Juan Snyman @stringlytyped@infosec.exchange
Things that make me happy: infosec, chocolate. Things that make me sad: crypto paranoia, misplaced apostrophes. Rev 3:7-8
- Keybase
- https://keybase.io/stringlytyped
- Places
- 🇿🇦 (now) | 🇨🇦 🇺🇸
Hello new folks! 👋 Since everyone is doing it, I'll post another #introduction. I am relatively new to Mastodon myself, but I've found a community here that is welcoming, tolerant and friendly. Hope you'll have the same experience.
I toot about #webdev, #infosec and general #technology related topics.
I regularly look through the #introductions tag for new people with similar interests, but if I miss you, give me a follow or send me a message, and I'll follow you back. 🙂
"It’s actually a big myth that search engines need to track your personal search history to make money or deliver quality search results" - DuckDuckGo's CEO explains how it’s become profitable without gathering user data
https://www.quora.com/What-is-the-revenue-generation-model-for-DuckDuckGo/answer/Gabriel-Weinberg
Institutional corruption Show more
Institutional corruption Show more
Institutional corruption Show more
Institutional corruption Show more
Wow, FileZilla’s bundled installer includes a malware downloader and the dev defends it horribly.
If using FileZilla, uninstall and find something else. Even if this issue is fixed, the morally ambiguous and defensive response is very concerning.
uspol, cdnpol, borders Show more
Find out how much your website costs someone to access on mobile networks around the world: https://whatdoesmysitecost.com/
Solved a second NPM-related issue this week by using Yarn instead. Not sure why I hadn't switched sooner.
Facebook confirms that it tracks how you move mouse on the computer screen
The social networking platform also admitted that it collects information about operating systems, hardware, software versions, battery levels, signal strength, available storage space, Bluetooth signals, file names and types, device Ids, browser and browser plugins (which is almost all of the information available on and about your device), from the users' phones, TV and other connected devices.
uspoli: trump, kim & other crazy people Show more
Random fun fact: you can print your own 7600-volume copy of the English Wikipedia ...as long as you have half a million dollars you're not using. http://printwikipedia.lulu.com/
@0x4464 Just wanted to say that I love the link underline effect you have on your website. I came across something similar a few days ago (https://zachholman.com/talk/utc-is-enough-for-everyone-right) and it got me thinking about what other animations could be done with links, so I am excited to see another neat example. 🙂
Interesting take on the GDPR by EasyDNS: https://easydns.com/blog/2018/05/28/gdrp-why-should-any-non-euro-companies-care/
Basically, they claim not to fall under the jurisdiction of EU law, and go further to say that acting as if they do could expose them to other undesirable (from their standpoint) EU laws, like VAT. It makes sense, and all discussions I’ve had with real lawyers indicate that they likely are correct, despite the prevailing opinion that it applies to everyone serving ppl in EU
Just finished writing my last A-level CS exam. It is such a relief to be done!
In Apple Mail, there is no protecting PGP-encrypted messages. Even with disabling remote content, GPGTools is vulnerable to EFAIL, and the only mitigation for now is to switch to Thunderbird/Enigmail, and disable viewing HTML emails
https://theintercept.com/2018/05/25/in-apple-mail-theres-no-protecting-pgp-encrypted-messages/
TIL that <marque> still works. Can't wait to use it on my GeoCities site.
lol ok
As such, #efail is not a very good attack for a person targeting corporate emails.
- Much of the encrypted email is internal.
- If an attacker has access to internal data stores, they probably have access to the cleartext emails from the employee's own endpoint of client anyways.
So after a couple meetings and going through more of the links, including the GPG response, etc.
My thoughts on the #efail vuln:
1) The core requirement is that an attacker needs to get ahold of an encrypted email first. This is axiomatic. This is the thing that they need to decrypt.
The attacker can do either by:
a) Sniffing the encrypted email in transit
b) Stealing the encrypted email at rest.
