Dan Goodin

Reporter covering security at Ars Technica. DM me on Signal: DanArs.82.

Public Key

npub1yyl6ktycvjymch9hyzq5yqphj89kalfqmtswcjpjmp7s67ms6g9sdp6r3v

NIP-05 Address

dangoodin@infosec-exchange.mostr.pub

Profile Code

nprofile1qqszz0at9jvxfzdutjmjpq2zqqmerjmwl5sd4c8vfqedslgd0dcdyzcpz4mhxue69uhhyetvv9ujuerfw36x7tnsw43qaasg6e

Publishing to

relay.ditto.pub

Author Public Key

npub1yyl6ktycvjymch9hyzq5yqphj89kalfqmtswcjpjmp7s67ms6g9sdp6r3v

Show more details

Last Notes

2026-03-26 16:23:23 UTC

Filippo is spot on. The question we should be asking now is: "What does Google know that the rest of us don't?"
#nevent1q…9m0l

2026-03-25 16:21:10 UTC

Google is dramatically shortening its deadline readiness for the arrival of Q Day, the point at which existing quantum computers can break public-key cryptography algorithms that secure decades’ worth of secrets belonging to militaries, banks, governments, and nearly every individual on earth.
https://arstechnica.com/security/2026/03/google-bumps-up-q-day-estimate-to-2029-far-sooner-than-previously-thought/?comments-page=1#comments

2026-03-24 16:49:22 UTC

Wow, TeamPCP is hacking open-source developers faster than we can report on them. The latest (that I'm aware of, anyway) is LiteLLM. They worked with Trivy but didn't bother to change their credentials after Trivy was hacked, despite an ample amount of advice to do so.
Folks, if any of you used LiteLLM, now is the time to change your credentials, at an atomic level. Now, as in immediately.
https://news.ycombinator.com/item?id=47501729

2026-03-18 20:12:56 UTC

Does anybody with a STRONG BACKGROUND IN WEBSITE PRIVACY have time to vet this research? Are TikTok and Meta pixels REALLY doing the things claimed? I'm concerned it may be overstating things in an attempt to sell its tag monitoring tools.
https://jscrambler.com/blog/beyond-analytics-tiktok-meta-ad-pixels

2026-03-09 17:26:51 UTC

- reply

@nprofile…44dh
Agreed. Most sites far prefer subscriptions over serving ads.

2026-03-09 17:23:36 UTC

Dear readers. If you're not willing to support the families of those you want to read then we regretfully will be preventing you from obtaining our work for free.
https://infosec.exchange/@StefanThinks@beige.party/116199534759633586
https://infosec.exchange/@StefanThinks@beige.party
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/200/370/455/839/715/original/f04687eb1e612879.png

2026-03-03 17:58:03 UTC

Tire pressure "transmissions are sent without any encryption or secure mechanisms and include a unique identifier. This allows anyone with affordable equipment like a low-cost spectrum receiver and a standard off-the-shelf antenna to capture and track them throughout time and space."
https://www.securityweek.com/researchers-uncover-method-to-track-cars-via-tire-sensors/

2026-03-03 17:47:32 UTC

RIP burner accounts
https://arstechnica.com/security/2026/03/llms-can-unmask-pseudonymous-users-at-scale-with-surprising-accuracy/

2026-02-27 19:02:21 UTC

Google has devised a means for securing HTTPS certificates against quantum computing attacks without massive performance hits stemming from the considerably longer size of data required to be included.
Is anyone following this work?
https://security.googleblog.com/2026/02/cultivating-robust-and-efficient.html

2026-02-26 15:54:24 UTC

That guest SSID you set up for your neighbors may not be as secure as you think
https://arstechnica.com/security/2026/02/new-airsnitch-attack-breaks-wi-fi-encryption-in-homes-offices-and-enterprises/

2026-02-09 19:31:41 UTC

If throngs of people handed over their IDs in exchange for a vanity blue check from a site that was untrustworthy even before it turned pro-authoritarian, what reason is there to think meaningful numbers of Discord users won't do the same?

2026-02-04 19:01:05 UTC

Anybody know how feasible it would have been for the WaPo reporter to refuse to provide her biometrics, or intentially sabotage the attempt by, say, using her wrong finger or closing her eyes? She might go to jail, but that's what reporters do to protect sources.

2026-02-03 21:49:37 UTC

https://sfstandard.com/2026/02/03/jeffrey-epstein-s-silicon-valley-network/

2026-01-15 18:18:27 UTC

Anyone have any general attacks about the details of the US cyberop the preceded the capture of Maduro?

2026-01-13 01:27:36 UTC

Curious to know if all the Trump haters who refused to vote for Harris because Gaza still stand by that decision.

2026-01-08 03:18:12 UTC

- reply

@nprofile…4kzv @nprofile…myvq
@nprofile…myvq
kudos on the move, but I can't help wondering: what took so long? This site has been spewing content that's at least this toxic ever since the Nazi saluting billionaire sociopath bought it. we should all be actively working on moving off Meta, discord and all the other platforms too.

2025-11-21 22:43:13 UTC

The International Association of Cryptologic Research has cancelled the results of its annual leadership election after an official lost an encryption key needed to unlock results stored in a "hyper-secure election system."
https://www.nytimes.com/2025/11/21/world/cryptography-group-lost-election-results.html?unlocked_article_code=1.208._aCi.O706MR3i3l3K&smid=url-share

2025-11-18 19:05:06 UTC

- reply

Microsoft says in the post (see toot above) that the agent isn't enabled by default and that only experienced users should enable it. What are these users to do to prevent the attacks Microsoft is warning of?

2025-10-19 02:31:49 UTC

- reply

@nprofile…2ard @nprofile…4unj
The helpless little thing with the dirty mouth /
Who's always got something to say
I miss Elliott terribly.

2025-10-16 20:39:59 UTC

"Godfather of Silicon Valley" Ron Conway resigns from Salesforce board after its CEO revealed his authoritarian leanings by calling on Tump to send national guards to San Francisco. "“It saddens me immensely to say that with your recent comments, and failure to understand their impact, I now barely recognize the person I have so long admired,” Conway tells Marc Benioff in an email.
https://sfstandard.com/2025/10/16/ron-conway-resigns-salesforce-foundation-board-marc-benioff/

2025-10-13 17:11:48 UTC

- reply

The fact that my labor union, like probably the majority of unions around the world, trusts slack is horrifying.

2025-10-13 17:10:17 UTC

- reply

Now that Marc Benioff, owner of Slack and Salesforce, has confirmed he sides with authoritarianism, it's more incumbent on us than ever to move off central platforms, which can dump communications we presumed were private or cut us off for any reason or no reason at all.
https://sfstandard.com/2025/10/10/marc-benioff-national-guard-sf/

2025-10-01 17:27:41 UTC

- reply

Here's another reminder that it's best to resist as much as possible the siren's call of relying on AI and other services from Big Tech. Gemini is blocking questions about Trump showing signs of dementia even as it answers the same question when applied to Biden. When we turn to AI we are abdicating our own judgement and research responsibilities to a broligarchy that bends to the whims of billionaires.
https://www.theverge.com/news/789152/google-ai-searches-blocking-trump-dementia-biden
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/300/061/864/400/127/original/e4f45a53e42d7c4d.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/300/072/991/347/661/original/66812af424a32782.png

2025-10-01 00:58:12 UTC

“San Francisco and Chicago, New York, Los Angeles. They’re very unsafe places, We’re gonna straighten them out one by one. It’s a war from within."
"I told Pete [Hegseth], we should use some of these cities as training grounds for our military."
https://sfstandard.com/2025/09/30/trump-military-san-francisco/

2025-09-30 20:44:21 UTC

The chipmakers say physical attacks aren't in the threat model. Many users didn't get the memo.
https://arstechnica.com/security/2025/09/intel-and-amd-trusted-enclaves-the-backbone-of-network-security-fall-to-physical-attacks/

2025-08-07 17:49:36 UTC

A reminder that software makers, hardware makers, cloud services, payment processors, and the like will throw their customers under the bus whenever it suits them. Your payment card, food delivery account, AWS instance, Gmail address -- all can be taken away on a whim for any reason or no reason. These providers are NOT your friend. Make plans now. Have backups in place. Practice self-reliance. Ween yourself off these one at a time.

2025-08-04 19:37:25 UTC

- reply

@nprofile…a0g8
"In reality, all we’ve created is a bot which is almost perfect at mimicking human-like natural language use, and the rest is people just projecting other human qualities on to it. Quite simply, “LLMs are doing reasoning” is the “look, my dog is smiling” of technology. In exactly the same way that dogs don’t convey their emotions via human-like facial expressions, there’s no reason to believe that even if computer could think, it’d perfectly mirror what looks like human reasoning."

2025-08-04 19:36:50 UTC

Once again, @nprofile…a0g8 nails it, this time calling out the "gluttony of myopic visionaries" shilling the wonders of AI.
https://malwaretech.com/2025/08/every-reason-why-i-hate-ai.html

2025-07-30 22:41:12 UTC

Is the activating of the Minnesota National Guard an over reaction to the ransomware attack on St. Paul? I have yet to hear an explanation of what exactly these folks are doing or what they can do that normal incident response people can't. Also, how many troops have been deployed? I haven't seen any of these questions answered let alone asked in the coverage I've read.

2025-07-07 16:44:46 UTC

I'm all for moving off of centralized platforms controlled by broligarchies. That said, how do we know platforms like Proton are any less horrible? Genuine question with no snark intended.

2025-05-21 17:07:04 UTC

- reply

Signal writes:
"We hope that the AI teams building systems like Recall will think through these implications more carefully in the future. Apps like Signal shouldn’t have to implement “one weird trick” in order to maintain the privacy and integrity of their services without proper developer tools. People who care about privacy shouldn’t be forced to sacrifice accessibility upon the altar of AI aspirations either."

2025-05-21 17:06:22 UTC

Signal Messenger is warning that Recall, the AI tool rolling out in Windows 11 that will screenshot, index, and store everything a user does every three seconds, poses a risk to its users. Effective immediately, the Windows Desktop version will by default block the ability of Windows to screenshot the app. Of course, Microsoft provides no API to disable Recall from screenshotting specific apps, so Signal is getting creative. They are invoking a digital rights management API that blocks the screenshotting of copyrighted material.
https://signal.org/blog/signal-doesnt-recall/

2025-05-01 22:56:40 UTC

April was the first full month since I installed my 4.1 kW solar system and accompanying batteries. And just like that, I went from drawing 200-250 kWh per month from the grid to 3 kWh. For the month, I produced 583 kWh, 284 kWh of which I exported 284 kWh to the grid.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/435/036/168/526/123/original/0d40dc72a404ce84.jpg

2025-04-25 00:00:56 UTC

PSA for iOS Android users everywhere: it's fine to use biometric authentication to unlock your device. It helps you choose better passwords. So instead of turning fingerprint and face scans off completely, when you find yourself in a less secure environment, simply press the power and volume up buttons simultaneously for a few seconds. On iPhones, your phone will immediately require a password. For Android users, you'll need to click the lockdown button presented on the screen. Then, practice the move a couple times per week each week. #UsableSecurity

2025-04-18 01:18:30 UTC

ICE officers in paramilitary gear appear to be inquiring about the citizenship status of passengers on a Amtrak Empire Builder train. As someone who rides Amtrak a lot, what should I say and do if I'm ever stopped like this?
https://www.havredailynews.com/story/2025/04/17/local/ice-questions-amtrak-passengers-in-havre-about-citizenship/547792.html#

2025-04-11 22:01:39 UTC

- reply

People in comments keep saying, oh well, time to move to Linux, as if that somehow insulates them. They forget that even then every interaction their Linux box has with a Windows 11 installation will STILL be compiled into a database that can be abused.

2025-04-11 21:58:39 UTC

Snapshotting and AI processing a screen every 3 seconds. What could possibly go wrong?
https://arstechnica.com/security/2025/04/microsoft-is-putting-privacy-endangering-recall-back-into-windows-11/

2025-04-07 16:12:39 UTC

- reply

@nprofile…0ajr @nprofile…u2fw
Thanks.

2025-04-04 21:10:30 UTC

No, I won't be going to RSA. In fact, I encourage everyone else to stay away. It's not fair to penalize people overseas for not traveling to the US because they don't want to jeopardize their safety. Besides, RSA is a really crappy conference with nearly zilch news value.

2025-04-02 07:37:55 UTC

- reply

@nprofile…5lc3
When I asked Oracle for comment, a PR person responded and offered a comment on the condition I not attribute it in any way to Oracle. When I said no, the PR person said Oracle was declining to comment.
#radicalopacity

2025-04-02 00:42:22 UTC

- reply

Here's the latest on XiaoFeng Wang, the a distinguished computer scientist who was summarily fired on Friday from his tenured position at Indiana University, where he had spent 20 years racking up accolades for his research in cryptography, privacy and cybersecurity. It comes from Alexander Tanford, president of the Bloomington chapter of the AAUP, the union representing IU professors, and colleagues of Wang's.
In February, an anonymous person filed a complaint alleging research misconduct against Wang. "The charge seemed trivial -- that he had failed to properly disclose who was principal investigator on a grant application and had not fully listed all his co-authors on an article," Tanford told me.
On March 13 or 14, IU temporarily suspended Wang, banned him from his office and denied access to his computer, research and data while the investigation continued. This is permitted under IU's research misconduct policy. The reasons, though, aren't publicly known.
On March 28, Provost Rahul Shrivastav informed Wang he was being terminated immediately. Shrivastav provided no reason (he mentioned Wang taking a job at a university in Singapore, but this is permitted and not grounds for dismissal). What's more, policy ACA-52, approved by the IU Board of Trustees, prohibits summarily firing a tenured professor.
Also on March 28, homes that Wang owns in Bloomington and Carmel, Indiana, were raided by the FBI. The FBI says the raids were court approved, but so far no one has seen a warrant. The US Attorney's Office for the Southern District of Indiana will neither confirm nor deny an investigation.
Indiana University has steadfastly refused to provide any reason for the termination or its failure to follow its own policy. Students and fellow faculty remain in the dark. His PhD students are frantically scrambling to find new advisors. One such student learned of Wang's firing only a few weeks before his PhD defense.
I reached out to Wang's attorneys 24 hours ago, and still haven't heard back.
We really need answers here. IU is tarnishing its reputation for academic independence. The lack of transparency here, both by IU and the FBI, truly sucks.
https://arstechnica.com/security/2025/03/computer-scientist-goes-silent-after-fbi-raid-and-purging-from-university-website/

2025-04-01 18:48:51 UTC

- reply

@nprofile…r26y
That's not correct. "a cloud service" but not Google's. It's a cloud service, or card key, that the organization has an account on.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/264/193/217/758/939/original/faba24d40356f9a2.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/264/193/182/080/826/original/fe03d9481aea190e.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/264/193/237/936/190/original/4b0d45d587d0ce4f.png

2025-04-01 18:41:45 UTC

- reply

@nprofile…r26y
Google specifically says keys are not stored on their server.
https://support.google.com/a/answer/14328489#zippy=%2Chow-is-cse-different-from-end-to-end-ee-encryption%2Chow-do-users-encrypt-data-using-cse%2Care-there-any-limitations-for-users-when-using-cse%2Cwhich-partner-key-management-services-can-i-use-with-cse%2Ccan-i-use-google-as-my-key-management-service%2Ccan-i-use-multiple-key-services%2Ccan-i-use-smart-cards-with-cse%2Ccan-i-use-both-a-key-service-and-hardware-encryption-keys-for-gmail

2025-04-01 18:02:23 UTC

Can anyone with deep knowledge of end-to-end encryption help me unpack Google's new E2EE offering for Workspace users?
First of all, how is it true E2EE if it's using Google's Client Side Encryption?
Second, how does it work? Sounds like organization stores keys in a cloud service, and when an employee in said organization wants to send an encrypted email, their browser downloads a public key from the cloud service, encrypts the message, and then it's sent to the recipient. Am I right so far?
It's not clear to me how the message gets decrypted on the other side. Is it decrypted on Google's server, in the recipient's browser or email client, something else?
All in all, how useful will this be to organizations? And might there be a way for individuals to use it someday?
TIA.
https://workspace.google.com/blog/identity-and-security/gmail-easy-end-to-end-encryption-all-businesses

2025-04-01 15:46:14 UTC

Thanks to @nprofile…5k2y for this well-documented critique.
https://krebsonsecurity.com/2025/03/how-each-pillar-of-the-1st-amendment-is-under-attack/

2025-03-31 16:28:50 UTC

- reply

The American Association of University
Professors is reminding Indiana University's provost that as a tenured professor, XiaoFeng Wang is entitled to due process. The university, meanwhile, is maintaining radio silence, which isn't a good look to prospective students considering attending.
https://aaup.sitehost.iu.edu/reports/AAUP_March_31_Letter_Shrivastav.pdf

2025-03-30 20:05:14 UTC

A prominent computer scientist who has spent 20 years publishing academic papers on cryptography, privacy, and cybersecurity has gone incommunicado, had his professor profile, email account, and phone number removed by his employer Indiana University, and had his homes raided by the FBI. No one knows why.
https://arstechnica.com/security/2025/03/computer-scientist-goes-silent-after-fbi-raid-and-purging-from-university-website/

2025-03-26 21:44:54 UTC

Proof the Trump admin is the gift that keeps on giving to US adversarial spies, the US national security advisor reveals the names of hundreds of personal and professional associates in publicly accessible Venmo profile.
https://www.wired.com/story/michael-waltz-left-his-venmo-public/

2025-03-23 22:52:18 UTC

Can anyone help me help a friend recover his compromised Facebook account? He's not sure how it got hijacked, but someone is using it to reach out to people, make a friend request, and then ask them out on dates. He's an investigative reporter, so it's not clear if this is a targeted attack attempting to meddle with confidential sources or an opportunistic one doing something like pig butchering. In any event, the compromised account poses a threat to Facebook users. My friend has tried recovering his account by sending FB a scan of his driver license, but the recovery link he gets gives him an error when he clicks on it. Does anyone reading this work in security at FB, or know someone who does? I (and my friend) would be so grateful for any help. Please DM me, preferably by Signal (DanArs.82) or here on Mastodon.

2025-03-20 07:11:26 UTC

One more inspection to go (scheduled for tomorrow) and my 4.1 kW solar panels go online.

2025-03-18 17:03:44 UTC

To follow up on yesterday's discussions about privacy implications of Cloudflare detecting the use of reused passwords in traffic passing through its infrastructure, Cloudflare has disclosed this practice previously. The protocol behind this check, known as Might I Get Pwned (in a nod to @nprofile…xh95), was described in a 2022 Usenix paper called Might I Get Pwned:
A Second Generation Compromised Credential Checking Service. It devises what it claims is a privacy-preserving way to check for credential reuse. It involves comparing hashes. Cloudflare says passwords are never logged.
I'm home recovering from a Covid infection, so I don't have the energy to dig into this any deeper right now. I am interested in responses from people qualified to evaluate the privacy-preservation claims, including @nprofile…htaz @nprofile…s6wl @nprofile…7mte and @nprofile…s8j9
Relevant links:
https://arxiv.org/pdf/2109.14490
https://blog.cloudflare.com/helping-keep-customers-safe-with-leaked-password-notification/
https://blog.cloudflare.com/privacy-preserving-compromised-credential-checking/

2025-03-17 02:56:41 UTC

Open-source software used by more than 23,000 organizations, some of them in large enterprises, was compromised with credential-stealing code after attackers gained unauthorized access to a maintainer account, in the latest open-source supply-chain attack to roil the Internet.
https://arstechnica.com/information-technology/2025/03/supply-chain-attack-exposing-credentials-affects-23k-users-of-tj-actions/

2025-03-15 00:40:10 UTC

Dear MAGAs: I know you hate EVs and swore you'd never buy one, but the over leveraged company owned by Dear Leader's goon will go bust if you don't.

2025-03-04 19:34:04 UTC

- reply

@nprofile…5lc3
OK, thanks, Kevin. Is it fair to compare accessing the hypervisor to gaining control over an Active Directory?

2025-03-04 19:26:54 UTC

- reply

@nprofile…5lc3
I just came here to ask you why these vulnerabilities are rated so critical if they can't be remotely exploited. Looks like you partially answered my question, but can you say more, please? Isn't it pretty much always game over when a threat actor has unauthorized access to a VM connected to your network? What's the scenario you're envisioning that makes these CVEs such a threat?

2025-03-04 17:05:34 UTC

Anyone trying to make sense of the recent reporting that the US is standing down on cyber operations involving Russia, your wait is over, courtesy of @nprofile…d9tn:
https://www.zetter-zeroday.com/did-trump-admin-order-u-s-cyber-command-and-cisa-to-stand-down-on-russia/

2025-02-26 19:13:37 UTC

- reply

@nprofile…s06p
My understanding is that Matrix isn't easy to deploy and has lots of bugs. Unions and similar orgs simply don't have the enough tech-experienced staff to support something like that. I'd be delighted to be disabused of this notion if there are unions and such that are happy Matrix users.

2025-02-26 18:30:35 UTC

- reply

And no, things like GPG on top of Slack or Gmail won't cut it, and neither will Matrix, Zulip or MatterMost in their current form. None of these alternatives are nearly as easy to use or as functional as Slack is. A solution has to be as easy for non-techies to use as Signal, Apple Messages or Tor and provide the same level of functionality and ease of deployment.

2025-02-26 18:18:37 UTC

- reply

It would take a year or more for me to process what has occurred over just the past six weeks. And of course, things are only getting started. I'm struggling to figure out how I can take any sort of meaningful stand against any of this.
One of the first steps I, as a journalist intent on fulfilling my ethical responsibilities, have to take is to figure out: how do I communicate securely? This is a problem with a solution that can only be answered by many people high above my pay grade level.
Signal is so awesome for so many things. I no longer take meetings on Zoom, Citrix, or Teams. The recently released Signal call links feature provides a much more secure alternative that's as easy to use as anything else.
Unfortunately, monopoly platforms like iCloud, Google cloud, and Slack aren't nearly as easy for most of us to replace. I have completely lost touch with my union and local because they communicate almost exclusively over Slack, a platform that can be hacked, subpoenaed or can use my interactions to train AI. It seems absolutely bonkers that organizations as vulnerable as these are trusting this platform, but what real alternative do they have?
The only solution I can envision will come from the contributions of people not working for profit, but out of dedication to privacy and equity. The two best examples I can think of are the Signal Foundation or Tor Project.
As I said, things are bleak and are only going to get worse in the coming weeks and months. I don't see how we mount a meaningful resistance without solving this fundamental problem first. I'd love to hear thoughts from people with more experience building these sorts of platforms.

2025-02-20 03:52:29 UTC

Can we devote some time to discussing Slack? As in, why are we all sending our every thought to a centralized server that can be hacked, and can can train AI with them? And why is Slack allowed to store transcripts but I can't?
My union uses Slack for organizing. How crazy is it that an organization in the cross hairs of a dangerous and emboldened government would do this? With everything going on right now, I'd love to be more active in the union, but must I really give up so much to this opaque platform?
Is anyone else struggling with these concerns? Do you know of viable Slack alternatives? Are there any hacks that make Slack less of a privacy invasion or make LLM training harder? Are there at least ways for me to save sessions the way I can with IRC? How do I resist Slack and not lose touch with groups that still use it?
Please boost for reach.

2025-02-13 19:49:12 UTC

I'm seeing a ton of new followers with no profile pic, no bio, 0 followers and 0 posts. If you're one of them, aren't a bot, and want to keep following me, please flesh out your account. Otherwise, I'll be blocking you.

2025-02-11 23:05:29 UTC

The result of the attack is the planting of false long-term memories that will be present in all future sessions, opening the potential for the chatbot to act on false information or instructions in perpetuity.
https://arstechnica.com/security/2025/02/new-hack-uses-prompt-injection-to-corrupt-geminis-long-term-memory/

2024-12-31 04:33:03 UTC

ICYMI: I published a year-end state-of-play story about passkeys. In short, they're the most viable means of moving to credential phishing-immune authentication, but they're also (1) not what I consider "usable security" for many and (2) don't (yet) live up to their security promises, since just about every site offering them still allows us to fall back on passwords and resets from emails, SMS, etc.
There are a large number of devs putting their blood, sweat and tears into passkeys. They deserve our thanks and respect. The move off of phishable, knoweledge-based authentication won't be easy. No one said it would be. Nothing in this story is intended to detract from the important work these folks do.
https://arstechnica.com/security/2024/12/passkey-technology-is-elegant-but-its-most-definitely-not-usable-security/

2024-10-30 22:44:09 UTC

It would appear there is an ongoing supply chain attack hitting Lottie Player/Files
https://forum.lottiefiles.com/t/the-problem-of-someone-elses-popup-appearing/6470

2024-07-16 22:00:02 UTC

I badly botched my earlier attempt at this, so I'm going to try again. I will no longer donate to @signalapp and I will encourage others to stop funding it as well, until its employees stop using Twitter in official communications. The blue vanity tick marks these employee accounts sport demonstrate the very real value these accounts have in keeping this toxic, anti-privacy platform alive. I'm getting close to stopping subscriptions to news outlets that are also doing their part to give oxygen to a site that actively undermines a free press.

2024-03-21 07:54:27 UTC

There's a newly discovered side channel that leaks encryption keys from a widely used CPU architecture. Details will drop in about 6 hours.

2024-03-12 16:26:19 UTC

- reply

Thanks all. The syntax is:
"from: "

2024-03-12 16:23:02 UTC

I can't believe I'm asking this again, but I can never seem to find it on duckduckgo: how do I search a particular Mastodon user's posts for a specific search term?

2024-03-12 01:03:06 UTC

- reply

Seriously, folks. When someone running for the highest office in the land says they admire dictators and intend to act like one on the first day of their term, you best believe them and vote accordingly.

2024-03-12 00:51:50 UTC

How much longer can left-of-center folks keep insisting there's no difference between Biden and TFG?

2024-01-19 19:35:05 UTC

- reply

HP CEO Enrique Lores said this about counterfeit ink cartridges this morningon CNBC:
They can "create security issues. We have seen that you can embed viruses in the cartridges, through the cartridges go to the printer, from the printer go to the network. So it can create [inaudible]"
I'm not aware of a single instance of this happening, either as a PoC attack by a researcher or a malicious one in the wild. Seems like the CEO is misspeaking. Any help here from people with experience in malware in embedded devices would be much appreciated.
Quote occurs at 3:28
https://youtu.be/QPRMyQSZGuY?si=EU905oCTcW860xJs&t=208

2024-01-19 18:44:30 UTC

Does anyone know of any attacks, either PoC or in the wild, that use malicious printer cartridges to infect printers? I saw this article from 2022
https://www.action-intell.com/2022/10/05/hp-bug-bounty-program-finds-reprogrammable-chips-open-printers-to-malware/
It says that HP's Bug Bounty program found such attacks are possible, but there are no details about who reported the bug that made such attacks possible. I remain skeptical about the accuracy.
Any help from experts in the form of pointers to attacks or analysis about whether printer cartridges are a viable infection vector would be much appreciated.

2023-10-20 16:26:44 UTC

I didn’t join Mastodon until after we launched 404 Media. I joined, frankly, because lots of people told me that we should. Mastodon had been decried by many (me, previously), as a social media platform that is too complicated or weird to sign up for. I had also convinced myself that people on Mastodon would be mad at me if I made jokes, which has (mostly) not been the case.
I’ve now been using it for about two months and I am here to tell you that it is, in principle, what we should want the internet to be. If you have been remotely interested in Mastodon but had reservations about joining because you thought it would be difficult, confusing, or otherwise annoying, it is not.
https://www.404media.co/mastodon-is-the-good-one/

2023-09-20 02:30:00 UTC

- reply

@npub1lrv…tth9
Yeah I know that, but what is the rational you mentioned for little journalism staying?

2023-09-20 02:24:43 UTC

- reply

@npub1lrv…tth9
Can you help me understand your rationale for small journalism staying on the dead bird site? Twitter isn't like electricity or water service that people can't live without. It seems like a copout to say you can't afford to leave the site be because of X, Y or Z. I suppose there probably are folks who might face true hardships if they leave, but even then, it seems like transitioning away could be a gradual process over no more than six months.
I just don't understand how all these Twitter users seem to think they are a victim of circumstance and have no choice.
What am I missing?

2023-09-20 02:14:39 UTC

- reply

@npub1lrv…tth9
I agree that the magnitude of the imperative is directly proportional to the number of followers and amount of influence you have. That said, I think it's incredibly short cited for any journalist to embrace the platform. I remain almost despondent so many people in this field ( and in cybersecurity, for that matter) choose a short term gain at the cost of the long-term good.

2023-09-20 02:08:21 UTC

- reply

@npub1lrv…tth9
I agree with everything you're saying except your use of the phrase "big journalism." It's equally in the interest litttle journalism too to stop giving comfort to a platform dedicated to spreading far-right extremism.

2023-08-16 18:25:30 UTC

- reply

A few months ago, an engineer in a data center in Norway encountered some perplexing errors that caused a Windows server to suddenly reset its system clock to 55 days in the future. The engineer relied on the server to maintain a routing table that tracked cell phone numbers in real time as they were being moved from one carrier to the other. A jump of eight weeks had dire consequences because it caused numbers that had yet to be transferred to be listed as having already been moved and numbers that had already been transferred to be reported as pending.
“With these updated routing tables, a lot of people were unable to make calls, as we didn't have a correct state!” the engineer, who asked to be identified only by his first name, Simen, wrote in an email. “We would route incoming and outgoing calls to the wrong operators! This meant, e.g., children could not reach their parents and vice versa.”
Simen had experienced a similar error last August when a machine running Windows Server 2019 reset its clock to January 2023 and then changed it back a short time later. Troubleshooting the cause of that mysterious reset was hampered because the engineers didn’t discover it until after event logs had been purged. The newer jump of 55 days, on a machine running Windows Server 2016, prompted him to once again search for a cause, and this time, he found it.
The culprit was a little-known feature in Windows known as Secure Time Seeding. Microsoft introduced the time-keeping feature in 2016 as a way to ensure that system clocks were accurate. Windows systems with clocks set to the wrong time can cause disastrous errors when they can’t properly parse time stamps in digital certificates or they execute jobs too early, too late, or out of the prescribed order. Secure Time Seeding, Microsoft said, was a hedge against failures in the battery-powered on-board devices designed to keep accurate time even when the machine is powered down.
https://arstechnica.com/security/2023/08/windows-feature-that-resets-system-clocks-based-on-random-data-is-wreaking-havoc/

2023-08-16 17:42:47 UTC

Windows Secure Time Seeding resets clocks months or years off the correct time.
https://arstechnica.com/security/2023/08/windows-feature-that-resets-system-clocks-based-on-random-data-is-wreaking-havoc/

2023-08-10 17:21:01 UTC

Journalism advocacy groups and presidents of secure messaging apps should pay more attention to why its crucial they stop giving oxygen to harmful social media platforms intent on undermining democracy, press freedoms and social justice. cc: @npub1ynl…873s @npub1l8d…rlx0/
https://media.infosec.exchange/infosecmediaeu/media_attachments/files/110/866/458/992/993/091/original/3a71b151ebcd7fb9.jpg