Security

Contrary to what is stated on the polyfill.io website, Cloudflare has never recommended the polyfill.io service or authorized their use of Cloudflare’s name on their website. We have asked them to remove the false statement, and they have, so far, ignored our requests. This is yet another warning sign that they cannot be trusted.

If it ain't 'murican we ban 'em!

Guess all foreign cars should be next, what with all the telemetry and all...

A 22-year-old man from the United Kingdom arrested this week in Spain is allegedly the ringleader of Scattered Spider, a cybercrime group suspected of hacking into Twilio, LastPass, DoorDash, Mailchimp, and nearly 130 other organizations over the past two years.

im working on a decentralized chat app. i open sourced it to get feedback on the implementation.

for a project like this, its important for it to be open source in order to gain user confidence in the security. but i find that the project is too complicated for pro-bono security assessment work (which is understandable).

fiverr probably isnt the best place to find reputable support, but i wanted to see the prices. it seems to range from 50 to 5k+

i wont be getting the support any time soon, but id like guage an estimate. i havent done something like this before so any/all advice is appriciated.

i created a threat-model which may help: https://positive-intentions.com/docs/research/threat-model/

to explain my app in more detail: https://medium.com/@positive.intentions.com/introducing-decentralized-chat-377c4aa37978

github repo: https://github.com/positive-intentions/chat

KrebsOnSecurity has been in intermittent contact with LockBitSupp for several months over the course of reporting on different LockBit victims. Reached at the same ToX instant messenger identity that the ransomware group leader has promoted on Russian cybercrime forums, LockBitSupp claimed the authorities named the wrong guy.

LockBitSupp, who now has a $10 million bounty for his arrest from the U.S. Department of State, has been known to be flexible with the truth.

When an email is forwarded, the position of the original email in the DOM usually changes, allowing for CSS rules to be selectively applied only when an email has been forwarded.

Anyone here use fidelity (https://www.fidelity.com/)? I had to call to get something done with my account and thought it was weird that they have you (more/less) T9 dial your password into the system, though its not real T9 in that (for example) one press of 2 would mean either a,A,b,B,c,C,2. They say for special characters just give a * sign.

Any thoughts on if that is safe on their part? It seems weird to me since they either need the password in plaintext on their end or I guess the hash of the T9 version of the password which would be less secure anyways because of: all one case and only one type of 'special character'.

And yes: before you ask this was 100% the actual fidelity phone number: +1 800-343-3548

In their defense they did ask for other verification information once I got a person, but still felt really weird.

Any thoughts on the security of this mechanism?

Describes considerations of convenience and security of auto-confirmation while entering a numeric PIN - which leads to information disclosure considerations.

An attacker can use this behavior to discover the length of the PIN: Try to sign in once with some initial guess like “all ones” and see how many ones can be entered before the system starts validating the PIN.

Is this a problem?

This was a fascinating and informative read. I hope the author makes progress on "creating an open-source project to de-cloud and debug smart home products"; I would love to contribute to something like that!

Why Decentralization is the Only Way to Prevent Cybersecurity Breaches?

1/ A decentralized network is built by people, where individuals function as nodes within the network.

2/ There is no central server that stores data in a single location; instead, all data is distributed across random devices/nodes within the decentralized network.

3/ Data can only be decrypted using a unique private key specific to each user.

4/ Messages are sent with end-to-end encryption (E2EE) within a peer-to-peer (P2P) decentralized network, bypassing the need for a central server, unlike centralized platforms such as Telegram or WhatsApp.

The absence of a central server translates to no centralized data storage, which in turn means no potential entry point for hackers to exploit and compromise data, thus preventing data breaches.

Three decentralized tool that I tried:

1. SimpleX:

• Simply a decentralized messaging tool, safer than Session

2. Nostr:

• Fully decentralized social platform
• Full of spam, hard to use compares to mastodom.

3. WireMin:

• Not open sourced (if they are open sourced, it will be my top choice.)
• A combination of mastodon and Session