Gonçalo Valério boosted
infosec-handbook.eu  

LastPass releases update for security vulnerability:

bugs.chromium.org/p/project-ze

– The vulnerability allowed extracting credentials of previously-visited websites.
– Tavis Ormandy: "I think it's fair to call this 'High' severity, even if it won't work for *all* URLs."
– fixed in v4.33.0/v4.33.

#lastpass #security #vulnerability #tavisormandy #projectzero #infosec #cybersecurity

0
Gonçalo Valério  

"Basic Electron Framework Exploitation"

contextis.com/en/blog/basic-el

0
Gonçalo Valério  

On using certificate authentication with SSH:

smallstep.com/blog/use-ssh-cer

An good and open source tool to help you with this is Hashicorps Vault.

0
Gonçalo Valério boosted
infosec-handbook.eu  

ProtonMail adds support for Web Key Directory (WKD), DANE, and MTA-STS:

protonmail.com/blog/security-u

– WKD is also available for external keys now
– DANE is also available for custom domains
– Besides, they added HTTP headers (Expect-CT, Public-Key-Pins-Report-Only), DNS CAA, and monitoring (e.g., TLSRPT)
– There will be an independent security audit of all Proton apps

#protonmail #gpg #infosec #security #cybersecurity #openpgp #wkd #wks #dane #mtasts

1
Gonçalo Valério  

> A lot of Chromebook and Chromebox users don't realize this, but all ChromeOS devices have an expiration date.

arstechnica.com/gadgets/2019/0

🤦‍♂️ put linux on it or don't buy this kind of stuff.

0
Gonçalo Valério  

"Security analysis of <portal> element"

research.securitum.com/securit

0
Gonçalo Valério  

Some tips to increase the security of your kubernetes cluster:

blog.sqreen.com/kubernetes-sec

0
Gonçalo Valério boosted
Dmitri ☭⚛🚀  

Mysterious iOS Attack Changes Everything We Know About iPhone Hacking. For two years, a handful of websites have indiscriminately hacked thousands of iPhones.
wired.com/story/ios-attack-wat

1
Gonçalo Valério boosted
rysiek ✅  

Fun fact: wizzair.com let's you set a long password, but behind the scenes it truncates it to 16 characters (because obviously every byte is precious these days, I guess?).

When you try to log-in with your long long password, it fails. You have to *know* to truncate it yourself to 16 chars.

This is a major airline in 2019.

#InfoSec #WizzAir

1
Gonçalo Valério  

What happens when you launch your browser for the first time:

news.ycombinator.com/item?id=2

Interesting read. I was kind of disappointed to learn that:

"The mozilla.org tab discussing the importance of Privacy loads in the background, bringing along with it the Google Tag Manager and Google Analytics. Hello, Google."

1
Gonçalo Valério boosted
Russ  

Hey #cccamp19, you know everything you buy from Decathlon has a long-range UHF RFID tag on it, and I have a reader with 10m range?

145 unique tags scanned from a quick walk around the Milliways area.

1
Gonçalo Valério  

Typechecking Django and DRF

sobolevn.me/2019/08/typechecki

0
Gonçalo Valério boosted
switching.social  

To avoid confusion, here's a step-by-step guide to putting your #Wordpress blog on the #Fediverse:

1. Log into your Wordpress site

2. Go to "Plugins", "Add New", search for "ActivityPub" plugin, install and activate it.

3. Go to "Users", then "Your Profile". Scroll down, and right at the bottom there's a new section called "Fediverse" with the blog's Fediverse address.

4. Share this address on #Mastodon etc, people will be able to follow it by pasting it into the search box and following it!

0
Gonçalo Valério  

Docker "symlink-race attack" 🤔

seclists.org/oss-sec/2019/q3/1

0
Gonçalo Valério  

"The entropy of Bluetooth session keys is negotiated in an unauthenticated protocol between the participants. The attacker can manipulate this to the lowest entropy allowed, 1 byte. The resulting session key can then easily be brute forced."

knobattack.com/

0
Gonçalo Valério boosted
The Tor Project  

Yikes. "The fingerprints of over 1 million people, as well as facial recognition information... was discovered on a publicly accessible database for a company used by the likes of the UK Metropolitan police, defence contractors and banks." theguardian.com/technology/201

1+
Gonçalo Valério  

Matrix of affected web servers: vuls.cert.org/confluence/pages

0
Gonçalo Valério  

"HTTP/2 Denial of Service Advisory"

github.com/Netflix/security-bu

1
Gonçalo Valério  

"It turns out it was possible to reach across sessions and violate NT security boundaries for nearly twenty years, and nobody noticed."

googleprojectzero.blogspot.com

0
Gonçalo Valério  

"WhatsApp chat Manipulation"

research.checkpoint.com/black-

0
Show more
Social feed

This is a personal and private instance.

Resources

Developers

What is Mastodon?

s.ovalerio.net

More…