g_p

61 ms·

571.
by g_p 6y ago
The issue with this would be counter synchronisation, as services shouldn't accept cloned responses when the counter ceases to be monotonic for what should be one single device.
572.
by g_p 6y ago
While not cryptographic level auditing, this is arguably a UX feature for sites to implement -- on their inevitable loading spinner after login, they could show you the U2F tokens enrolled, and their most recent use on a small timeline. If
573.
by g_p 6y ago
Interesting and disappointingly. In this case I was testing it with play services, using the nextcloud app. I believe they are using something slightly custom from an open SDK, and suspect the outdoor was at their end. It seems strange Goog
574.
by g_p 6y ago
This is the biggest weakness of U2F unfortunately. My approach is to keep a list (a simple text file) of what services are used for U2F, and which keys are enrolled with it. Most services ask or require you to name the token you enrol (if t
575.
by g_p 6y ago
> I don't think you even can do this. I'm not entirely sure how FIDO works, but I think the key is basically derived from some kind of "master" key combined with the domain you're connecting to. So the key doesn&
576.
by g_p 6y ago
It's a good question, and I believe they mean in terms of the epoxy making it harder to get easy access to the chip to do any shenanigans. It's worth remembering the threat model for U2F tokens (let's set aside PIV, FIDO2, et
577.
by g_p 6y ago
1. I'm not aware of any drivers being needed on any common platform. Support in Android apps is sometimes not perfect, but that's an app issue rather than a driver issue. 2. No software is required - far easier to use than you des
578.
by g_p 6y ago
> When I ask how they organize their school files, they either use Google Docs for everything (all in one folder) or, if they use Word, they have one folder with all their documents named, "New Document", "New Document (1)
579.
by g_p 6y ago
Another deterioration I've noticed in knowledge is around the amount of understanding of a filesystem. There's a growing generation that don't properly understand files, folders and directory structures, as they learned their
580.
by g_p 6y ago
Cell towers are generally going to be actively defended though - they tend to connect to private backhaul circuits, or link by IPsec to the security gateway in the mobile network. The difference here is that nobody takes responsibility for
581.
by g_p 6y ago
While horrifying, this is just the tip of the iceberg. Huge amounts of important infrastructure sits internet connected due to individual laziness, coupled with a lack of willingness to understand and think about cyber security. Often it se
582.
by g_p 6y ago
From a technical perspective, you're of course right. I fear however that the majority of "regualar users" are being coerced into giving consent without realising what is happening - seeing the number of people end up in a FO
583.
by g_p 6y ago
It does seem like when IDFA goes, apps will be struggling for identifers, at least on iOS. I've seen a few articles suggesting they will be back to trying to fingerprint devices (in manners that break the App Store terms of service). I
584.
by g_p 6y ago
Agreed - it really is absurd. One time I tried to design as a thought experiment a "platform" where each execution environment of the app was absolutely indistinguishable from any other. Unfortunately to make it work you can'
585.
by g_p 6y ago
From a European perspective, EU regulation 2019/1150 covers protections for business users of online intermediation platforms [1]. Article 4 sets out a range of protections for business users, including a requirement to provide "a
586.
by g_p 6y ago
EU regulation 2019/1150 would seem to be the first real attempt I'm aware of at addressing this issue. Article 4 covers suspension and termination, with intermediary platforms (i.e. Google, Facebook et al) "the opportunity to
587.
by g_p 6y ago
> We are at a point where auto-updates are more risky than the security flaw itself - especially since iOS has a pretty good sandbox, especially since its impossible for one app to access the data of another. Additionally, the App usuall
588.
by g_p 6y ago
I wonder how quickly (if this goes ahead) it descends into Kafka-esque cycles of automation resulting in people getting locked out of fundamental services due to the plethora of edge cases that aren't convenient and scalable for the te
589.
by g_p 6y ago
Gov.UK is built around an assumption users have no or broken JavaScript, based on some of their research into how people use the site. When running at scale, they found about 1 in 93 visitors didn't have working JavaScript. [1] Mid sta
590.
by g_p 6y ago
The UK has found many, and documented outline details of them in annual public reports, like [1] In outline: - Version management issues, with different firmwares being used for each operator, with significant variations in each one [1]. -
591.
by g_p 6y ago
In the UK where Huawei is on a phase-out, Open RAN is a bet by operators to ensure that they have more than 2 vendor options. They are required right now to use 2 vendors, so they are not solely reliant on any one company for their equipmen
592.
by g_p 6y ago
I think there's a growing acceptance that SS7 is a protocol from the past. It's based on a set of assumptions (around telecoms operators being trustworthy) that just never held true. The problem is that it continues to be the lowe
593.
by g_p 6y ago
It would be interesting to see how this process works for someone whose account has been disabled. Clearly Facebook won't want manual requests. Any European users could make 2 requests - one for access to their data, and one to exercis
594.
by g_p 6y ago
I think part of the problem at FB's scale is getting any level of consistency across human moderation. If you ask 10 good, experienced, human moderators whether a controversial post is allowed, you'll probably get at least 15 diff
595.
by g_p 6y ago
> Chances are most of the people you talk to are hiring or know people who are hiring. Definitely this. And if they like you, and their company isn't hiring, they might even be able to get them to hire you. Good and enthusiastic sec
596.
by g_p 6y ago
Absolutely echo this. You need to really start with the basics, and focus on understanding (i.e. asking yourself) *how* and *why* everything works and happens. In order to find vulnerabilities, you need to understand how a system works, and
597.
by g_p 6y ago
I can sympathize with the comment, and know for a fact it's true in a lot of fields, including ones it shouldn't be done in due to similar skills niches. Despite this, as you say, I've usually seen CVs/resumes come strai
598.
by g_p 6y ago
If you're doing well at CTFs and HTB and similar, I guess you are now at the point where you should start to look at networking. Clearly given world circumstances right now, in-person networking events are not likely to be happening, b
599.
by g_p 6y ago
Out of interest, are these larger, and more "corporate" focused shops? I have directly worked with a range of client companies, and none cared about certs (even government!) I'm wondering if OSCP is an "easy resume filte
600.
by g_p 6y ago
Certifications are far less important than this article makes out - this roadmap seems to really just be a roadmap of certifications for some reason, rather than a true roadmap for a beginner. If you focus on certificates, you won't ga

More ›