akerl_

26 ms·

661.
by akerl_ 1y ago
You're thinking of the CAB, which dictates which CAs are trusted. Google is a participant in that. The things they dictate are public and have to do with security requirements, not whether or not they pay Google money.
662.
by akerl_ 1y ago
This only works because you company's endpoints have been configured to trust the company's root CA. Which makes sense, because it's their device and their VPN.
663.
by akerl_ 1y ago
I trust the WebPKI infra quite a bit. Cert validation is publicly logged, CAs that do nefarious things get booted from browser trust stores. I can set which CAs can sign certs for my domains, and monitor if any are issued that I didn't
664.
by akerl_ 1y ago
I guess we could organize regional parties where site operators and users meet up and exchange key material. I'm sure that will scale and won't have any problems of its own.
665.
by akerl_ 1y ago
This is the sleight of hand being employed when folks suggest TOFU mechanisms. The problem with any communication boils down to trust. The modern web PKI has a bunch of complexity and a plenty of rough edges in how it handles resolving that
666.
by akerl_ 1y ago
MITM of unencrypted HTTP was so common that it was outright a business model for many ISPs. Anybody could look up a guide online on how to monitor who at their starbucks was logging into Facebook or whatever. We were having to train a gener
667.
by akerl_ 1y ago
Why are you speaking like having a secure device and a powerful device are exclusive options?
668.
by akerl_ 1y ago
> Would you buy a hammer that can't ever hurt your thumb? Yes.
669.
by akerl_ 1y ago
As an aside to the discussions of the implications of how OTAs work / how they’re tested / etc: I saw this post while sitting in a 2024 4xe which was not bricked, so it doesn’t appear to be all of them.
670.
by akerl_ 1y ago
Sure. I’m not going to nitpick exactly how long or how severely something has been rendered inoperable. If somebody wants to refer to their phone as a brick because they’re camping and forgot the charger, that doesn’t bother me. I’m just pu
671.
by akerl_ 1y ago
I think this may have more to do with a combination of insufficient imagination and fault-tolerant manufacturing. There are plenty of devices that can be rendered inoperable via non-physical destruction. There used to be more of them, but m
672.
by akerl_ 1y ago
The entire premise is that you’ve turned the device into a brick. If the failure is recoverable, it’s not a brick.
673.
by akerl_ 1y ago
Does it? Pretty sure that logging in as root generates one cloudtrail per action, regardless of whether or not you did it with a saved password or you reset the password. Resetting the password doesn't generate a cloudtrail event as fa
674.
by akerl_ 1y ago
Given the context of the post, it seems like "Enabled AWS CloudTrail, GuardDuty, and DataDog alerting" means "enabled alerts via CloudTrail, GuardDuty, and Datadog", not "enabled Cloudtrail logging". Otherwise
675.
by akerl_ 1y ago
By "massive papertrail" do you mean "a pair of emails to the associated address"?
676.
by akerl_ 1y ago
So the solution for this isn’t actually usable?
677.
by akerl_ 1y ago
I think you're missing a hidden satire tag
678.
by akerl_ 1y ago
There are certainly phishing attempts that are pixel perfect, but I'd say way more energy tends to go into making phishing websites perfect. The goal of the email is to flip people into action as quickly as possible with as little vali
679.
by akerl_ 1y ago
I don't know where the official list of "standard company" stuff is, but I'd wager that for small to medium sized tech companies, it's relatively unsurprising for "leadership" to still be in the weeds on v
680.
by akerl_ 1y ago
I think you'll be led astray thinking this is CEO-specific. The whole theory of phishing, and especially targeted phishing, is to present a scenario that tricks the user into ignoring the red flags. Usually, this is an urgent call to a
681.
by akerl_ 1y ago
Sure; the fix for that is blocking unexpected USB devices on corporate devices.
682.
by akerl_ 1y ago
Yes; 1Password was used. And it worked properly. But because humans are fallible, a human made a mistake anyways. "Properly working password managers" do not provide a strong defense against real world phishing attacks. The weak l
683.
by akerl_ 1y ago
It’s a bold move to typecast all CEOs as uniquely vulnerable to a problem that the evidence shows every single one of us is vulnerable to. Blaming some attribute about user as why they fell for a phishing attempt is categorically misguided.
684.
by akerl_ 1y ago
Sure. Except this is a story about the user manually copying the credential into a phishing site after the password manager didn’t fill it in. Whether that’s via a hotkey or not seems totally irrelevant.
685.
by akerl_ 1y ago
User security that doesn’t meet real users where they are is just nerd theatre.
686.
by akerl_ 1y ago
Autofill and the hotkey use the same mechanism, and neither is going to work on a phishing site.
687.
by akerl_ 1y ago
Which is why a properly working password manager is not a strong defense against phishing.
688.
by akerl_ 1y ago
I think you mean Kurt.
689.
by akerl_ 1y ago
FIDO2 won’t send an authentication to a fake site, no matter what the human does. That’s what makes it phishing-resistant.
690.
by akerl_ 1y ago
Isn’t turning off auto enter exacerbating the problem? The avenue for catching this is that the password manager’s autofill won’t work on the phishing site, and the user could notice that and catch that it’s a malicious domain

More ›