Royce Williams

Just doing my undue diligence.

ISP vet, password cracker (Team Hashcat), security demi-boffin, YubiKey stan, public-interest technologist, AK license plate geek. Husband to a philosopher, father to a llama fanatic. Views his.

Day job: Enterprise Security Architect for an Alaskan ISP.

Obsessed with security keys:
techsolvency.com/mfa/security-keys

My 2017 #BSidesLV talk "Password Cracking 201: Beyond the Basics":
youtube.com/watch?v=-uiMQGICeQY&t=20260s

Followed you out of the blue = stole you from someone I respect.

Blocked inadvertently? Ask!

Am I following a dirtbag? Tell me!

Suggestions welcome!

Photo: White 50-ish man w/big forehead, short beard, & glasses, grinning by a display of Alaskan license plates.

Boosts not about security ... usually are.

Banner: 5 rows of security keys in a wall case.

#NonAIContent

#hashcat #Alaska #YubiKeys #LicensePlates

P.S. I hate advance-fee scammers w/heat of 400B suns

❤️:⚛👨‍👩‍👧🛡🙊🌻🗽💻✏🎥🍦🌶🍫!

Public Key

npub1l4uw5jf7geh9gq658wjsga0g4nrez4l28w45yw6n77q238yjgglqykte68

NIP-05 Address

tychotithonus@infosec-exchange.mostr.pub

Profile Code

nprofile1qqs06782fylyvmj5qd2rhfgywh52e3u32l4rh26z8dfl0q9gnjfyy0spz4mhxue69uhhyetvv9ujuerfw36x7tnsw43q76n3ka

Publishing to

relay.ditto.pub

Author Public Key

npub1l4uw5jf7geh9gq658wjsga0g4nrez4l28w45yw6n77q238yjgglqykte68

Show more details

Published at

2026-05-22T16:01:53Z

Kind type

0 Metadata

Event JSON

{ "id": "58b7408f38b09a6858e71083d58edd2bc3ecb9be042b96a2d91d27c695c63c49", "pubkey": "fd78ea493e466e5403543ba50475e8acc79157ea3bab423b53f780a89c92423e", "created_at": 1779465713, "kind": 0, "tags": [ [ "proxy", "https://infosec.exchange/users/tychotithonus", "activitypub" ], [ "client", "Mostr", "31990:6be38f8c63df7dbf84db7ec4a6e6fbbd8d19dca3b980efad18585c46f04b26f9:mostr", "wss://relay.ditto.pub" ] ], "content": "{\"name\":\"Royce Williams\",\"about\":\"Just doing my undue diligence.\\n\\nISP vet, password cracker (Team Hashcat), security demi-boffin, YubiKey stan, public-interest technologist, AK license plate geek. Husband to a philosopher, father to a llama fanatic. Views his.\\n\\nDay job: Enterprise Security Architect for an Alaskan ISP.\\n\\nObsessed with security keys:\\ntechsolvency.com/mfa/security-keys\\n\\nMy 2017 #BSidesLV talk \\\"Password Cracking 201: Beyond the Basics\\\":\\nyoutube.com/watch?v=-uiMQGICeQY\u0026t=20260s\\n\\nFollowed you out of the blue = stole you from someone I respect.\\n\\nBlocked inadvertently? Ask!\\n\\nAm I following a dirtbag? Tell me!\\n\\nSuggestions welcome!\\n\\nPhoto: White 50-ish man w/big forehead, short beard, \u0026 glasses, grinning by a display of Alaskan license plates.\\n\\nBoosts not about security ... usually are.\\n\\nBanner: 5 rows of security keys in a wall case.\\n\\n#NonAIContent\\n\\n#hashcat #Alaska #YubiKeys #LicensePlates\\n\\nP.S. I hate advance-fee scammers w/heat of 400B suns\\n\\n❤️:⚛👨‍👩‍👧🛡🙊🌻🗽💻✏🎥🍦🌶🍫!\",\"picture\":\"https://media.infosec.exchange/infosec.exchange/accounts/avatars/108/195/621/247/550/549/original/d96204cc09c9dbfe.jpg\",\"banner\":\"https://media.infosec.exchange/infosec.exchange/accounts/headers/108/195/621/247/550/549/original/a838db735a039849.jpg\",\"nip05\":\"tychotithonus@infosec-exchange.mostr.pub\",\"fields\":[[\"Stuff\",\"https://www.techsolvency.com/roycewilliams/mastodon\"],[\"Keybase\",\"https://keybase.io/royce\"],[\"GitHub\",\"https://github.com/roycewilliams\"],[\"LinkedIn\",\"https://www.linkedin.com/in/roycewilliams\"],[\"Gravatar\",\"https://gravatar.com/tychotithonus\"],[\"Not \\\"dehashed\\\"!\",\"https://www.techsolvency.com/passwords/dehashing-reversing-decrypting/\"]]}", "sig": "90998a3dff4b1b560dd5751e63cac898e73189553c4f9c45ae57b419b6d26c93a78a6054c0b2bec34280700d9a566cb6e683e820b6a45877875ddad598506294" }

Last Notes

2026-04-03 20:12:52 UTC

- reply

@nprofile…n8vl Ah, absolutely makes sense!

2026-04-03 15:28:40 UTC

- reply

@nprofile…n8vl Fair, though I'm not clear enough on how typing always works to understand that something could be the correct type, but still unwanted data (but maybe this is too belt-and-suspenders)

2026-04-03 08:41:36 UTC

- reply

@nprofile…n8vl I guess so, but, I mean, lots of stuff can be a "source of bugs". A I'm just not clear of why many languages don't think that it's worth adding and keeping current. Feels like a huge security win.

2026-04-03 03:40:02 UTC

Why did they remove from Ruby the equivalent of Perl's data "taintedness" tracing mechanism?

2026-04-01 06:23:49 UTC

The latest Pixel Watch update seems to have taken away the ability to show the weather for a fixed location. As far as I can tell, the only way I can see what the temperature is in my town ... is to turn on location.

2026-03-24 19:43:18 UTC

- reply

@nprofile…75wv They often can't tell the difference between a legit message that says that, and a fake / malicious message that says the same thing. So they ignore / distrust them all.

2026-03-05 07:13:10 UTC

- reply

@nprofile…3k8n It's a fair point, for that kind of scale. I had in mind smaller things like bash scripts, etc as well!

2026-03-04 17:52:35 UTC

Inside every temporary print() statement ... is a debug/verbosity level trying to get out.
Don't throw away that situational wisdom -- cache it.

2026-02-22 20:06:13 UTC

- reply

@nprofile…6z3g holy crap ... did he just ... flush them? or were they they before? Wild

2026-02-20 15:54:47 UTC

"The tech industry's future is one in which you rent computing power from them, accessed via a locked-down device without the ability to operate on its own. The inputs and outputs of your computing will be mediated and captured by language models that obscure sources and process from you."
💯
#nevent1q…ss09

2026-02-01 21:14:03 UTC

Based on the drop in quality for Google Search, I assume the long game is to justify retiring it (due to low usage), and replace it with paid Gemini plans.

2026-01-24 19:59:03 UTC

- reply

@nprofile…3d77 Ahhh, yeah. If your APP'ing a non-critical account, totally different calculation. And yay Graphene! No idea what APP even translates to in that space, that's super interesting. IIRC APP is at the Google Play layer, so I guess I shouldn't be surprised!

2026-01-24 19:38:25 UTC

- reply

@nprofile…3d77 I see the appeal! Though I can also conceive of 1Password access failure modes ... for which having an independent option -- a local, usually airgapped, no modifiable firmware, no batteries required, physically secureable option -- could be prudent.
Your Threat Model May Vary, of course -- just raising my hand about the potential attractiveness of a diversity of options. 🍻

2026-01-24 19:26:54 UTC

- reply

@nprofile…3d77 Nice!
Recommendation: if you're not doing physical security keys, acquire a couple so that you have a strong auth path if your phone is unavailable.
Also, if you have an Android 16 device, you can also active it at the per-device level, but there are trade-offs:
https://infosec.exchange/@tychotithonus/115937015503110004

2026-01-18 16:16:35 UTC

- reply

@nprofile…uygl I'd be curious to see specifics about your choices, if you are at liberty to disclose!

2026-01-12 18:12:41 UTC

Good morning to everyone except Anthropic, who have decided to hijack the ubiquitous Control-Shift-I (which opens Developer Tools in some browsers), to instead open a new Claude private chat session.

2025-12-16 14:45:34 UTC

I swear, they studied how people accidentally touch their Android phones ... and put all of the Gemini buttons there.

2025-11-18 02:19:44 UTC

I swear some accounts are tracking moderately viral posts, feeding them to LLMs to amplify their virality, and then reposting.

2025-11-07 00:35:27 UTC

The kids can't eat without something to scroll. It terrifies me. When can we rest? When can we have ideas? When can we connect?

2025-11-06 18:07:00 UTC

- reply

@nprofile…va3u And TIL some famous actors invested in 1Password. Huh.

2025-10-28 06:01:15 UTC

We must protect Debian at all costs. 🤩

2025-10-24 15:54:25 UTC

- reply

@nprofile…g7vf Ditto, had no idea. Wish I had learned it sometime other than on-site trying to get the cable to work 😬. Ebay for the win for next time, at least!

2025-10-24 15:47:06 UTC

- reply

@nprofile…g7vf It turns out the physical security holes on the side of a Framework 12 are a "Kensington nano" slot, not compatible with my standard Kensington cable set. 😬 As bulky as this device is, seems like a standard Kensington would have been fine. 😐

2025-10-20 18:42:35 UTC

- reply

@nprofile…n2xw Among other things, I think they don't sufficiently simulate its absence / misconfig.

2025-10-20 13:11:02 UTC

- reply

@nprofile…4unj Absolutely. He worked at smaller places here in Anchorage first, and it was an absolute delight to drop in and be served by him. He was good sizing up people to determine what level of interaction / humor they would enjoy. And of course, if he already knew you, he could begin to work immediately. 😁

2025-10-20 07:05:57 UTC

One of my buddies from high school and college became a sommelier at some fancy places, and it's been such a great career fit for him, knowledge / trivia, plus insight, plus talking to people and helping them, plus a little bit of performance/ shmoozing but not too much.

2025-10-17 15:53:19 UTC

- reply

@nprofile…p7lw there's a reason I cropped that picture of the book before I posted it 😉😅😬😁

2025-10-12 04:24:04 UTC

- reply

@nprofile…d82u Indeed it does.

2025-10-12 04:22:10 UTC

- reply

@nprofile…d82u Of course, the focus will be on high return, such as discovering pharmaceuticals that can be billed at $30,000 a month.

2025-10-10 05:43:03 UTC

- reply

@nprofile…67n0 Nailed it! Thank you!

2025-10-09 21:46:27 UTC

- reply

@nprofile…67n0 Thanks, that's clarifying! (Maybe a small doc tweak to over-communicate that?)

2025-10-09 20:13:56 UTC

- reply

@nprofile…4zm4 You're definitely not alone. But there's a whole generation of folks for whom their person-to-person video interaction is exactly like that, so it's normal for them. Not saying I like it, but ... it's a thing

2025-10-09 08:40:37 UTC

- reply

@nprofile…3nsk It's not that the bot is old, it's that if they have certain older versions blocked, they block a ton of the bots. I assume they have the data necessary to determine the false positive rate I don't think they intend to exclude older browsers per se, but maybe they do?

2025-10-09 04:10:20 UTC

- reply

@nprofile…3nsk I have seen this, but usually because for whatever reason, a lot of bot-ish stuff has User-Agents that run significantly behind current

2025-10-08 03:27:23 UTC

- reply

@nprofile…k0zs Hey, cooool! I only checked the 16 - good catch.

2025-10-07 15:55:52 UTC

Framework laptop feature request: Kensington lock slot.

2025-10-07 07:04:30 UTC

- reply

@nprofile…8wcz Ha! Reminds me of a Star Trek comedy set from a while back:
Captain Kirk: I'll just see what's in this utility closet here...
panting sounds
Captain Kirk: What are you two ensigns doing in here?
Ensign 1: it's okay sir; we're engaged!
Captain Kirk:
Captain Kirk: Well, disengage and get back to your posts!

2025-09-17 16:02:56 UTC

Hey, the runZero docs say:
You do not need to use an interface connected to a SPAN or TAP port; a regular network interface will work.
But does this mean that there's no value in setting up a span, if you can?
#runZero

2025-09-09 16:35:37 UTC

- reply

@nprofile…tg95 @nprofile…qx0v
Hey, I know some of those people! 😉

2025-08-28 15:16:20 UTC

Turns out using "max my Uber/Lyft ratings" tips for drivers are also a great way to make life better for you and your private passengers -- but with more creative control.
Snacks? Charging? Lint roller? Tissues? The sky's the limit. #KidCarpoolTales
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/107/042/997/730/175/original/3dd47ed894ffffb4.png

2025-08-24 14:14:14 UTC

It's interesting that Android implicitly assumes that "I should be sleeping" and "make the screen extra dim" are mutually exclusive.
Which is, of course, ironic: maybe if the screen was less bright when you needed to check it in the off hours, you'd be ... less likely to wake up more?
The missing option: "automatically enable Extra Dim when Bedtime Mode or Sleeping are active"

2025-08-18 14:56:34 UTC

These can both be true:
Passkey deployment has been fraught with UX challenges, failures to advise users about threat model trade-offs, and vendor lock-in concerns
The ecosystem couldn't go much longer without the benefits of passkeys (reducing password reuse risk, mitigating infostealer harm, and deploying FIDO2 phishing resistance at scale)
#Passkeys

2025-06-26 16:03:45 UTC

Collab / call platforms:
Just add a
"When someone shares their screen, give all other attendees a 'Can you see what is being shared? Yes / No' button
already.

2025-04-29 19:58:47 UTC

- reply

@nprofile…r0kn Linux should also be taking crap for this. 😅

2025-04-08 20:49:15 UTC

- reply

@nprofile…naem Someone needs to write a browser extension that adds a "first date this page was seen on the Wayback Machine" floating box thingie.

2025-04-02 18:56:42 UTC

- reply

@nprofile…z76w I'd even say that every user is born a "cloud as last resort * user, and only trained into "cloud only" by market pressures.

2025-04-01 01:39:03 UTC

- reply

@nprofile…q5wq How about midnight UTC?

2025-03-30 21:31:30 UTC

OMG but Mastodon needs a "filter stuff I've already liked or bookmarked" option.
Do I support multiple boosts, because different people have different followers? Definitely!
But do I really need to see the same article boosted 30 times? No.

2025-03-24 15:34:42 UTC

- reply

@nprofile…y63h
I think it's telling that we only recently reached the "Gmail / Yahoo start enforcing" point last year. We're dealing with 30+ years of legacy, default-open email architecture, for an ecosystem that (for good or ill) has become the "lowest common denominator" of comms (and MFA) for decades. Heck, how long did it take us to get rid of open SMTP relays? (Trick question: we didn't -- but they're a small-enough percentage now to no longer be a significant percentage of the problem)

2025-03-24 15:29:55 UTC

- reply

@nprofile…y63h
@nprofile…y63h Fair -- I definitely put DMARC in the "necessary but not sufficient" category. We can't reach the "tipping point" of empowering users to trust the sending domain until sender spoofing is harder.
The long-term UX goal is to push the "did this message come from $org or not" decision further "up the stack". Today (as you well know, but for folks following along), spoofing email is absolutely trivial. Without DMARC/DKIM/SPF, I can send mail as anyone I want, making the sending domain a useless signal for the user.
The (very rough) equivalent in email links is to force spammers to use unrelated domains in their links, instead of using my domain in their links. At least today, in theory, an org could tell users that legit links from the org only appear in a specific domain, making the "hover over the link" step an obvious signal to the user when it's a totally bogus domain. The more obvious I can make the difference to A) the recipient user, and/or B) the receiving infrastructure, the better. And orgs can't start "hard enforcing" until the signal reaches a high level of fidelity.
Re your (quite typical) list, spotty stats are a normal part of a transition period, in which systems are migrating away from a more-permissive incumbent. Enforcement has to be feathered in slowly. There's a reason why Gmail etc had to wait a while before moving to requiring and enforcing DMARC). The benefits start to scale up when more legit senders are publishing DMARC and more major receiving platforms (GMail, etc.) are enforcing DMARC. If they're only partially used and enforced, the usefulness is indeed reduced.
Put another way: for folks familiar with RPKI etc in the BGP world, it's similar (but inverted): every org that prevents spoofed packets coming from their AS protects the ASes that were being spoofed. Partial implementation only provides partial protection ... but each org that adds it improves the overall ecosystem, until we reach a point where orgs can "flip the switch" and start enforcing in earnest.
We can't reach the enforcement stage without moving through the messy partial adoption + partial benefit stage. What we don't want to do is to judge a snapshot in time during the transition as being only partially effective, and conclude that because the future state has not been achieved, we should abandon the transition.

2025-03-24 14:47:17 UTC

My DMARC protects you; your DMARC protects me.

2025-03-17 23:17:12 UTC

- reply

@nprofile…al7m Oooh, excellent! What OS? It's been a few years since I tinkered with Tim Hockin's boot loader shim to support "newer" kernels. Are you doing NetBSD?

2025-03-16 01:27:10 UTC

- reply

@nprofile…naem @nprofile…s6wl And filterable!

2025-03-09 15:34:28 UTC

Obvious in retrospect, but never occurred to me until this morning:
Won't many broad answers provided by AI that are actually true have to be suppressed (regimes, ads and other commercial motivation, etc.)?
Won't improving true AI performance always be at odds with the goals of its creators, to the detriment of its consumers?
(Note that I say "actually true" on purpose; AI picking up wrong but dominant answers from bad data is also a thing but not what I'm talking about.)

2025-02-27 19:20:07 UTC

In retrospect, it sure seems like Google's financial support of Mozilla was a specific subproject of a long-term frog-boiling play.

2025-02-25 17:27:22 UTC

- reply

If it's in the same security zone as prod, or is routable to prod, or caches credentials from prod ...what you've got there is a prod environment.

2025-02-12 23:51:51 UTC

- reply

@nprofile…cl5w Seen multiple reports of similar -- appears to be widespread (but apparently somewhat novel in our corners of the Fediverse?)

2024-04-28 03:32:59 UTC

Standing invitation for any Mastodonians I've interacted with - if you're visiting Anchorage and need any tourist tips, or might enjoy a meetup ... send me a DM! The security-key museum, the Alaskan license-plate museum, and the SPAM museum are colocated. ;)
https://media.infosec.exchange/infosec.exchange/media_attachments/files/112/346/742/823/885/703/original/485bf8a25c73b7c8.jpeg
https://media.infosec.exchange/infosec.exchange/media_attachments/files/112/346/746/681/026/508/original/83f8cb617b74474d.jpeg
https://media.infosec.exchange/infosec.exchange/media_attachments/files/112/346/752/012/107/805/original/d18e04dfe35438ef.jpg