Nostr notes by Royce Williams

There's also at least one service that provides legal-level ...

2026-06-16T19:06:01Z

In reply to nevent1q…rfn2
_________________________

There's also at least one service that provides legal-level monitoring as a service -- basically they put a very specific kind of lien on the property that triggers them being notified if there's a change to it

Uh, this was always true, Dark Reading. Phishing training was ...

2026-06-16T05:27:04Z

Uh, this was *always* true, Dark Reading. Phishing training was *always* disproportionately punishing the victim by ineffectively treating the symptom instead of tackling the root cause.

The goal was always to make the controls render natural user behavior less harmful.

AI only speeds up the impact of not having been fixing the problem at the right level all along.

https://www.darkreading.com/cyberattacks-data-breaches/beginning-end-social-engineering

RE: https://social.coop/@shauna/116737114240403155 This is a post ...

2026-06-12T15:50:49Z

RE: https://social.coop/@shauna/116737114240403155

This is a post about cyber security.

quoting
note16xp…38ug

there's a confidence that comes from thinking you're always right, and a confidence that comes from being okay with being wrong

Did you know that in many cultures, it's considered good luck ...

2026-06-11T02:17:32Z

Did you know that in many cultures, it's considered good luck to share your food with a dog?
-- the dog

if it helps, I find you offensive. i could even make you a PDF ...

2026-06-09T20:18:28Z

In reply to nevent1q…j38m
_________________________

if it helps, I find you offensive. i could even make you a PDF certificate. 😉

A different kind of war war of attrition -- a slow death by a ...

2026-06-05T20:53:21Z

A different kind of war war of attrition -- a slow death by a thousand paper-cut reductions in service, unavailability of resources, escalations, inconveniences, and distractions. Multi-front, purposefully at a crawl.

It's boiling frogs all the way down.

The Quantum status page has been updated: ...

2026-06-05T15:58:02Z

In reply to nevent1q…l6ca
_________________________

The Quantum status page has been updated:

Signal beta on Android is now notifying "You may have new ...

2026-05-23T03:35:13Z

Signal beta on Android is now notifying "You may have new messages" ... when there aren't.

I mean, the "KE" in KEV stands for "known ...

2026-05-21T22:40:55Z

I mean, the "KE" in KEV stands for "*known* exploited". How were organizations reporting *before* to CISA that they were being exploited? Did some poor staffer there have to transcribe your email? I'm not seeing how making it easier to tell CISA that you were exploited (with the new form) is a bad thing?

These are keys that I registered before the rise of WebAuthn. ...

2026-05-20T14:01:48Z

In reply to nevent1q…ysjl
_________________________

These are keys that I registered before the rise of WebAuthn. (The only way to register a new key that way is to disable everything but U2F on the key, then register it. Or at least, that used to work)

You say that like it's a bad thing, Google. YubiKeys as ...

2026-05-20T07:07:36Z

You say that like it's a bad thing, Google.

YubiKeys as *second* factor 4 lyfe!

inb4 all of the fun vulnerability brand names are used up and ...

2026-05-18T15:30:32Z

inb4 all of the fun vulnerability brand names are used up and researchers start randomizing phoneme groups, like those Amazon "brands".

brb asking the people running the garage sale what the Wi-Fi ...

2026-05-17T07:48:17Z

brb asking the people running the garage sale what the Wi-Fi password is

(Yes, this is a sub-post about the YellowKey BitLocker ...

2026-05-13T15:47:44Z

In reply to nevent1q…fq7d
_________________________

(Yes, this is a sub-post about the YellowKey BitLocker "vulnerability")

Every org that has been relying on obscurity hiding their ...

2026-05-13T14:07:55Z

Every org that has been relying on obscurity hiding *their* backdoor.

I can neither confirm nor deny that it already exists. ...

2026-05-13T05:04:20Z

In reply to nevent1q…qx5l
_________________________

I can neither confirm nor deny that it already exists.

FreddyB Aviation Photography (npub1d26…72uz)

ME: Hey, I totally forgot my 1994 undergrad CS "solve the ...

2026-05-11T16:13:55Z

ME: Hey, I totally forgot my 1994 undergrad CS "solve the Eight Queens Problem with backtracking" exercise i I did in my Pascal class! I really got into it, did way more than the assignment required, taught it to log its work, ran it on the Sears salesfloor computers (Pentium II just came out!) a lot. Wonder if I could rewrite it in something else, it multithread it, etc.

[tinkering]

ME: Wow, that's much faster! Now chewing on a 46x46 board, been a couple of hours. Hmm, I wonder if I can add a flag to teach it other strategies besides backtracking.

[Googling]

HOFFMAN ET AL, 1969: Hey, we can do a million-sided board in seconds with this one weird trick!

ME: Hey, man ... I know this was a textbook lesson in recursion, but you *really* could have mentioned Hoffman after the assignment was over.

PASCAL PROFESSOR: My bad.

Maybe curl has been scrutinized so heavily and maintained so ...

2026-05-11T14:53:17Z

Maybe curl has been scrutinized so heavily and maintained so thoroughly that the kind of stuff Mythos (or other models) can find isn't there.

RE: https://chaos.social/@icing/116526903529846107 > ...

2026-05-06T12:08:04Z

RE: https://chaos.social/@icing/116526903529846107

> Aftermath: people, running Debian httpd 2.4.66, started complaining when they’ll get the 2.4.67 update to fix this RCE vulnerability. Which they already were protected from, but did not know. > *Because the CVE was not public at the time the fix was shipped.*

[...]

> Two security researchers found the vulnerability independently. Just scanning the 2.4.66 source code. This means > *the bad guys*> can no longer be > *kept in the dark*> . > **Coordinated disclosure no longer works.**

#CVE_2026_23918

quoting
note12yx…nusj

"That 'responsibble disclosure' Thing"

A post with the details of CVE-2026-23918, the double free vulnerability fixed in Apache httpd 2.4.67.

#apache
https://eissing.org/icing/posts/responsible-disclosure/

DigitalOcean: Hey that Apache thing needs upgrade on your ...

2026-05-06T01:02:25Z

DigitalOcean: Hey that Apache thing needs upgrade on your droplet.

Me: Thanks! Are your distro repos updated to contain the patched version?

DO: lol no

RE: https://infosec.exchange/@tychotithonus/116512575091069174 ...

2026-05-03T21:09:06Z

RE: https://infosec.exchange/@tychotithonus/116512575091069174

Figured out what my beef is here. Named vulnerabilities are usually (at least implicitly) *for the benefit of defenders*. At launch, CopyFail emphasis was on impact, but support for defenders was extremely thin -- and a failure of empathy. The motivation appears to have been soley as an advertisement for "if you want to attack good, buy us / buy our thing". I consider that asymmetry irresponsible, and the lack of empathy especially untrustworthy. I want vendors who have my back.

quoting
note1mqz…sj3q

Also, *they themselves* claim that it is no ordinary vulnerability, and should have stood out - making their failure (to initially leverage their position as even a basic clearinghouse for the rush of people who wouldn't find out about it until later) even more questionable.

Again, it's a weird hybrid of "this is really important" with no understanding of how defenders actually operate.

And for all of their claimed AI acumen, they didn't even bother to prompt for what defenders would need to know (until well after the announcement, where it's clear that they scrambled to fill in some gaps).

#CopyFail

Also, they themselves claim that it is no ordinary ...

2026-05-03T20:40:06Z

In reply to nevent1q…au3a
_________________________

Also, *they themselves* claim that it is no ordinary vulnerability, and should have stood out - making their failure (to initially leverage their position as even a basic clearinghouse for the rush of people who wouldn't find out about it until later) even more questionable.

Again, it's a weird hybrid of "this is really important" with no understanding of how defenders actually operate.

And for all of their claimed AI acumen, they didn't even bother to prompt for what defenders would need to know (until well after the announcement, where it's clear that they scrambled to fill in some gaps).

#CopyFail

I'm following this for the most part, but what I don't ...

2026-05-03T20:33:28Z

In reply to nevent1q…wqa6
_________________________

I'm following this for the most part, but what I don't understand is why they thought they needed to stand up an entire domain name and website and coordination point, and then ... do almost nothing with it [initially, and for a couple days after].

Either they thought it was important enough to do that, and they therefore have a corresponding obligation to at least minimally coordinate and inform defenders (which is what many named vulnerabilities have done in the past), or ... it wasn't. They've chosen some weird middle ground, and even if it was only for marketing reasons, it sure doesn't make me want to buy their product, because I don't trust them to have the judgment or good taste to understand the implications of what they're choosing to do.

I suspect this is in preparation for selling the domain to an AI ...

2026-05-03T15:21:45Z

In reply to nevent1q…632d
_________________________

I suspect this is in preparation for selling the domain to an AI platform.

Nostr event nevent1qqsf7gh3xutuvpn776c44azny8q77ffvfmllddttuem224r94hgxknszyp5kgl2m3qt5w2kzem2t3r7efh8td8nukpsrsunhrfnnw3c2se0p6c4avpr

2026-05-02T00:01:00Z

/me escapes to the woods ...

2026-05-01T22:04:53Z

/me *escapes to the woods*

RE: https://mastodon.social/@Viss/116490543256385246 From my ...

2026-04-30T15:13:53Z

RE: https://mastodon.social/@Viss/116490543256385246

From my reading, this is my understanding as well. You don't have to have root, and you can modify anything in the page cache. Like ... sshd, or libpam, or anything called by a cron job that's running as root.

How can we definitively confirm this?

#CopyFail #CVE_2026_31431

quoting
note14ru…z93m

right now, every single remote code vuln that will lead to command injection or rce will make this #copyfail thing a very very big deal.

so all those qa servers and staging servers and test boxes you think nobody gives a shit about that are just flapping out there in the public, not being logged, not in the siem, not getting alerted on, not getting patched?

all those are gonna catch the "oops attackers overwrote sshd to steal creds" disease.

or cryptominers. or proxies.

The CopyFail announcement and handling is one of the least ...

2026-04-30T13:38:24Z

The CopyFail announcement and handling is one of the least defender-supporting I think I've ever seen.

Mitigations were extremely thin at launch, and haven't improved much, and are even brittle and misleading:

https://infosec.exchange/@tychotithonus/116490466168316767

They've also largely neglected most of the value of the feedback they're getting from defenders clamoring for useful intel. The GitHub repo is full of feedback about which distros are affected or unaffected ... and a day later, none of it has been used to update the list of affected versions in the main README (except for the RHEL made-up version fix)

And this exchange is painful:

https://github.com/theori-io/copy-fail-CVE-2026-31431/issues/12

"None of us are RH people so it wasn't caught" 😐 You had *weeks* do basic vetting, or find someone who would help you.

Theori seems to have to have intended this to be a showcase for their product. Instead, it has convinced me that I will *never* buy anything from them.

#CopyFail #cve_2026_31431

Nostr event nevent1qqsd3kz6wgy39yrmtu2mcf45knxu2k2srk4v5a4fnp6p60ljv252ragzyp5kgl2m3qt5w2kzem2t3r7efh8td8nukpsrsunhrfnnw3c2se0p65qu3tf

2026-04-22T22:47:57Z

I keep reading "AiTM" as "Am I The Monster"

https://www. ietf.org/archive/id/draft-meow -mrrp-00.html

2026-04-17T14:54:02Z

In reply to nevent1q…zlh7
_________________________

https://www.
ietf.org/archive/id/draft-meow
-mrrp-00.html

Nostr event nevent1qqs9ztpaxf3695yfdw0wcrm3eu7esmh63qheflj8vp4nry7sdep4a5qzyp5kgl2m3qt5w2kzem2t3r7efh8td8nukpsrsunhrfnnw3c2se0p6kvj0q0

2026-04-16T15:12:08Z

Lies, damned lies, and "LIFT TAB TO OPEN"

I don't understand why the recovery of deleted Signal ...

2026-04-09T15:49:47Z

I don't understand why the recovery of deleted Signal messages is news.

If an attacker has full access to the endpoiint, Signal has never claimed to protect messages -- and IIRC, has expressly stated that they do not.

Edit: But hey, at least it is getting the word out that deleting the app doesn't delete the messages!

RE: https://techpolicy.social/@joebeone/116194325589609756 New AI ...

2026-03-08T15:45:58Z

RE: https://techpolicy.social/@joebeone/116194325589609756

New AI term just dropped: vibekilling

quoting
note1679…q3j4

great to hear Siva Vaidhyanathan (npub1wa2…dqnj) talking to Brooke Gladstone on On the Media about AI and weapons of war. They talk real-time targeting and what accountability means today. https://www.wnycstudios.org/podcasts/otm/articles/the-aipowered-war-machines-are-here

"Wow, I got a TOTP code of 000000! What are the odds of ...

2026-01-24T20:27:16Z

"Wow, I got a TOTP code of 000000! What are the odds of that?!"

"Uh ... one in a million?"

"I know, right?"

🤣

The nice thing about EICAR is that, when properly implemented, it ...

2026-01-22T22:35:48Z

The nice thing about EICAR is that, when properly implemented, it should only produce a hit if it is at the *beginning* of the file (per the EICAR spec itself). Inclusions of EICAR elsewhere are amusing, but should absolutely be false positives that should be fixed.

The Anthropic magic string, by contrast, can appear *anywhere*. The chaos this enables is commensurately greater.

I'm having a Mandela Effect / Berenstain Bears moment where I ...

2026-01-06T21:10:25Z

I'm having a Mandela Effect / Berenstain Bears moment where I *swear* people say "pled" as the past tense of "plead" ... but half of the spellcheckers don't like it?

Ah, indeed. Though when working as designed, the ATA Secure Erase ...

2025-12-30T03:19:08Z

In reply to nevent1q…q2np
_________________________

Ah, indeed. Though when working as designed, the ATA Secure Erase *should* reach all storage. Except when it doesn't. Hmm.

In your experience, what are the ATA Secure Erase failure modes? If we (pessimistically) assume that it can fail silently, it is probably often working as intended (unless it throws an error).

So if I had to write an internal standard at $dayjob, the wiping workflow would *always* attempt an ATA Secure Erase first, and then *always* follow with a single overwrite (with zeroes or NULL; the reasons for overlapping / random / multipass are from ancient HDD days).

I'd argue that verification is itself limited. Part of the ...

2025-12-30T03:03:15Z

In reply to nevent1q…yxe2
_________________________

I'd argue that verification is itself limited. Part of the OS-level verification gap/problem is that the storage has regions that the OS can't reach. So an OS-level verification process is inherently incomplete.

Hmm .. since each approach covers angles that the other does not, ...

2025-12-30T03:00:56Z

In reply to nevent1q…p7cr
_________________________

Hmm .. since each approach covers angles that the other does not, then, the most robust approach is probably to first trigger an ATA Secure Erase, and then do an overwrite.

SSDs also support ATA Secure Erase (controller-level ...

2025-12-30T02:51:08Z

In reply to nevent1q…s0ut
_________________________

SSDs also support ATA Secure Erase (controller-level encrypt-then-discard-key) -- which should, in theory, be significantly more thorough than OS-level overwrite.

This is also the NIST-approved method.

RE: https://infosec.exchange/@zak/115793005915790340 This is a ...

2025-12-27T18:49:40Z

RE: https://infosec.exchange/@zak/115793005915790340

This is a metaphor about cybersecurity products.

quoting
note156n…mum6

Eyelashes: stop things from falling into your eyes.

Also eyelashes: fall directly into your eyes.

What horseshit.

Also how did we manage to land the "switch to passkeys" ...

2025-12-15T15:59:37Z

Also how did we manage to land the "switch to passkeys" messaging ... but somehow miss the "and you absolutely must let users add more than one, with clear UX" bit?

"Let us be the repository of your passkeys" and "We ...

2025-12-15T15:54:49Z

"Let us be the repository of your passkeys" and "We may terminate your account at any time and permanently refuse to communicate with you" ... seems like a bad combination?

Welp, Google is killing off the Dark Web Report feature, which ...

2025-12-15T15:38:41Z

Welp, Google is killing off the Dark Web Report feature, which was useful (to me, anyway), as of Feb 16, 2026.

Nostr event nevent1qqs09mh9cnawlpdxt69atdwvs8a0m6z3p3dg0ukh4w07jalwdmdl27gzyp5kgl2m3qt5w2kzem2t3r7efh8td8nukpsrsunhrfnnw3c2se0p6s2k03r

2025-12-05T15:53:20Z

I kinda hate the mashed-to-a-single word "protip".

I know of seven org-branded standard YubiKey bubble packs (note: ...

2025-11-26T00:23:52Z

I know of seven org-branded standard YubiKey bubble packs (note: the *packaging* is branded, not necessarily the *key*). Are there any more?

First four:

1/2

I don't know why this is how I found out. ...

2025-11-15T20:15:55Z

I don't know why this is how I found out.

https://www.nytimes.com/2025/11/13/us/politics/alaska-phone-voting-anchorage.html

Anchorage is going to try voting by phone.

No one who understands the problem space thinks this is a good idea.

OH: "You're in his DMs. I'm in his VMs. We're not ...

2025-11-07T06:55:47Z

OH: "You're in his DMs. I'm in his VMs. We're not the same."

The kids can't eat without something to scroll. It terrifies ...

2025-11-07T00:35:27Z

The kids can't eat without something to scroll. It terrifies me. When can we rest? When can we have ideas? When can we connect?

Indeed! This thread is what triggered the support in JtR (and ...

2025-11-05T21:11:15Z

In reply to nevent1q…06mw
_________________________

Indeed! This thread is what triggered the support in JtR (and eventually hashcat):

https://unix.stackexchange.com/questions/31549/is-it-possible-to-find-out-the-hosts-in-the-known-hosts-file

Happy to try to crack them if you'd like!

2025-11-05T21:08:24Z

In reply to nevent1q…j37n
_________________________

Happy to try to crack them if you'd like!

Whoa, how did I miss that you'll be able to buy YubiKeys at ...

2025-11-05T04:01:14Z

Whoa, how did I miss that you'll be able to buy YubiKeys at Best Buy?!

https://www.yubico.com/press-releases/secure-your-digital-accounts-yubikeys-available-now-in-stores-at-best-buy/

[Edit: *right now* -- or at least, available to pick up within the hour at my local store!]

#YubiKey

😐

2025-11-04T21:21:51Z

In reply to nevent1q…rjjy
_________________________

😐

Oof. Does the mechanism provide a way for the defederating server ...

2025-11-04T21:20:43Z

In reply to nevent1q…c87z
_________________________

Oof. Does the mechanism provide a way for the defederating server to say why it happened? Or is it just totally opaque?

inb4 everyone realizes that several Someones are taking notes ...

2025-10-29T18:45:53Z

inb4 everyone realizes that several Someones are taking notes during ransomware attacks, outages, etc. -- mapping our attack surface / dependencies / response capabilities.

What percentage are active vs passive measurement are left as an exercise.

https://infosec.exchange/@tychotithonus/115418342699692840

2025-10-22T14:45:41Z

In reply to nevent1q…nj8d
_________________________

https://infosec.exchange/@tychotithonus/115418342699692840

Hot take: we are boiling the illiteracy frog. ...

2025-10-22T06:26:26Z

Hot take: we are boiling the illiteracy frog.

I feel like a lot of the "it was DNS" is conceptually ...

2025-10-20T13:47:22Z

I feel like a lot of the "it was DNS" is conceptually oversimplifying, and masking true root cause(s).

It makes sense to centralize naming, It makes sense to abstract naming away from IP addresses. Many of these outages are "this other thing broke, and it made DNS break". Most folks would never say "it was DNS" when it was a network problem that was preventing reaching the DNS servers. But a lot of the time, this isn't much different from that.

Don't get me wrong, every outage is an opportunity to learn and improve, both locally and centrally. I just want to shift the conversation to "it was DNS, *because* ...", and help people make informed risk trade-offs.

Approach it like the NTSB would: keep going until you know, and have recommendations for, *all* of the failure modes.

And the opposites are also very true: Local doesn't mean ...

2025-10-09T16:00:22Z

In reply to nevent1q…j6yd
_________________________

And the opposites are also very true:

Local doesn't mean insecure. Cloud doesn't mean secure.

Good question! A core property of FIDO2 is authenticating the ...

2025-10-04T14:21:03Z

In reply to nevent1q…2lq2
_________________________

Good question!

A core property of FIDO2 is authenticating the *origin* (are you connected to the right site, or a copycat). The daily benefit of this protection is intended to be worth the trade-off of requiring diligence in retaining possession of the key.

Also, the idea is that loss of the key would be noticed quickly enough that the key could be revoked.

Finally, putting a PIN on a "leave-in" / installed key (which is a PIN for the *key*, not for individual sites), is a reasonable way to mitigate the risk of the window of time between the loss/theft of key and when it can be revoked.

#YubiKey

This saga feels like an ad for ZFS 😉 I've been burned by ...

2025-09-29T16:51:12Z

In reply to nevent1q…etwy
_________________________

This saga feels like an ad for ZFS 😉

I've been burned by both hard and soft RAID too many times to ever go back.

Updated to include: ...

2025-09-23T20:22:04Z

In reply to nevent1q…u9pc
_________________________

Updated to include:

https://www.yubico.com/press-releases/yubico-and-t-mobile-deployment-of-200000-phishing-resistant-yubikeys-enhances-un-carriers-work-systems-security/

I should have been collecting the receipts on a rolling basis; ...

2025-09-23T20:17:18Z

In reply to nevent1q…xwsm
_________________________

I should have been collecting the receipts on a rolling basis; chatter at the time for multiple of these was "deploying fast now for highest risk, doing the rest in a more controlled fashion after".

Thinking of:<li>npm ("encouraging FIDO2", anyway)</li><li>T-Mobile - <a href="https://www.t-mobile.com/news/network/additional-information-regarding-2021-cyberattack-investigation"; target="_blank" rel="nofollow noopener" translate="no">https://www.t-mobile.com/news/network/additional-information-regarding-2021-cyberattack-investigation</a></li><li>Twitter - <a href="https://blog.x.com/engineering/en_us/topics/insights/2021/how-we-rolled-out-security-keys-at-twitter"; target="_blank" rel="nofollow noopener" translate="no">https://blog.x.com/engineering/en_us/topics/insights/2021/how-we-rolled-out-security-keys-at-twitter</a></li>

And probably:<li>Uber ("further strengthening our MFA", reading between the lines for 2022 breach and 2023 deployment) - <a href="https://www.uber.com/newsroom/security-update/"; target="_blank" rel="nofollow noopener" translate="no">https://www.uber.com/newsroom/security-update/</a></li><li>Discord (again, reading between the lines - 2023 breach, 2025 deployment)</li><li>eBay (public evidence is thinner here, but I got a couple of confidential reports)</li>

And a couple "we could see the writing on the wall" (they get points for that):<li>Google (2017) - <a href="https://krebsonsecurity.com/2018/07/google-security-keys-neutralized-employee-phishing/"; target="_blank" rel="nofollow noopener" translate="no">https://krebsonsecurity.com/2018/07/google-security-keys-neutralized-employee-phishing/</a></li><li>Cloudflare - <a href="https://blog.cloudflare.com/how-cloudflare-implemented-fido2-and-zero-trust/"; target="_blank" rel="nofollow noopener" translate="no">https://blog.cloudflare.com/how-cloudflare-implemented-fido2-and-zero-trust/</a></li>

How many stories of "get popped, then do an emergency FIDO2 ...

2025-09-23T19:56:52Z

How many stories of "get popped, *then* do an emergency FIDO2 deployment" does your leadership need to read before you decide to deploy FIDO2 proactively?

Like conference social preference badges, except "yes I will ...

2025-09-20T01:57:52Z

Like conference social preference badges, except "yes I will always say hi to your dog"

"Using ChatGPT to complete assignments is like bringing a ...

2025-09-18T17:28:08Z

"Using ChatGPT to complete assignments is like bringing a forklift into the weight room; you will never improve your cognitive fitness that way."
-- Ted Chiang

Source:
https://www.newyorker.com/culture/the-weekend-essay/why-ai-isnt-going-to-make-art

Dudes will install Debian on a 13yo MacBook Air instead of going ...

2025-09-17T00:37:54Z

Dudes will install Debian on a 13yo MacBook Air instead of going to therapy.

It's me. I'm dudes.

(XFCE is pretty snappy!)

And to your solid point about the 70%, I forgot to math that out ...

2025-09-09T12:56:46Z

In reply to nevent1q…qmj2
_________________________

And to your solid point about the 70%, I forgot to math that out to illustrate the importance of protecting the remaining people who *aren't* reusing passwords. (And I know you know this, mostly posting for those following along).

In the 16 million bcrypt cost 12 case, if 70% of them can be "pre-cracked" with correlation, then the amount of time for the attack above to run for the remaining 30% drops from 300 days to 90 days. Which is an okay amount of time to buy between compromise and discovery, until we remember that you can have a lot more than two 4090s 😅, and of course, bcrypt parallelizes relatively well, such that a different hash like Argon2 or yescrypt is a better choice. But if bcrypt is the only option for some reason, bumping the work factor higher, if feasible, would be recommended.

Wow, that is substantially more terrible than I was expecting. ...

2025-09-09T05:23:39Z

In reply to nevent1q…4yx9
_________________________

Wow, that is substantially more terrible than I was expecting. Yow.

Well, there's a spectrum there. A lot of the Hashmob bcrypt ...

2025-09-09T04:49:36Z

In reply to nevent1q…p4tw
_________________________

Well, there's a spectrum there. A lot of the Hashmob bcrypt lists have been thoroughly correlated, and I think the percentage trends lower than 70% there, but I'd have to look.

If full correlation is in play (a leak with known passwords), then the cost doesn't make a ton of difference, because each hash can be targeted with john's --single mode or hashcat's -a 9.

And for hashes that cannot be correlated, targeting a single hash slows the attacker down only so much (because single-hash performance has to be tolerable for user experience). When the bcrypt cost gets to 12, and a million candidate passwords, that's only about 30 seconds with hashcat on 2 4090s.

And then that cost is magnified when it's a broad attack (many hashes targeted simultaneously), Even just trying the first N thousand most common passwords, attempting to crack a million bcrypt cost 12s is correspondingly harder, so there's still a "herd health" benefit to the hashes being stronger.

For example, with 16 million cost 12 bcrypts, and a very short list of very common passwords (6144 words, the minimum for certain hashcat efficiencies), 2x 4090s will take 300 days to fully exhaust. The equivalent attack - all other variables constant, but dropping the bcrypt cost from 12 to five -- will complete *in 2.5 days*.

And that's for a *very* short wordlist. Running through longer wordlists would be correspondingly longer.

So I think that the work factors should be tuned to protect folks who aren't reusing their own passwords across multiple accounts, but might be sharing semi-common passwords *with other users*.

Nice find! We're going to have get the word out that just ...

2025-09-09T03:54:13Z

In reply to nevent1q…tf76
_________________________

*Nice* find!

We're going to have get the word out that just 'bcrypt' isn't enough -- bcrypt cost 12 is 128 times harder than cost 5, etc. We need to know the default costs.

Anyone seeing disclosure of what password hashing algorithm Plex ...

2025-09-09T02:03:27Z

Anyone seeing disclosure of what password hashing algorithm Plex uses on their back end?

[Edit: Aaron Toponce ⚛️:debian: (npub1t9c…8529) discovered a thread showing bcrypt:

https://fosstodon.org/@atoponce/115172271450263878 ]

There are three kinds of org postures relative to disclosure of password-hashing algorithm:<li>Orgs confident enough in their selection of algorithm that they know that there is no harm in disclosing it</li><li>Orgs who know they're doing it badly and want to keep it a secret</li><li>Orgs who won't disclose their algorithm because the PR team has no idea how the passwords are hashed, and internal comms are spotty enough that the information can't reach the public</li>

Note that a mix of 1 and 3, or 2 and 3, are also possible.

1 alone is a sign of security maturity. If 2 and 3 are in play, there's room for improvement ... for different reasons, but both indicators of security immaturity.

Practitioners: Which type is your org?

Reporters: Are you probing orgs to find out which type they are?

Normalize hash-type disclosure.

Clonezilla is such a hidden gem. An impressive combination of ...

2025-09-07T23:52:12Z

Clonezilla is such a hidden gem. An impressive combination of "make the core things easy and the tricky things possible" and "do what I probably need".

I totally forgot about this. Thank you, random synapse from ...

2025-09-04T03:04:22Z

I totally forgot about this. Thank you, random synapse from literally the year 2000.

https://goodreads.com/book/show/331807.How_to_Good_Bye_Depression_If_You_Constrict_Anus_100_Times_Everyday__Malarkey__or_Effective_Way_

That is hilarious and insightful. You win the Internet today, and ...

2025-08-28T13:42:48Z

In reply to nevent1q…vl3q
_________________________

That is hilarious and insightful. You win the Internet today, and it's only 5:42 a.m. here. 😁

Turns out "despite patches" means "despite patches ...

2025-08-28T13:35:21Z

Turns out "despite patches" means "despite patches being available, because a bunch of people aren't applying them" rather than "despite patching it, but it's still vulnerable anyway and there's something wrong with the patches" 🙄

Words mean things.

#SavedYouAClick

MDXfind 1.133 released: ...

2025-08-26T04:50:30Z

MDXfind 1.133 released:

https://www.techsolvency.com/pub/bin/mdxfind/

Highlights:<li>Now shows hash and candidate rates/sec in comfort messages</li><li>Significant (10x) improvement in solution output speed for hashes</li><li>Previously undocumented features, including <code>-m</code> flag to specify hashtypes in hashcat mode syntax</li><li>Metadata showing mapping of MDXfind hashtype IDs (by position in -h) to hashcat modes</li><li>Now with gzip support for hashes (<code>-f</code> or stdin), and for candidate lists</li>

Too many to fully list, but lots of interesting stuff in the full changelog:

https://www.techsolvency.com/pub/bin/mdxfind/CHANGES.txt

Always be cracking!

#MDXfind

Good morning to everyone except GitHub, ...

2025-08-24T16:00:15Z

Good morning to everyone except GitHub, which:<li>allows (but strongly discourages) fine-grained access tokens with no expiration date, but</li><li>won't let you create one with an expiration date more than one year out.</li>

So my choices are "never expire" or expire in a year or less".

Our Threat Models May Vary!

Nostr event nevent1qqsgsqwk33jl4qylj656w8r7dy7qp084c9j3emv48vvqp8ts08flhfqzyp5kgl2m3qt5w2kzem2t3r7efh8td8nukpsrsunhrfnnw3c2se0p6e55mqe

2025-08-23T04:00:34Z

These can both be true: <li>Passkey deployment has ...

2025-08-18T14:56:34Z

These can both be true: <li>Passkey deployment has been fraught with UX challenges, failures to advise users about threat model trade-offs, and vendor lock-in concerns </li><li>The ecosystem couldn't go much longer without the benefits of passkeys (reducing password reuse risk, mitigating infostealer harm, and deploying FIDO2 phishing resistance at scale)</li>

#Passkeys

Ah, another "strong MFA bypassed" story. /me opens ...

2025-08-17T22:23:25Z

Ah, another "strong MFA bypassed" story.

/me opens article, starts scanning for buried lede

Ah, here it is ... paragraph 8:

"First you have to compromise the endpoint"

🙄

Surprise! This is *not something passkeys -- or any other authentication system -- are designed to mitigate*.

https://www.securityweek.com/passkey-login-bypassed-via-webauthn-process-manipulation/

I say again: the word "bypass" only leaves the layperson with the impression of "nya nya strong MFA isn't as strong as they said lol" ... and the CIO with the impression "you told me I had to move to strong MFA why do they keep finding problems with it"

Cut it out.

So ... is the new Sandia time-independent MFA thing: ...

2025-08-17T15:39:19Z

So ... is the new Sandia time-independent MFA thing:

https://www.sandia.gov/labnews/2025/07/24/two-factor-authentication-just-got-easier/

... just ... renegotiating a new per-client code every time there's a new connection?

Like ... how garage door openers have worked ... since the mid-90s?

Huh -- did I miss it, or does even the upstream Sandia not ...

2025-08-17T15:33:20Z

In reply to nevent1q…h8hc
_________________________

Huh -- did I miss it, or does even the upstream Sandia not actually say what the approach *is*?

https://www.sandia.gov/labnews/2025/07/24/two-factor-authentication-just-got-easier/

All I can extract from the coverage is "easier" and "time-independent".

Still digging ...

Edit: is it... just ... renegotiating a new per-client code every time there's a new connection?

Like ... how garage door openers have worked ... since the mid-90s?

Kiddo: why do you put the full year with "20" at the ...

2025-08-16T22:00:18Z

Kiddo: why do you put the full year with "20" at the front when you sign the school forms?

Me: *thousand-yard Y2K stare*

Since it's just the tree, if someone could snapshot it ...

2025-08-15T17:56:14Z

In reply to nevent1q…7j9d
_________________________

Since it's just the tree, if someone could snapshot it safetly and put a text-only version of it somewhere (like a GitHub gist), folks would probably appreciate that

Does "runtime" here always imply "source code is ...

2025-08-13T15:59:11Z

In reply to nevent1q…6t3h
_________________________

Does "runtime" here always imply "source code is available"?

On mobile, desktop, or both? I hadn't seen this yet, can you ...

2025-08-03T01:15:30Z

In reply to nevent1q…lved
_________________________

On mobile, desktop, or both? I hadn't seen this yet, can you point me to some coverage or a summary?

Things platforms want you to do less of:<li>untrackably ...

2025-08-02T16:22:43Z

Things platforms want you to do less of:<li>untrackably copy a link to something</li><li>save an image</li><li>copy arbitrary text</li><li>decide what to look at next</li><li>return to where you were a minute ago</li><li>find options you can change</li><li>know how many search results there are / length of scroll</li><li>decide what part of a video you want to see</li><li>prioritize and deprioritize content based on your own preferences</li><li>manage your own attention</li>

Mobile apps make this agenda easier. Apps are for companies.

The web makes this agenda harder. The web is for people.

RIP the Corporation for Public Broadcasting. It genuinely made ...

2025-08-01T18:52:33Z

RIP the Corporation for Public Broadcasting.

It genuinely made generations of kids both smarter and more empathetic.

The only winners in this outcome are the enemies of the United States.

And I didn't realize it was going to hit me this hard.

https://cpb.org/pressroom/Corporation-Public-Broadcasting-Addresses-Operations-Following-Loss-Federal-Funding

Oh look, another "door locks are bad because someone can ...

2025-07-30T05:03:53Z

Oh look, another "door locks are bad because someone can crawl through the window" scare article (this time a sponsored one). Not responsible journalism, Bleeping.

I especially "appreciate" the scare quotes around "phishing-resistant" 🤬

Never tell a call with 300 people that they can just drop ...

2025-07-22T17:32:52Z

Never tell a call with 300 people that they can just drop questions into chat whenever they want for a 3 hour presentation. Only takes 5‰ of them taking you up on it -- who somehow don't realize most of their questions are about to be answered -- to derail velocity.

Man, this feels like some data-hoarding person would have ...

2025-07-16T22:16:43Z

In reply to nevent1q…55p4
_________________________

Man, this feels like *some* data-hoarding person would have retained it -- or was it never actually downloadable?

I mean, I just liked the quote. Wasn't really trying to ...

2025-07-11T05:11:53Z

In reply to nevent1q…uych
_________________________

I mean, I just liked the quote. Wasn't really trying to invoke the overall article either way.

npub1qu3wjn555sk4g4xaehm55a09hhszlkrxhpcu404zytw3elkwnf8qg7rukd (npub1qu3…rukd)

"Engineering should eat security." -- Caleb Sima Source: ...

2025-07-11T03:03:08Z

"Engineering should eat security."
-- Caleb Sima

Source:
https://danielmiessler.com/blog/ai-creative-destruction-wave
(via npub1qu3wjn555sk4g4xaehm55a09hhszlkrxhpcu404zytw3elkwnf8qg7rukd (npub1qu3…rukd))

Couldn't find this anywhere and my scanner is borked, but at ...

2025-07-08T16:13:45Z

Couldn't find this anywhere and my scanner is borked, but at least here's a photo, with alt text.

Love Rich Tennant -- quite insightful. Not affiliated, just a fan:

https://the5thwave.com/

1/2

Mention of "several mitigations" without details ... ...

2025-07-08T13:55:45Z

In reply to nevent1q…m7gs
_________________________

Mention of "several mitigations" without details ... sheesh

That sounds quite satisfying -- nice work! Need before and after ...

2025-06-28T23:47:22Z

In reply to nevent1q…aky5
_________________________

That sounds quite satisfying -- nice work! Need before and after photos 😉

Ooh, really?! That's so great. Legit impressed

2025-06-27T03:24:26Z

In reply to nevent1q…pnwf
_________________________

Ooh, really?! That's so great. Legit impressed

Collab / call platforms: Just add a "When someone shares ...

2025-06-26T16:03:45Z

Collab / call platforms:

Just add a

"When someone shares their screen, give all other attendees a 'Can you see what is being shared? Yes / No' button

already.

Assuming you have no plans to leave the house that day ... at ...

2025-06-24T14:12:36Z

Assuming you have **no plans to leave the house** that day ... at what percentage of battery level on your primary mobile device do you *start* to get uncomfortable, and think you should charge it?

Assume you will not have access to a charger or external power pack while away (If you do end up having to leave).

(If your number is somewhere in between, choose the next lower number)

(Please RT to improve sample size.)