Viewing profile — cjcampbell

I’ve also run into various capacity issues in each US region I have worked in. East US 2 has been least constrained for me, but I recall that I was still bouncing around between VM…

I do the same.

Definitely interested to kick the tires and compare to some of the other solutions out there. As others mentioned, you lose some benefits of an OIDC-integrated SSH CA, but that’s a…

I’ve played a bit with this, but iirc, I ran into limitations with some of the clients that needed to be supported. But if all you need is OpenSSH, you should be set.

One devious thing about this attack is that the phishing site doesn’t even need to impersonate the site it’s attacking. I have password based logins on hundreds of sites and it’s p…

You don’t necessarily have to disable anything, but choose not to use the secondary device authentication flow. Let’s say that you rely on the passkey implementation in your passwo…

Maybe “phishing passkey protected sessions …” or “phishing passkey protected accounts”. I also echo some of the other critiques, which are that passkeys are advertised as phishing …

Don’t know where I first discovered it, but I have been using ipkitten for years when working with non-tech friends, family, and clients. It seems to help with the intimidation fil…

The posture implementation is quite easy to work with. There’s a growing list of integrations, and you can also roll your own with the posture API. I’ve used Kolide so far and will…

I have significantly more experience in AWS, but I've spent equal time building and securing infrastructure in Azure for at least two years now. While AWS is not without it's rough…

The flag button sits right in the zone I swipe with my right thumb on mobile. Occasionally I notice and go unflag something. Clicking through this, I found several pages of posts I…

I’m surprised that the author chose to configure a public OIDC client for this scenario. Part of the benefit of this pattern is that it’s possible to use a confidential client, sin…

They all support OIDC, though in my experience, it’s moderately more clunky to deploy unless a “blessed” integration exists in the app store/directory. Okta provides the best exper…

I love to see OIDC gaining traction, though I will say that for setting up any sort of custom workforce federation, the administrative experience for OIDC applications often feels …

Apple deprecated kernel extensions with 10.15 in order to improve reliability and eventually added a requirement that end users must disable SIP in order to install kexts. Security…

I work with a variety of small companies (5-25 FTEs) that are increasingly facing strict MFA requirements in order to maintain insurance. SSO isn’t an explicit requirement, but the…

Windows 10 had the same behavior. MacOS has also done this by default for years now. I don’t say this to excuse the behavior. On the contrary, I’ve seen many a small business owner…

Was that point meant to be reversed … favors the irrelevant over the unknown?

I probably could have framed this more clearly. I don’t think my point really supports the lock-in argument. Google has been a big proponent of FIDO, having been an early adopter o…

I'm surprised that they're moving forward with this already. As of last week, there were still enough rough edges on their implementation that I disabled it for my Workspace tenant…

True if they are referring to the MagSafe cable. If referring to USB C to C, they’re mistaken. The charging cable for all MacBooks does support USB 2 data rates.

In my experience, a large percentage of compliance officers believe that this is a non-negotiable requirement for HIPAA compliant web apps. My reading of the Security Rule is much …

Depends on the password manager. 1Password will not autofill if the domain doesn’t match. It’s up to the user at that point to check the url before copy/pasting the code. My guess …

The focus of the presentation is on using the forwarder to poison the recursive cache, but my take from a quick skim of the presentation is that plenty of damage could still be don…