I do cool things that matter ;) @antonis@mastodon.social
Zürich, Switzerland
Joined June 2009
- Tweets42.9K
- Following429
- Followers935
- Likes4
DaKnOb retweeted
ISRG is hiring an SRE to help keep the world’s largest certificate authority running. Come join our team and help us make the internet safer for all. abetterinternet.org/careers/…
DaKnOb retweeted
After a constructive engagement with @ThreemaApp during responsible disclosure, this is unexpectedly dismissive. We broke their protocol 6 ways. They updated it, thanks to our work (breakingthe3ma.app). So of course our work applies to an old version.
There’s a new paper on Threema’s old communication protocol. Apparently, today’s academia forces researchers and even students to hopelessly oversell their findings. Here’s some real talk: threema.ch/bp/new-paper-on-o…
DaKnOb retweeted
We (@winterdeaf @kientuong114 and I) took a deep dive on Threema, a Swiss-made secure messaging app. We found 6 new cryptographic vulnerabilities. Full paper at breakingthe3ma.app; mini-thread follows. #threema
DaKnOb retweeted
Don't dump LastPass because of 7 breaches, dump them for crap crypto: Padding oracle vulns, ECB pass len leaks, switch to CBC for new vaults not old ones, vault key uses AES256 but only 128 bits entropy, key webui leak, silent KDF downgrade, KDF hash log leak, keys left in mem.
The blue keys that are cheaper are perfectly fine for 2FA and to some degree as Passkeys / for Passwordless login. The black keys are only needed for the Nano form factor, the Lightning connector, or their other applications (PIV, GPG, etc.).
DaKnOb retweeted
This video of cops in Nevada searching a suspect and finding a seed phrase is pretty wild. Imagine having your seed phrase become part of public record due to it being captured by an officer's body camera!
I have a little bit more, 1/5th, however it’s just one specific set of people mostly, which means Mastodon now is not covering everything I used to see here.
I used fedifinder.glitch.me/ to find everyone and add them on Mastodon so I can begin the migration.
DaKnOb retweeted
Oh yeah, forgot about that. I'm pretty sure we have the plumbing for this, let me see if we expose it.
It seems to be working just fine:
crt.sh/?q=sl.daknob.net
We just need more CT Logs to make this sustainable ;)
Google Trust Services supports setting the notBefore and notAfter via ACME so you can specify the exact duration, for up to 90 days.
I’ve been using it with this patch: go-review.googlesource.com/c…
Works fine, and I added it as “requested” to convey the fact that it may not happen.
DaKnOb retweeted
Fine ok you get *another* blog post, this time about why doing on-device WebAuthn (rather than requiring a separate token) is harder in the PC world than on Macs and why Linux just doesn't have a good story here yet: mjg59.dreamwidth.org/62746.h…
I spoke yesterday about the future of Web Authentication, and you can find the recording online here:
youtube.com/watch?v=Iyw5s9F-…
#WebAuthn #Web #WWW #Security #Authentication