"Computer security is not too good in 2020. It’s really kind of a mess and crypto is one of the things that works. Taking away this tool would be a disaster for the entire connected world."

Experts Worry Crypto War Two May Go the Other Way

duo.com/decipher/experts-worry

I am a huge proponent of using TLS everywhere it's possible to use it, so I very much appreciate
Troy demonstrating why even statically generated websites should use HTTPS.

troyhunt.com/heres-why-your-st

Deployed 82nd Airborne unit told to use these encrypted messaging apps on government cell phones

“Unfortunately, those apps are more secure than texting in the clear, which is more or less the alternative. Granted, if a hostile party has access to the handset, that encryption isn’t particularly helpful.”

militarytimes.com/flashpoints/

Time to look for alternatives.

LastPass Mistakenly Removes Extension from Chrome Store, Causes Outage

An accidental outage was caused by LastPass yesterday by mistakenly removing the LastPass extension from the Chrome Web Store, leading to users seeing 404 errors when trying to download and install it on their devices.

bleepingcomputer.com/news/secu

Guard your Tomatoes, folks

Internet routers running Tomato are under attack by notorious crime gang

The Muhstik botnet has targeted other IoT devices. Now it's attacking Tomato routers.

arstechnica.com/information-te

Glad I switched to BitWarden last year.

LastPass is in the midst of a major outage | ZDNet

LastPass issue appears to impact users with accounts dating back to 2014 and earlier.

zdnet.com/article/lastpass-is-

I have been playing with TShark on my Chromebook. Works well and is quite powerful.

Use Wireshark at the Linux command line with TShark

opensource.com/article/20/1/wi

Build a 10 USD Raspberry Pi Tunnel Gateway

In this tutorial I'll show you how to build an Internet Gateway for your home network using a Raspberry Pi and a HTTPS tunnel for just 10 USD.

blog.alexellis.io/raspberry-pi

Anyone using Krypton and have an opinion on it?

Krypton U2F Authenticator

Unphishable, zero-touch two-factor logins

krypt.co/

"Instead of a password, a private-public keypair (known as a credential) is created for a website. The private key is stored securely on the user’s device; a public key and randomly generated credential ID is sent to the server for storage. The server can then use that public key to prove the user’s identity."

An introduction to Web Authentication (WebAuthn), the new API that can replace passwords with strong authentication.

webauthn.guide/

Further info on SameSite cookie problem.

WTF is Chrome’s SameSite cookie update?

Google is again tweaking how its leading browser handles cookies, all part of moves by browsers to beef up privacy controls.

digiday.com/media/what-is-chro

Nice overview of cookies, CSRF, and how we can try to fix this mess.

Promiscuous Cookies and Their Impending Death via the SameSite Policy

troyhunt.com/promiscuous-cooki

Active Directory Security Fundamentals

A lot of (targeted) ransomware attacks have been leveraging through Active Directory and it has made the headlines. Most organizations are struggling to secure their AD, because it is complex. It r…

identityaccess.management/2019

Anyone who would willingly install an extension with a name like that deserves their fate.

A Google Chrome extension named Shitcoin Wallet is stealing passwords and wallet private keys, security researcher says.

zdnet.com/article/chrome-exten

While I will admit that I was put out by the shuttering of Google Reader, I don't find the accusation they killed RSS to be even remotely true. I switched easily to Feedly and then Inoreader and never looked back. RSS, especially in the area of podcasts, has only grown since then. Just some more click-baity nonsense that capitalizes on contemporary anti-Google sentiment.

Dan McKinley :: Google Reader Killed RSS

mcfunley.com/google-reader-kil

Anyone Can Check for Magecart with Just the Browser

What can a normal everyday user do to check and see if their favorite shopping site is compromised? In this blog post, I will go over a few steps that don’t require any security training to perform.

trustwave.com/en-us/resources/

Show more
Infosec Exchange

A Mastodon instance for info/cyber security-minded people.