@kurtseifried@infosec.exchange avatar

kurtseifried

@kurtseifried@infosec.exchange

Chief Innovation Officer https://cloudsecurityalliance.org https://webfinger.io https://gsd.id and #osspodcast

This profile is from a federated server and may be incomplete. For a complete list of posts, browse on the original instance.

jerry , to random
@jerry@infosec.exchange avatar

Here is a short summary of the US presidential debate

video/mp4

kurtseifried ,
@kurtseifried@infosec.exchange avatar

@jerry if it’s any consolation, the upcoming Canadian election (on or before October 2025) looks like it’s gonna be a complete gong show. Canadian traditionally vote out a political party if they’re upset with it. So yeah…

jerry , to random
@jerry@infosec.exchange avatar

OooOooooO the heartburn regret of eating the whole order of Chang’s spicy chicken right before bed 🤢

kurtseifried ,
@kurtseifried@infosec.exchange avatar

@jerry Mostly I just take pictures of spicey food now and imagine what it would be like to eat it.

jerry , to random
@jerry@infosec.exchange avatar

I find it endlessly fascinating that the place with arguably the most data privacy protections (EU) are working to hard to remove the ability to protect one’s data (via breaking e2e encryption)

kurtseifried ,
@kurtseifried@infosec.exchange avatar

@jerry the EU government is often ok with protecting people from criminals and predatory US companies… but many EU countries (like all countries really) would like the ability to spy on their own people.

The US is a good example: Room 641A https://en.m.wikipedia.org/wiki/Room_641A and the Intelligence Community Comprehensive National Cybersecurity Initiative Data Center https://en.m.wikipedia.org/wiki/Utah_Data_Center are exactly why people wants to move to quantum resistant crypto sooner rather than later (the US gets SIGINT is a long game and decrypting 10-50 year old traffic can still be useful).

kurtseifried , to random
@kurtseifried@infosec.exchange avatar

So should we not do things unless they are perfect?

NO! OF COURSE NOT! ARE YOU INSANE?!?!?!?!

But maybe we should consider doing things that move the security needle from empty to ... less empty (full would be a dream). Find out with @joshbressers and @kurtseifried on the https://opensourcesecurity.io/2024/06/16/episode-433-should-openssh-block-misbehaving-clients/

There is no TLDR, it's a mess.

jerry , to random
@jerry@infosec.exchange avatar

The new factors for authentication
Something you wish you were
Something you want
Something that hurt you

kurtseifried ,
@kurtseifried@infosec.exchange avatar

@jerry a fast computer. All three.

jerry , to random
@jerry@infosec.exchange avatar

[Thread, post or comment was deleted by the author]

    •
    kurtseifried , (edited )
    @kurtseifried@infosec.exchange avatar

    @jerry @GrapheneOS @jo @simonzerafa I feel like people can disagree and be polite about it. Like do you really care if I’m right or wrong if I come to your house and start screaming at your house plants about whether or not the world is flat? No. You just want the crazy guy screaming out of your house.

    Edit: at -> out of

    kurtseifried , to random
    @kurtseifried@infosec.exchange avatar

    Should you redirect HTTP to HTTPS for a website? What about for APIs? @joshbressers and @kurtseifried thought this was a reasonably simple question and... well... as usual it turns out to be quite complicated and nuanced. Find out on the at http://opensourcesecurity.io/2024/06/02/episode-431-redirecting-http-to-https/ TL;DR: we should really make HTTPS the default, not HTTP for new stuff. I'm also still not sure how I feel about the cult of backwards compatibility (especially in light of the RJ tab toots).

    molly0xfff , to random
    @molly0xfff@hachyderm.io avatar

    just realized i've had the mollywhite.net domain for over 10 years(!!)

    related sneak peek into an upcoming piece: i firmly believe that if you're going to spend money on one thing online it should be a domain, particularly as online identity gets more fragmented. as platforms come and go, you can always find me there.

    kurtseifried ,
    @kurtseifried@infosec.exchange avatar

    @molly0xfff The problem is most people don't have the operational expertise to do this reliably on an ongoing basis, LTT talked about how they get a lot of resumes for technical positions with custom email/web domains that don't work. And if you want to do email you better make sure you use a provider with easy to setup SPF/DKIM/DMARC if you want anyone to read your email.

    Using Facebook/Myspace/whatever to host your online presence means you can lose it all if they stop working or delete your account, but doing it yourself with your own domain isn't 100% risk free either.

    Even well funded orgs with technical expertise mess this up: https://inti.io/p/when-privacy-expires-how-i-got-access

    jerry , (edited ) to random
    @jerry@infosec.exchange avatar

    The number of active Mastodon accounts continues to drop, including here on Infosec.exchange, however it’s dropping slower than elsewhere. According to https://fedidb.org/software/mastodon we are the number 4 (soon to be number 3) most active instance. I’m not sure whether to be happy or sad.

    kurtseifried ,
    @kurtseifried@infosec.exchange avatar

    @jerry I bet 99% of public comms people have never heard of Mastodon, but they have purchased a service that lets them schedule tweets for their client(s). Unless Twitter/X were to actively shut down, why would they come here?

    jerry , to random
    @jerry@infosec.exchange avatar

    The sheriff is out doing very low flybys to try to get people out of the water today due to strong rip currents. It’s not working so well.

    kurtseifried ,
    @kurtseifried@infosec.exchange avatar

    @jerry remember when we thought zombie films and jaws were dumb films because no way would people behave that stupidly?

    It turns out those films were wildly over estimating how people would behave when it comes to self preservation.

    elilla , to random
    @elilla@transmom.love avatar
    It's the "girl putting tuba on girl's head" meme. A schoolgirl in uniform is comically posing with a tuba covering the head of another schoolgirl, pushing her against the wall as if about to blast her ears of. The targeted schoolgirl is labelled as: "But there are some valid uses of LLMs, such as...". The tuba schoolgirl is labelled "me", and the tuba blasts, interrupting the other mid-sentence, are labelled with some screenshoted headlines: "AI's footprint is bigger than you think"; "AI is accelerating the loss of our scarcest resource—water"; "the obscene energy demands of AI".
    ALT
  • Reply
  • Expand (7)
  • Collapse (7)
    • + ben
    kurtseifried ,
    @kurtseifried@infosec.exchange avatar

    @alexaral @elilla @alice_watson I’m willing to listen, what exactly are you saying? We shouldn’t use AI at all because it uses energy?

    jerry , to random
    @jerry@infosec.exchange avatar

    I get 1password from from work... now that I am being kicked out, I need to figure out if I want to stay with 1Password... (and pay for it) 🤔

    kurtseifried ,
    @kurtseifried@infosec.exchange avatar

    @jerry well you could use lastpass, if you’re willing to ignore this: https://en.wikipedia.org/wiki/LastPass#Security_incidents

    kurtseifried , to random
    @kurtseifried@infosec.exchange avatar

    Remember when an entity (that totally isn't China) used to cripple UnitedHealth in the US? Good news, Canada is catching up, one of our main pharmacy chains in western Canada just got shut down "due to an operational issue" https://www.cbc.ca/news/canada/british-columbia/london-drugs-closure-western-canada-1.7187615 @briankrebs

    kurtseifried , to random
    @kurtseifried@infosec.exchange avatar

    @pluralistic Revenue Canada's terms and conditions of use is beyond draconian, like you can't even hit "save page" in your browser or even cut and paste without violating it:

    "You agree that you will not use any script, robot, spider, Web crawler, screen scraper, automated query program or other automated device or any manual process to monitor or copy the content contained in any online services."

    https://www.canada.ca/en/revenue-agency/services/e-services/digital-services-individuals/account-individuals/preview-account-terms-conditions-use.html

    And it's not like you can really opt-out of using this website/service (well I mean some people do, but that rarely ends well for them).

    pluralistic , to random
    @pluralistic@mamot.fr avatar

    Give the people what they want

    kurtseifried ,
    @kurtseifried@infosec.exchange avatar

    @TonyJWells @hmoffatt @ipsquiggle @pluralistic Edmonton is in the process of changing parking apps. There will be a gap, where you can scan a QR code to pay or something, it’s not clear. also people with balances under a certain amount will have their account balances wiped (oops I’m sure). Also the new company is apparently kind of a bit shit. https://www.reddit.com/r/Edmonton/comments/1bvwk16/edmonton_switches_parking_payments_to_hotspot/

    kurtseifried , to random
    @kurtseifried@infosec.exchange avatar

    Hey @lcamtuf regarding https://lcamtuf.substack.com/p/technologist-vs-spy-the-xz-backdoor

    "In today’s world, if you have the technical chops and the patience to pull this off, you can easily land a job that would set you for life without risking any prison time."

    What prison time? If they exploit it, yes that's classical hacking, but if they create the backdoor and then sell it to a company or government... what specific laws have they broken?

    A zealous prosecutor could definitely make a case around:

    "or causes to be communicated, delivered, or transmitted, ... to any person not entitled to receive it, or willfully retains the same and fails to deliver it to the officer or employee of the United States entitled to receive it;"

    But I'm not finding any specific statutes that ban the creation of a back door, and I know first hand of many commercial software entities that put backdoors/default accounts in, often at the customers request, e.g. "admin123" in a label printing software package to allow over rides, or an accounting package on a SCO server with an admin account that had a password of the companies+address name spelled backwards with alternating capitals so they could help provide adjustments and so on.

    kurtseifried OP ,
    @kurtseifried@infosec.exchange avatar

    @vathpela @lcamtuf Do we have any examples of a successful prosecution of this in this sort of scenario? Also as a defense I'd play the "I was doing a security test" like the University of Michigan did: https://www.theverge.com/2021/4/30/22410164/linux-kernel-university-of-minnesota-banned-open-source

    pluralistic , to random
    @pluralistic@mamot.fr avatar

    Hard to overstate how enshittified and botshitted Google Maps has become. Went looking for my local locksmith on Gmaps. Maps shows 20+ fake locksmith referral scam outlets and doesn't even register the real locksmith, despite it being fully visible in Street View.

    Instead, a red pin on the shop identifies it as a fake locksmith scammer. The real locksmith - which has been there SINCE 1942 (!!) and is a verified merchant - doesn't even show up.

    Google Maps, showing the storefront for Golden State Lock as an empty building.

    kurtseifried ,
    @kurtseifried@infosec.exchange avatar

    @tomjennings @bougiewonderland @pluralistic @AnnaAnthro two main comments: the phone is usually more correct than asking a random random person or themselves, And they are explicitly being told to follow the phone. These companies are not rewarding creativity. One minor comment: you can send feedback and get the maps corrected. I have done this in past when Google showed a road going through my backyard to the front street. I was unable to do this for example, with delivery apps where the log was the major road comes near my property, but they ignored the 10 foot wall between it and my property. Most engineers do not think about building, proper feedback loops into their software data systems. I think it can be generally summarized as false food program programmers believe about data: the data is correct.

    Narrator: the data was in fact, not correct.

  • All
  • Subscribed
  • Moderated
  • Favorites
  • •
  • random
  • test
  • worldmews
  • mews
  • All magazines
    •