_ the attack vector I had in mind also- even if someone stole my phone, Touch ID should stop them from getting at my passwords.