snowwolf

15 ms·

91.
by snowwolf 8y ago
Yeah. Let’s just blow the entire months budget on a single day of consulting. And I’m sure one day is all they would need to understand the workflow requirements of the team, implement and configure it and test it. That seems reasonable.
92.
by snowwolf 8y ago
Ah yes I missed that. Hopefully they do explain the risks of using SMS. At least they don’t force you to use it unlike some sites.
93.
by snowwolf 8y ago
I don’t understand. If you’ve rightfully decided not to offer sms as a 2 factor option because of its poor opsec (number porting, sim cloning, etc.) why then offer it as a recovery option. Your 2-Factor is only a secure as the weakest recov
94.
by snowwolf 8y ago
How about having default conservative alerts built in for new accounts (not caps, just alerts). That way people who forget to set them will be reminded the first time they get one. An account that goes from $0 spend to $30k in 72 hours shou
95.
by snowwolf 8y ago
At the very least Google (and really all cloud services) could have reasonable default billing alerts built in. And automatic spike detection. I'd rather have default alerts already configured that I can change, rather than none.
96.
by snowwolf 8y ago
So how does this work? https://www.vegware.com/ I drank my hot coffee out of one today.
97.
by snowwolf 8y ago
A few of my local coffee shops are now using compostable cups and lids [1]. The problem is that there is nowhere to dispose of them. Quite a few of the rubbish bins now have general waste and recyclable waste sections, but it would be great
98.
by snowwolf 8y ago
Why did you need to write a script? GitHub allows you to enforce 2FA at the organisation level. https://help.github.com/articles/requiring-two-factor-authen...
99.
by snowwolf 8y ago
Possibly not, but it would have prevented the compromise in the first place. My advice was less about helping people affected by this and more about trying to prevent the next one.
100.
by snowwolf 8y ago
This would be a good time to stop what you are doing right now and enable 2FA everywhere you can think of if you haven’t already. If you control an organisation account enforce it for everyone (github, etc). I know some places implement it
101.
by snowwolf 8y ago
Some of the recent attack vectors I can remember: * An employee account was compromised - usually because they re-use their password and that password was exposed in an unrelated breach. And then failure to require 2 factor authentication f
102.
by snowwolf 8y ago
>> from a single leaked unhashed / unsalted password These days it’s becoming more common to have been compromised from multiple sources. And unfortunately storing passwords securely seems to still be too hard for a lot of compan
103.
by snowwolf 8y ago
As they have now done, they could have reduced the threat exposure by requiring 2FA to join the organisation, and using a password pattern scheme does expose you to a targeted attack so ideally encouraging password manager generated passwor
104.
by snowwolf 8y ago
Github allows multiple administrator accounts.
105.
by snowwolf 8y ago
Microsoft Research wrote a paper about this - basically it helps filter out the false positives. https://www.microsoft.com/en-us/research/wp-content/uploads/... [PDF]
106.
by snowwolf 8y ago
Well the email k-anonymity is new that he added for this integration and Troy addresses why he’s not yet using it on HIBP in the article.
107.
by snowwolf 8y ago
This also has anonymized email lookup (using the same model as passwords) that is new.
108.
by snowwolf 8y ago
As I understood it they were using machine learning models to identify attacks. Abuse and fraud strategies are constantly evolving, so the benefit of having many clients is that once you see a new attack strategy at one, you can instantly
109.
by snowwolf 8y ago
This whole thread is moral posturing about how unprofessional Twitter/Smyte have been, but if we want to talk about professionalism we should look at ourselves.
110.
by snowwolf 8y ago
1. You have an SLA guaranteeing 100% uptime? 2. If it's that critical, you have redundancy (an alternative provider, or a naive implementation that maybe causes more false positives but that will cover you during an outage)
111.
by snowwolf 8y ago
One thing that doesn't make sense is surely a service like this greatly benefits from the network effects of being able to see activity across multiple sites, so if Twitter wanted to continue using the technology, wouldn't they ha
112.
by snowwolf 8y ago
I'm not denying that what they've done is really bad, but who puts a 3rd party API in a critical path without having any fallback (alternative service, reasonable timeouts, etc.) for when it goes down (as almost any service will e
113.
by snowwolf 8y ago
“Invincible to the people who do not have a screwdriver” https://boingboing.net/2018/06/15/high-tech-lock-is-invincib... Which incidentally is also maybe and issue for tapplock https://www.theregis
114.
by snowwolf 8y ago
I'm not sure I mentioned GDPR? I merely said it would be interesting to see what the ICO do. The main problem is that a £400k fine was not sufficient to make them invest in their security, even after they knew they were definitely a ta
115.
by snowwolf 8y ago
Note that this is the second hack in 3 years they've had to disclose and they were fined £400k for that hack [1], which was obviously not enough to incentivise them to invest further in their security. Wonder what the ICO will do this
116.
by snowwolf 8y ago
> It works both ways. If you're too lazy to learn a service I chose to host my code, you don't deserve my code. Linus is that you? [1] in case you don’t get the reference. But in all seriousness this is a terrible attitude to h
117.
by snowwolf 8y ago
Exactly this. I can discover and contribute to many projects (creating issues, submitting pull requests, with discussion) without having to learn 100s of subtly different UX each “distributed” system chooses to implement it. And I know most
118.
by snowwolf 8y ago
So the author of this has a vested interest in their "solution" being the correct one, but I fundamentally disagree with it. I agree with their hypothesis that we are bad at planning/estimating, but the solution is not spendi
119.
by snowwolf 8y ago
Because it’s an indicator of a loss of independence. And if you went through the Skype changeover you’ll know exactly what a fiasco that change to a Microsoft account was.
120.
by snowwolf 8y ago
I’ve seen many acquisitions commit to 2) only to slowly walk back from that “in the interests of operational efficiencies”. And next thing you know you have to change over to using a Microsoft account to log in...

More ›