VocaLounge

0 posts0 participants0 posts today

Ryan HodnettDoes anyone know what this is? It was in shallow water in a pond in Norway.<a href="https://mastodon.world/tags/Unidentified" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Unidentified</a> <a href="https://mastodon.world/tags/Identification" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Identification</a> <a href="https://mastodon.world/tags/ArtWithOpenSource" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ArtWithOpenSource</a> <a href="https://mastodon.world/tags/Darktable" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Darktable</a> <a href="https://mastodon.world/tags/CCBYSA" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#CCBYSA</a> <a href="https://mastodon.world/tags/Nature" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Nature</a> <a href="https://mastodon.world/tags/NaturePhotography" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#NaturePhotography</a> <a href="https://mastodon.world/tags/Photography" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Photography</a>

loganer<a href="https://mastodon.social/tags/Bug" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Bug</a> <a href="https://mastodon.social/tags/Canada" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Canada</a> <a href="https://mastodon.social/tags/Aylmer" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Aylmer</a> <a href="https://mastodon.social/tags/Ontario" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Ontario</a> <a href="https://mastodon.social/tags/Identification" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Identification</a> I have never seen anything like this before. some kind of spider/stick bug hybrid?

Erik van Straten<a href="https://infosec.exchange/@fifonetworks" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@fifonetworks</a> : it's a taboo. Nobody really wants to accept that infosec is extremely hard, and most are in denial that they're at bigger risks than they think they are.We (security people) often come up with a bunch of measures without explaining why they are a good idea, what side effects they have and which risks are not covered at all.Here's one example: "use 2FA".🔸 WEAK MFA • Why use 2FA/MFA in the first place? Because most people use (and reuse) extremely weak passwords. 2FA does not _SOLVE_ *that* problem.• SMS and voice are a bad idea anyway because of the risks of telephone "line" interception, call redirects or "SIM-swaps" (i.e. a miscreant hijacks your phone number).• Many TOTP apps suck or sucked (see <a href="https://www.usenix.org/conference/usenixsecurity23/presentation/gilsenan" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://www.usenix.org/conference/usenixsecurity23/presentation/gilsenan</a> by Conor Gilsenan <a href="https://infosec.exchange/@conorgil" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@conorgil</a> et al. in <a href="https://infosec.exchange/@conorgil/109542074585730853" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://infosec.exchange/@conorgil/109542074585730853</a>). A *lot* of people lost access to their accounts because Google Authenticator would not make backups of the underlying secrets, which people found out about after their phone died or was stolen. Authy in particular is bad (in Dutch: <a href="https://tweakers.net/nieuws/207532/#r_18549330" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://tweakers.net/nieuws/207532/#r_18549330</a>).Effectively TOTP apps make people use a second password (unique for each website-account) that, supposedly, they do not have to remember, nor are they made aware that therefore (secure!) backups are a necessity. If those secrets are simply stored in their cloud-accounts, without encryption using an *independent* password, then they offer an extremy overestimated level of protection (it's mostly security by obscurity in such a case).• None of the regular 2FA/MFA solutions protect against "evil proxies" (like those based on EvilGinx2) often provided by PhaaS (Phishing as a service) providers, used by a rapidly increasing number of attackers - as acknowledged by Microsoft in 2019 (link + details in <a href="https://infosec.exchange/@ErikvanStraten/112974991373414022" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://infosec.exchange/@ErikvanStraten/112974991373414022</a> - whose marketeers, IMO misleading, still love to tell anyone that they should use Microsoft Authenticator).🔸 STRONG MFA Strong MFA (such as provided by passkeys and hardware keys) eliminates the *human* vulnerability of not knowing whether a given domain name belongs to the apparent (easily impersonated) owner of a website.However, an increasing number of mis-issued certificates (this week, for potentially all of the .mobi TLD: <a href="https://arstechnica.com/security/2024/09/rogue-whois-server-gives-researcher-superpowers-no-one-should-ever-have/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://arstechnica.com/security/2024/09/rogue-whois-server-gives-researcher-superpowers-no-one-should-ever-have/</a>; some earlier attacks: <a href="https://infosec.exchange/@ErikvanStraten/112914050216821746" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://infosec.exchange/@ErikvanStraten/112914050216821746</a>) means that passkeys and hardware keys are *not* as phishing-resistant as marketeers like us to believe.That apart from the fact that passkeys and hardware keys are *not at all* without other issues.🔸 PHISHING There are roughly two types of phishing:1) Where the user shares information with a website of an owner they believe to have interacted with before, or2) Where they share personal info with, and/or pay money to, a website of an owner who is "new" to them (like a webshop that they've never done business with before).Of course, 2FA/MFA do not help at all in case 2 (example in <a href="https://infosec.exchange/@ErikvanStraten/112988945087291542" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://infosec.exchange/@ErikvanStraten/112988945087291542</a>).IMO it is impossible to teach most people to reliably distinguish between fake and real on the internet (this is not only *my* opinion: <a href="https://security.googleblog.com/2024/05/on-fire-drills-and-phishing-tests.html" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://security.googleblog.com/2024/05/on-fire-drills-and-phishing-tests.html</a>).The common "instructions" to distinguish between fake an real websites are totaly unreliable, like "check for typos" or use a site like scamadvisor. There are way too many false positives *and* false negatives, while cybercriminals have an easy job to evade all such criteria. It should not be a requirement to be a forensics expert to safely use the internet.🔸 INTERNET IS TOO INSECURE We need to fix the internet first before we bother people with (currently unreliable) measures (typically without pointing out remaining or new risks).🔸 FIX Big tech have turned certificates into something comparable to passports that only show a totally meaningless SSN (Social Security Number). Which is why cybercrime is booming on the internet (for example, look at the approx. 1500 domain names listed below "Website data" in <a href="https://www.scamadviser.com/check-website/href.li" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://www.scamadviser.com/check-website/href.li</a>).Fix: see <a href="https://infosec.exchange/@ErikvanStraten/113079966331873386" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://infosec.exchange/@ErikvanStraten/113079966331873386</a>.🔸 EXAMPLE See the images below. When tapping "Scan", Chrome on my Android phone goes full screen and scans C:\Users\ (among others). Eventually it advised me to download "t4gf8h.zip" (<a href="https://www.virustotal.com/gui/file/0858ecedb7bfa0c148cd2ed282cd0dc7e11beee5c00fccebc4eb9f98094a7a67/summary" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://www.virustotal.com/gui/file/0858ecedb7bfa0c148cd2ed282cd0dc7e11beee5c00fccebc4eb9f98094a7a67/summary</a>).🔸 FAKE VS REAL (AUTHENTIC) Even strong MFA/2FA does not help. How are (non-nerd) Windows users supposed to know that this is *NOT* a McAfee website and *NOT* a McAfee virus scanner, with currently (according to VT, which may not be 100% correct, but -in my experience- provides a good indication) is detected by only 7/67 scanners?<a href="https://infosec.exchange/tags/Phishing" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Phishing</a> <a href="https://infosec.exchange/tags/Infosec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Infosec</a> <a href="https://infosec.exchange/tags/BigTech" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#BigTech</a> <a href="https://infosec.exchange/tags/PEBCAK" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#PEBCAK</a> <a href="https://infosec.exchange/tags/Certificates" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Certificates</a> <a href="https://infosec.exchange/tags/DV" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#DV</a> <a href="https://infosec.exchange/tags/Passport" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Passport</a> <a href="https://infosec.exchange/tags/SSN" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#SSN</a> <a href="https://infosec.exchange/tags/Awareness" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Awareness</a> <a href="https://infosec.exchange/tags/SecurityAwareness" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#SecurityAwareness</a> <a href="https://infosec.exchange/tags/CyberSecurityAwareness" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#CyberSecurityAwareness</a> <a href="https://infosec.exchange/tags/Identification" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Identification</a> <a href="https://infosec.exchange/tags/Authentication" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Authentication</a> <a href="https://infosec.exchange/tags/Impersonation" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Impersonation</a> <a href="https://infosec.exchange/tags/AnonymousWebsites" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#AnonymousWebsites</a> <a href="https://infosec.exchange/tags/2FA" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#2FA</a> <a href="https://infosec.exchange/tags/mfa_bypass" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#mfa_bypass</a> <a href="https://infosec.exchange/tags/mfa_yubikey" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#mfa_yubikey</a> <a href="https://infosec.exchange/tags/Yubikey" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Yubikey</a> <a href="https://infosec.exchange/tags/DistinguishBetweenRealAndFake" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#DistinguishBetweenRealAndFake</a> <a href="https://infosec.exchange/tags/DistinguishBetweenFakeAndReal" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#DistinguishBetweenFakeAndReal</a>

Erik van StratenIn <a href="https://www.security.nl/posting/852814/DV+certs%3A+de+maat+is+vol" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://www.security.nl/posting/852814/DV+certs%3A+de+maat+is+vol</a> schreef ik (in het Nederlands) waarom het internet één grote criminele bende is geworden, refererend naar een eerdere serie (van 3) Engelstalige toots van mijn hand (<a href="https://infosec.exchange/@ErikvanStraten/112914047006977222" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://infosec.exchange/@ErikvanStraten/112914047006977222</a>).In de tweede helft van <a href="https://security.nl/posting/852741" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://security.nl/posting/852741</a> beschrijf ik een oplossing voor een deel van het probleem: dat websites, omwille van winstbejag van Big Tech, tot *eenheidsworst* zijn gemaakt.Als bezoeker kunt u namelijk *nergens* meer uit opmaken of een website authentiek is, of dat er sprake is van inpersonatie van de echte website - door cybercriminelen.Dat wordt veroorzaakt door browsermakers en certificaatuitgevers die alle mogelijke moeite hebben gedaan om u de informatie te onthouden *WIE* VERANTWOORDELIJK is voor een website (de domeinnaam daarvan om precies te zijn, die u ziet in de adresbalk van uw browser).De *suggestie* van Big Tech dat het voor *u* goed genoeg is als u weet wat de domeinnaam is van een website, is absurd.Dat is, in de praktijk, totale onzin omdat mensen uiterst slecht zijn in het exact (noodzakelijkerwijs 100% foutloos) kunnen herkennen van *volledige* domeinnamen - en eenvoudig gefopt kunnen worden (zelfs als zij begrijpen waar zij op moeten letten en hoe domeinnamen zijn opgebouwd).Bij voor mensen nieuwe websites (zoals van een gegooglde loodgieter of een sandalenwebshop) zegt een domeinnaam meestal ofwel niets *betrouwbaars* over wie de eigenaar is, of is pure misleiding - terwijl elke pagina van de website zelf hartstikke nep kan zijn.Kom in opstand tegen de geldwolven op internet!<a href="https://infosec.exchange/tags/Certs" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Certs</a> <a href="https://infosec.exchange/tags/Misissuance" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Misissuance</a> <a href="https://infosec.exchange/tags/Mis_issuance" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Mis_issuance</a> <a href="https://infosec.exchange/tags/Revocation" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Revocation</a> <a href="https://infosec.exchange/tags/Revoked" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Revoked</a> <a href="https://infosec.exchange/tags/Weaknessess" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Weaknessess</a> <a href="https://infosec.exchange/tags/WeakCertificates" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#WeakCertificates</a> <a href="https://infosec.exchange/tags/WeakAuthentication" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#WeakAuthentication</a> <a href="https://infosec.exchange/tags/Authentication" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Authentication</a> <a href="https://infosec.exchange/tags/Impersonation" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Impersonation</a> <a href="https://infosec.exchange/tags/Identification" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Identification</a> <a href="https://infosec.exchange/tags/Infosec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Infosec</a> <a href="https://infosec.exchange/tags/DNS" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#DNS</a> <a href="https://infosec.exchange/tags/DNSHijacks" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#DNSHijacks</a> <a href="https://infosec.exchange/tags/SquareSpace" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#SquareSpace</a> <a href="https://infosec.exchange/tags/Authorization" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Authorization</a> <a href="https://infosec.exchange/tags/UnauthorizedChanges" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#UnauthorizedChanges</a> <a href="https://infosec.exchange/tags/UnauthorizedModifications" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#UnauthorizedModifications</a> <a href="https://infosec.exchange/tags/DeFi" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#DeFi</a> <a href="https://infosec.exchange/tags/dydx_exchange" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#dydx_exchange</a> <a href="https://infosec.exchange/tags/CryptoCoins" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#CryptoCoins</a>

Erik van Straten🌘DV-CERT MIS-ISSUANCE INCIDENTS🌒 🧵#3/3Note: this list (in reverse chronological order) is probably incomplete; please respond if you know of additional incidents!2024-07-31 "Sitting Ducks" attacks/DNS hijacks: mis-issued certificates for possibly more than 35.000 domains by Let’s Encrypt and DigiCert: <a href="https://blogs.infoblox.com/threat-intelligence/who-knew-domain-hijacking-is-so-easy/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://blogs.infoblox.com/threat-intelligence/who-knew-domain-hijacking-is-so-easy/</a> (src: <a href="https://www.bleepingcomputer.com/news/security/sitting-ducks-dns-attacks-let-hackers-hijack-over-35-000-domains/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://www.bleepingcomputer.com/news/security/sitting-ducks-dns-attacks-let-hackers-hijack-over-35-000-domains/</a>)2024-07-23 Let's Encrypt mis-issued 34 certificates,revokes 27 for dydx.exchange: see 🧵#2/3 in this series of toots2023-11-03 jabber.ru MitMed/AitMed in German hosting center <a href="https://notes.valdikss.org.ru/jabber.ru" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://notes.valdikss.org.ru/jabber.ru</a>2023-11-01 KlaySwap en Celer Bridge BGP-hijacks described <a href="https://www.certik.com/resources/blog/1NHvPnvZ8EUjVVs4KZ4L8h-bgp-hijacking-how-hackers-circumvent-internet-routing-security-to-tear-the" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://www.certik.com/resources/blog/1NHvPnvZ8EUjVVs4KZ4L8h-bgp-hijacking-how-hackers-circumvent-internet-routing-security-to-tear-the</a>2023-09-01 Biggest BGP Incidents/BGP-hijacks/BGP hijacks <a href="https://blog.lacnic.net/en/routing/a-brief-history-of-the-internets-biggest-bgp-incidents" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://blog.lacnic.net/en/routing/a-brief-history-of-the-internets-biggest-bgp-incidents</a>2022-09-22 BGP-hijack mis-issued GoGetSSL DV certificate <a href="https://arstechnica.com/information-technology/2022/09/how-3-hours-of-inaction-from-amazon-cost-cryptocurrency-holders-235000/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://arstechnica.com/information-technology/2022/09/how-3-hours-of-inaction-from-amazon-cost-cryptocurrency-holders-235000/</a>2022-09-09 Celer Bridge incident analysis <a href="https://www.coinbase.com/en-nl/blog/celer-bridge-incident-analysis" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://www.coinbase.com/en-nl/blog/celer-bridge-incident-analysis</a>2022-02-16 Crypto Exchange KLAYswap Loses $1.9M After BGP Hijack <a href="https://www.bankinfosecurity.com/crypto-exchange-klayswap-loses-19m-after-bgp-hijack-a-18518" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://www.bankinfosecurity.com/crypto-exchange-klayswap-loses-19m-after-bgp-hijack-a-18518</a>🌘BACKGROUND INFO🌒 2024-08-01 "Cloudflare once again comes under pressure for enabling abusive sites (Dan Goodin - Aug 1, 2024) <a href="https://arstechnica.com/security/2024/07/cloudflare-once-again-comes-under-pressure-for-enabling-abusive-sites/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://arstechnica.com/security/2024/07/cloudflare-once-again-comes-under-pressure-for-enabling-abusive-sites/</a>2018-08-15 Usenix-18: "Bamboozling Certificate Authorities with BGP" <a href="https://www.usenix.org/conference/usenixsecurity18/presentation/birge-lee" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://www.usenix.org/conference/usenixsecurity18/presentation/birge-lee</a><a href="https://infosec.exchange/tags/DV" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#DV</a> <a href="https://infosec.exchange/tags/LE" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#LE</a> <a href="https://infosec.exchange/tags/LetsEncrypt" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#LetsEncrypt</a> <a href="https://infosec.exchange/tags/Certificates" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Certificates</a> <a href="https://infosec.exchange/tags/Certs" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Certs</a> <a href="https://infosec.exchange/tags/Misissuance" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Misissuance</a> <a href="https://infosec.exchange/tags/Mis_issuance" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Mis_issuance</a> <a href="https://infosec.exchange/tags/Revocation" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Revocation</a> <a href="https://infosec.exchange/tags/Revoked" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Revoked</a> <a href="https://infosec.exchange/tags/Weaknessess" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Weaknessess</a> <a href="https://infosec.exchange/tags/WeakCertificates" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#WeakCertificates</a> <a href="https://infosec.exchange/tags/WeakAuthentication" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#WeakAuthentication</a> <a href="https://infosec.exchange/tags/Authentication" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Authentication</a> <a href="https://infosec.exchange/tags/Impersonation" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Impersonation</a> <a href="https://infosec.exchange/tags/Identification" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Identification</a> <a href="https://infosec.exchange/tags/Infosec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Infosec</a> <a href="https://infosec.exchange/tags/DNS" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#DNS</a> <a href="https://infosec.exchange/tags/DNSHijacks" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#DNSHijacks</a> <a href="https://infosec.exchange/tags/SquareSpace" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#SquareSpace</a> <a href="https://infosec.exchange/tags/Authorization" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Authorization</a> <a href="https://infosec.exchange/tags/UnauthorizedChanges" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#UnauthorizedChanges</a> <a href="https://infosec.exchange/tags/UnauthorizedModifications" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#UnauthorizedModifications</a> <a href="https://infosec.exchange/tags/DeFi" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#DeFi</a> <a href="https://infosec.exchange/tags/dydx_exchange" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#dydx_exchange</a> <a href="https://infosec.exchange/tags/CryptoCoins" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#CryptoCoins</a>

Erik van Straten🌘DV-CERT MIS-ISSUANCES & OCSP ENDING🌒 🧵#1/3On Jul 23, 2024, Josh Aas of Let's Encrypt wrote, while his nose was growing rapidly:<<< Intent to End OCSP Service [...] We plan to end support for OCSP primarily because it represents a considerable risk to privacy on the Internet. [...] CRLs do not have this issue. >>> <a href="https://letsencrypt.org/2024/07/23/replacing-ocsp-with-crls.html" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://letsencrypt.org/2024/07/23/replacing-ocsp-with-crls.html</a>🚨 On THAT SAME DAY, Jul 23, 2024, LE (Let's Encrypt) issued at least 34 certs (certificates) for [*.]dydx.exchange to cybercriminals, of which LE revoked 27 mis-issued certs approximately 6.5 hours later.Note that falsified DNS records may instruct DNS caching servers to retain entries for a long time; therefore speedy revocation helps reducing the number of victims.Apart from this mis-issuance *blunder*, CRL's have HUGE issues that Josh does not mention: they are SSSLLLOOOWWW and files are potentially huge - while OCSP is instantaneous and uses little bandwith.🌘NO OCSP INCREASES INTERNET RISKS🌒 If LE quits OCSP support, the average risk of using the internet will *increase*.🌘LIES🌒 Furthermore, the privacy argument is mostly moot, as nearly every website makes people's browsers connect to domains owned by Google (and even let's those browsers execute Javascript from third party servers, allowing nearly unlimited espionage). In addition, IP-addresses are sent in the plain anyway (📎).(📎 When using a VPN, source and destination IP-addresses *within the tunnel* are not visible for anyone with access to the *outside* of the tunnel - but they are sent in the plain between the end of the tunnel and the actual server.)Worse, the remote endpoint of your E2EE https connection increasingly often is *not* the actual server (that website was moved to sombody else's server in the cloud anyway), but a CDN proxy server which has the ability to monitor everything you do (unencrypting your data: three letter agencies love it, FISA section 702 grants them unlimmited access - without anyone informing you).🤷 LE may try to blame others for their mis-issuance blunder, but *THEY* chose to use old, notoriously untrustworthy, internet protocols (BGP and DNS, including database records - that DNSSEC will never protect) as the basis for authentication. By making that choice, LE and other DV cert suppliers were simply ASKING for trouble.🔓 In fact, the promise that Let's Encrypt would make the internet safer was misleading from the start: domain names are mostly meaningless to users, 100% fault intolerant, unpredictable and easily forgotten. If your browser is communicating with a malicious server, encryption is pointless.Josh, stop lying to us; your motives are purely economical.🌘CORRUPT: BIG TECH FACILITATES CRIME🌒 DV-certs were heavily promoted by Google (not for phun but for profit) after their researchers "proved" that it was possible to show misleasing identification information in the browser's address bar after certificate mis-issuance (the "Stripe, Inc" incident, <a href="https://arstechnica.com/information-technology/2017/12/nope-this-isnt-the-https-validated-stripe-website-you-think-it-is/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://arstechnica.com/information-technology/2017/12/nope-this-isnt-the-https-validated-stripe-website-you-think-it-is/</a>).This message was repeated by many specialists (e.g. <a href="https://www.troyhunt.com/paypals-beautiful-demonstration-of-extended-validation-fud/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://www.troyhunt.com/paypals-beautiful-demonstration-of-extended-validation-fud/</a>) with stupid arguments: certificates do NOT directly warrant reliable websites.OV and EV certificates, and QWAC's, more or less reliably, warrant *WHO OWNS* a domain name. That means that users know *who* they're doing business with, can depend on their reputation and can sue them if they violate laws."Of course" Google recently lost trust in Entrust for mis-issuing certificates (<a href="https://security.googleblog.com/2024/06/sustaining-digital-certificate-security.html" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://security.googleblog.com/2024/06/sustaining-digital-certificate-security.html</a>).Meanwhile the internet has become a corrupt and criminal mess; its users get to see misleading identification info in their browser's address bar WAY MORE OFTEN, e.g. https:⁄⁄us–usps–ny.com (for loads of examples see <a href="https://www.virustotal.com/gui/ip-address/188.114.96.0/relations" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://www.virustotal.com/gui/ip-address/188.114.96.0/relations</a>; tap ••• a couple of times).Supporting DN's like "ing–movil.com" and "m–santander.de" *is* facilitating cybercrime, by repeatedly mis-issuing certs for them (see <a href="https://crt.sh/?q=ing-movil.com" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://crt.sh/?q=ing-movil.com</a> and <a href="https://crt.sh/?q=m-santander.de" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://crt.sh/?q=m-santander.de</a>) and by letting them hide behind a CDN (see <a href="https://www.virustotal.com/gui/domain/ing-movil.com/details" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://www.virustotal.com/gui/domain/ing-movil.com/details</a> and <a href="https://www.virustotal.com/gui/domain/m-santander.de/details" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://www.virustotal.com/gui/domain/m-santander.de/details</a>).In addition, *thousands* of DV-certs have been mis-issued - without *their* issuers getting distrusted by Google, Microsoft, Apple and Mozilla.People have their bank accounts drained and companies get slammed with ransomware because of this.But no Big Tech company (including the likes of Cloudflare) takes ANY responsibility; they make Big Money by facilitating cybercrime. Not by issuing "free" DV-certs, but by selling domain names, server space and CDN functionality, and by letting browsers no longer distinguish between useful and useless certs. They've deliberately made the internet insecure *FOR PROFIT*.🌘CERT MIS-ISSUANCE ROOT CAUSE🌒 The mis-issuance of LE certs was caused by the unauthorized modification of customer DNS records managed by SquareSpace; this incident was further described in <a href="https://www.bleepingcomputer.com/news/security/defi-exchange-dydx-v3-website-hacked-in-dns-hijack-attack/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://www.bleepingcomputer.com/news/security/defi-exchange-dydx-v3-website-hacked-in-dns-hijack-attack/</a>.Note that a similar attack, also affecting SquareSpace customers, occurred on July 11, 2024 (see <a href="https://www.bleepingcomputer.com/news/security/dns-hijacks-target-crypto-platforms-registered-with-squarespace/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://www.bleepingcomputer.com/news/security/dns-hijacks-target-crypto-platforms-registered-with-squarespace/</a>). Even if it *looks like* that no certs were mis-issued during the July 11 incident, because (AFAIK) none of them have been revoked, this does not warrant that none of them were mis-issued; such certs can still be abused by attackers, albeit on a smaller scale.🌘MORE INFO🌒 Please find additional information in two followups of this toot:🧵#2/3 Extensive details regarding Mis-issued dydx.exchange certs on 2024-07-23;🧵#3/3 Links to descriptions of multiple other DV-cert mis-issuance issues.🌘DISCLAIMER🌒 I am not (and have never been) associated with any certificate supplier. My goal is to obtain a safer internet, in particular for users who are not forensic experts. It is *way* too hard for ordinary internet users to destinguish between 'fake' and 'authentic' on the internet. Something that, IMO, can an must significantly improve ASAP.Edited 08:16 UTC to add people: <a href="https://infosec.exchange/@troyhunt" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@troyhunt</a> <a href="https://infosec.exchange/@dangoodin" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@dangoodin</a> <a href="https://infosec.exchange/@BleepingComputer" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@BleepingComputer</a> <a href="https://infosec.exchange/@agl" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@agl</a> <a href="https://infosec.exchange/tags/DV" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#DV</a> <a href="https://infosec.exchange/tags/LE" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#LE</a> <a href="https://infosec.exchange/tags/LetsEncrypt" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#LetsEncrypt</a> <a href="https://infosec.exchange/tags/Certificates" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Certificates</a> <a href="https://infosec.exchange/tags/Certs" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Certs</a> <a href="https://infosec.exchange/tags/Misissuance" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Misissuance</a> <a href="https://infosec.exchange/tags/Mis_issuance" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Mis_issuance</a> <a href="https://infosec.exchange/tags/Revocation" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Revocation</a> <a href="https://infosec.exchange/tags/Revoked" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Revoked</a> <a href="https://infosec.exchange/tags/Weaknessess" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Weaknessess</a> <a href="https://infosec.exchange/tags/WeakCertificates" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#WeakCertificates</a> <a href="https://infosec.exchange/tags/WeakAuthentication" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#WeakAuthentication</a> <a href="https://infosec.exchange/tags/Authentication" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Authentication</a> <a href="https://infosec.exchange/tags/Impersonation" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Impersonation</a> <a href="https://infosec.exchange/tags/Identification" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Identification</a> <a href="https://infosec.exchange/tags/Infosec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Infosec</a> <a href="https://infosec.exchange/tags/DNS" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#DNS</a> <a href="https://infosec.exchange/tags/DNSHijacks" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#DNSHijacks</a> <a href="https://infosec.exchange/tags/SquareSpace" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#SquareSpace</a> <a href="https://infosec.exchange/tags/Authorization" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Authorization</a> <a href="https://infosec.exchange/tags/UnauthorizedChanges" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#UnauthorizedChanges</a> <a href="https://infosec.exchange/tags/UnauthorizedModifications" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#UnauthorizedModifications</a> <a href="https://infosec.exchange/tags/DeFi" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#DeFi</a> <a href="https://infosec.exchange/tags/dydx_exchange" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#dydx_exchange</a> <a href="https://infosec.exchange/tags/CryptoCoins" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#CryptoCoins</a>

ProPublicaA Former NFL Player Persuaded Politicians That His Child ID Kits Help Find Missing Kids. There’s No Evidence They Do. ==At least 11 states have agreed to distribute fingerprinting kits sold by Kenny Hansmire’s National Child Identification Program. Some are spending millions even though similar kits are available for free.<a href="https://newsie.social/tags/Children" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Children</a> <a href="https://newsie.social/tags/Kids" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Kids</a> <a href="https://newsie.social/tags/Missing" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Missing</a> <a href="https://newsie.social/tags/Fingerprinting" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Fingerprinting</a> <a href="https://newsie.social/tags/Identification" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Identification</a> <a href="https://newsie.social/tags/NFL" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#NFL</a> <a href="https://www.propublica.org/article/kenny-hansmire-persuades-politicians-to-fund-child-id-kits?utm_medium=social&utm_source=mastodon&utm_campaign=mastodon-post" rel="nofollow noopener noreferrer" target="_blank">https://www.propublica.org/article/kenny-hansmire-persuades-politicians-to-fund-child-id-kits?utm_medium=social&utm_source=mastodon&utm_campaign=mastodon-post</a>

Raye :tattoo_butt:"Starting this year, the Washington Department of Licensing will offer a one-time original or renewed state ID card at no cost for those who are homeless and expected to live in Washington.....Those who are homeless and seeking a free ID card can arrive at a driver’s licensing office with or without an appointment. If the person had a Washington driver’s license or ID in the past, employees can locate their record in the DOL system. No other documentation is needed.People seeking identification will need a current mailing address, which could be a shelter, community organization or a church. Or they can request to pick up the ID directly from the licensing office.If the person has never had a Washington ID, they will need a document showing proof of identity. If they don’t have one, DOL recommends they visit a licensing office to speak with a supervisor."<a href="https://weirder.earth/tags/WashingtonState" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#WashingtonState</a> <a href="https://weirder.earth/tags/Identification" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Identification</a> <a href="https://www.seattletimes.com/seattle-news/homeless/free-id-cards-now-available-for-homeless-people-in-wa/" rel="nofollow noopener noreferrer" target="_blank">https://www.seattletimes.com/seattle-news/homeless/free-id-cards-now-available-for-homeless-people-in-wa/</a>

Kingsley Uyi Idehen<a href="https://mstdn.social/@feditips" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@feditips</a>,Woot! I just attached a video that demonstrates the effects of loosely-coupling <a href="https://mastodon.social/tags/identity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#identity</a>, <a href="https://mastodon.social/tags/identification" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#identification</a>, <a href="https://mastodon.social/tags/authentication" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#authentication</a>, <a href="https://mastodon.social/tags/authorization" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#authorization</a>, and <a href="https://mastodon.social/tags/storage" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#storage</a> to test what's possible./cc <a href="https://mastodon.social/@Mastodon" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@Mastodon</a>

Recent searches

Search options

Administered by:

Server stats:

#identification