arkadiyt

65 ms·

901.
Dozens sue Amazon's Ring after camera hack leads to threats and racial slurs(theguardian.com)
42 points by arkadiyt 6y ago|0 comments
902.
US plans major expansion of facial recognition authority at airports(theverge.com)
1 points by arkadiyt 6y ago|0 comments
903.
Portable Data ExFiltration: XSS for PDFs(portswigger.net)
2 points by arkadiyt 6y ago|0 comments
904.
'Dozens of email accounts' were hacked at U.S. Treasury – Senator Wyden(reuters.com)
2 points by arkadiyt 6y ago|0 comments
905.
Exploring Rootless Docker(raesene.github.io)
1 points by arkadiyt 6y ago|0 comments
906.
Pasadena police pledged not to send license data to ICE. They shared it anyway(latimes.com)
2 points by arkadiyt 6y ago|1 comments
907.
by arkadiyt 6y ago
This password to their FTP server would have allowed you to upload arbitrary executables, but they still wouldn't be signed like a valid SolarWinds update would be, so it seems unlikely to be related to the recent hack. The real attack
908.
Journalists Hacked with Suspected NSO Group iMessage ‘Zero-Click’ Exploit(citizenlab.ca)
622 points by arkadiyt 6y ago|289 comments
909.
The U.S. has recorded over 250k cases in a day for the first time(nytimes.com)
61 points by arkadiyt 6y ago|26 comments
910.
Security Vulnerabilities in Smallstep PKI Software(agwa.name)
1 points by arkadiyt 6y ago|0 comments
911.
Insecure by Design, Epic Games Peer-to-Peer Multiplayer Service(billdemirkapi.me)
3 points by arkadiyt 6y ago|0 comments
912.
Investors in SolarWinds traded $280M in stock before hack was revealed(washingtonpost.com)
20 points by arkadiyt 6y ago|0 comments
913.
Keeping your GitHub Actions and workflows secure: Preventing pwn requests(securitylab.github.com)
1 points by arkadiyt 6y ago|0 comments
914.
CVE-2020-25695 Privilege Escalation in PostgreSQL(staaldraad.github.io)
3 points by arkadiyt 6y ago|0 comments
915.
CISA Issues Emergency Directive to Mitigate Compromise of Solarwinds Products(cisa.gov)
4 points by arkadiyt 6y ago|0 comments
916.
by arkadiyt 6y ago
No one is arguing a compromise of the update server doesn't allow compromising all customers. They're arguing that the benefits out auto-updating software (especially consumer software) outweigh the risk of a compromised update se
917.
Former Cisco engineer sentenced to prison for deleting 16k Webex accounts(zdnet.com)
2 points by arkadiyt 6y ago|0 comments
918.
by arkadiyt 6y ago
We've been using Sentinel by Hashicorp with great success for this. The language is a little awkward at times, but it has deep integration with Terraform - our policy rules have access to the entire terraform state, the details of the
919.
Facebook doxes APT32, links Vietnam's primary hacking group to local IT firm(zdnet.com)
4 points by arkadiyt 6y ago|1 comments
920.
by arkadiyt 6y ago
> it just doesn't seem like it's possible Mobile apps can do this with certificate pinning. Web apps used to be able to do this with HTTP Public Key Pinning (HPKP) [1], but it was deprecated because it was too much of a footgun
921.
by arkadiyt 6y ago
Yes, in fact government agencies like the Secret Service [1], CBP [2], IRS [3], and others frequently purchase it to circumvent warrant requirements. [1]: https://arstechnica.com/tech-policy/2020/08/secret-ser
922.
The Lengths People Go to Just to Avoid DNSSEC(agwa.name)
1 points by arkadiyt 6y ago|0 comments
923.
Getting Banned for Security Research(nedwill.github.io)
3 points by arkadiyt 6y ago|0 comments
924.
by arkadiyt 6y ago
> Blob file names are the SHA256 hash of the unencrypted blob contents Obviously this is needed to make block level deduplication possible, but it also means that for this "end to end encrypted" product someone can still tell w
925.
by arkadiyt 6y ago
Some secrets (like IAM access keys) can be encrypted with a public PGP key. Some other secrets (like RDS instance master passwords) can't be encrypted, but I like to use a trick where you have a local provisioner that runs after the in
926.
Cloud Native Security Whitepaper [pdf](github.com)
2 points by arkadiyt 6y ago|0 comments
927.
Privileged Container Escape – Control Groups Release_agent(ajxchapman.github.io)
2 points by arkadiyt 6y ago|0 comments
928.
by arkadiyt 6y ago
If you had access to a public key for every email address then why stop at authentication - you could encrypt all email on the web. But we don't, so we can't.
929.
by arkadiyt 6y ago
> rotating keys doesn't prevent non-repudation That's why he says Google also needs to publish the private keys.
930.
by arkadiyt 6y ago
Interesting/educational read but I'm still not convinced that this unintended side effect is a bad thing - it seems like a desirable property to have authenticated emails. Matt argues this might lead to regular folks (as opposed t

More ›