psanford

28 ms·

331.
by psanford 5y ago
Ideally, I'd have 2 webauthn tokens, one that I keep on myself, and one that I have at a secure, off site location (like a safe deposit box, if you consider that secure). The problem is you need to physically posses the backup key to r
332.
by psanford 5y ago
Nebula uses public key certificates, but they are not x509. The nebula certificate format uses protobuf for its encoding.
333.
by psanford 5y ago
Feynman was the youngest group leader at Los Alamos. He was also fairly instrumental in ensuring Oak Ridge didn't have an accidental criticality incident due to the way they were storing uranium oxide.
334.
by psanford 5y ago
Not quite. aws-vault still reads the secret out of the backend to create session credentials. You likewise could read the backend directly to get the credentials (assuming you are authenticated). With the secret stored in a tpm it cannot be
335.
by psanford 5y ago
If you are looking for some references besides my linked code, this comment[0] on the tpm2-tools repo will probably be useful. FWIW, I've moved my workflow over to having long lived aws keys protected by my TPM and then I generate sess
336.
by psanford 5y ago
Neat! An HSM sounds like way overkill for a developer machine, but I could see that being useful for other use cases. The TPM is a good option because every non-Mac ships with one already (and there are similar facilities available on macs)
337.
by psanford 5y ago
If the ECDSA key pair is still derived using an hmac keyed by the private key, I can do that with the key loaded in the tpm. Otherwise it is unlikely to work with my current setup. Once the key is loaded into the TPM as an HMAC key, you can
338.
by psanford 5y ago
This is neat, although it throws a wrench into my recent move encrypt my AWS secret access key with my TPM to prevent the key from being used anywhere besides my laptop[0]. [0]: https://github.com/psanford/awsv4signer&#
339.
by psanford 5y ago
The TPM 2.0 spec has the ability to duplicate keys from one TPM to another for this type of use case. It of course requires the key policy to allow for duplication, so you have to plan ahead of time, but it is possible.
340.
In which a laptop defies the trends(technomancy.us)
56 points by psanford 5y ago|35 comments
341.
by psanford 5y ago
Being translated means it doesn't have the normal cgo calling overhead. It also means you can cross compile it for every platform that the Go toolchain supports without any external compilers.
342.
by psanford 5y ago
gopass already supports age: https://github.com/gopasspw/gopass/blob/master/docs/backends...
343.
by psanford 5y ago
gopass already has support for an age backend: https://github.com/gopasspw/gopass/blob/master/docs/backends...
344.
by psanford 5y ago
If you are using SQLite and care about performance, be sure to run in WAL (Write Ahead Log) Mode: `PRAGMA journal_mode=WAL;`[0]. WAL mode is significantly faster and does not have a "stop-the-world write lock" ("Reading and w
345.
by psanford 5y ago
There's a bunch of projects that have implemented this. I wrote a SQLite VFS in Go that lets you query a read-only SQLite db over http (including from s3) [0]. The VFS API offers the possibility for weirder storage solutions, if thats
346.
by psanford 5y ago
You can still use https:// for unauthenticated access to public repos.
347.
by psanford 5y ago
Without more details its really hard to say. One would assume that Microsoft is at least competent enough to notify potentially affected customers.
348.
Efficient QR Codes(imperialviolet.org)
2 points by psanford 5y ago|0 comments
349.
by psanford 5y ago
Yikes. 30% of Cosmos DB customers were vulnerable to this attack. I'm really looking forward to seeing the details of this exploit. It sounds like it was a service authorization that failed to check account boundary limits. That is a m
350.
ChaosDB: Unauthorized Privileged Access to Microsoft Azure Cosmos DB(chaosdb.wiz.io)
63 points by psanford 5y ago|7 comments
351.
by psanford 5y ago
I do the same. I wrote[0] a little wrapper around this workflow that does a few additional niceties: 1) normalizes column names and removes whitespace, 2) supports importing multiple csv files without importing the header line as a record.
352.
by psanford 5y ago
Yup, there's a flag `-backend memory` that generates ephemeral keys in memory.
353.
by psanford 5y ago
I made a FIDO token (a platform authenticator) implementation that uses the TPM to protect your private keys on Linux: https://github.com/psanford/tpm-fido
354.
by psanford 5y ago
Nope. For accounts created before 2017, if you change the root account's email address it changes the Amazon.com retail account's email address as well. This is documented behavior by AWS[0]: > If your AWS account and Amazon.co
355.
by psanford 5y ago
That doesn't work for old accounts. Changing your root email address will also change it for the retail account. This is documented behavior by AWS: https://aws.amazon.com/premiumsupport/knowledge-center/trans
356.
by psanford 5y ago
Sounds like a problem if you are an AWS Serverless Hero, but for the rest of us I think there is comfort in the fact that AWS identities are not a massive privacy invasion.
357.
by psanford 5y ago
CSV files are terrible, but I love them. I love sites that offer an "Export to CSV" option, because I know I can take that export and start working with it immediately. I can give that CSV file to my Dad, who can open it in Excel,
358.
by psanford 5y ago
For accessing the database I use sqlite3vfshttp[0] with an s3 presigned url for authentication. [0]: https://github.com/psanford/sqlite3vfshttp
359.
by psanford 5y ago
Athena is great for if you have _a lot_ of data. It isn't great for real time queries. I use a SQLite database stored in S3 + SQLite's FTS5 for a really cheap full text search implementation.
360.
by psanford 5y ago
I just implemented something similar in Go[0]. Just yesterday I added the ability to compile it as a loadable sqlite3 extension, so you can use the normal sqlite3 cli tool to query databases hosted on an http(s) connection. [0]: https:&#x2

More ›