Collaborate Disseminate
Many threads like this one on reddit are springing up, which is great for spreading awareness of a major CVE. But questionable advice like this occasionally worms its way in:
Check your version with xz -V in the terminal
Now, this obviou… Continue reading Will using the xz binary trigger any call-home mechanism? [closed]
I just called a number that I thought was my bank’s and reached a customer service representative that asked me to verbally read to them a one-time passcode that was texted to my phone.
Is this standard practice?
I can’t imagine anybody bu… Continue reading Is reading off a OTP code over the phone standard practice?
Screenshots are generally held to be dubious evidence when presented in court because they are susceptible to alteration, especially when it comes to pages rendered in web browsers. You can use the browser’s dev tools to alter the content… Continue reading Verifiable alternative to screenshots for web browsers
Digicert has disallowed "double dashes" in the third and fourth characters in new certs:
Effective October 1, 2021, for publicly trusted TLS/SSL certificates, we no longer allow the use of double dashes (–) in the third and fou… Continue reading Why are SSL CAs prohibiting double dash in third and fourth characters?
Okta recently sent out an email to admins about changes to their new device detection strategy. According to them:
Due to browser advancements in anonymous web browsing, JavaScript fingerprinting techniques are quickly becoming obsolete…. Continue reading Is javascript fingerprinting becoming obsolete?
The Jurassic Park scene referenced in the title is infamous for how ludicrous it sounds to those who are tech literate. But it also illustrates what seems to me to be a glaringly huge hole in web security, particularly IoT devices–as soo… Continue reading Why is the OS obfuscation defense against "It’s a Unix system!" not widely implemented?
I’ve recently started some work on Google Cloud Platform (GCP) and while developing the auth strategy for my company, I’ve repeatedly come across the recommendation to use service accounts for authentication. That makes great sense for ma… Continue reading Why is it recommended to use GCP service accounts vs user accounts?