Viewing profile — ivlad

If someone eats junk food at McDonald’s it does not mean I should eat junk food at Burger King. If someone does not encrypt their radio comms, it does not mean I should be satisfie…

Absolutely

The whole post is a PR activity presented as some kind of analysis. It is bs. First, long-living credentials are the standard because the machinery to rotate them is complicated an…

Lack of the authentication means an adversary can feed any data to the receiver. Local data access is a win, I agree

09 F9 !!

44 bits of security is not “pretty good”. The post author used Python, but anything more performant would result almost real-time decryption. There are no performance implications …

Technically, no. SPF allows to say “these IPs are authorised to send emails as example.com”, where DMARC allows to say “I as domain owner recommend to quarantine emails that fail S…

Three so-called “cribs” are typically mentioned in literature: 1. Weather reports that were encrypted with Enigma for the High Command and then sent again encrypted with a much wea…

Mandatory watch: https://www.youtube.com/watch?v=pyMNIFZTQkg

I have deployed FIDO authenticators at a ~2000 employees organization as the second factor. It was great for a while - when early versions of macOS and iOS respected the “platform”…

Neither Apple nor Google do key attestation for their cloud-synced keys. This > Which is happening with all the big platforms right now. Does not seem to be happening. Am I missing…

If you are going to store passkeys in a password manager, the whole situation is no more secure than just using passwords. Consider: 1. Password managers tie passwords to sites, so…

I was talking about the non-resident FIDO keys. “Passkey” term is meaningless unfortunately because FIDO Alliance did not define it initially, it was a marketing term invented by A…

> The important part is it's up to the service to decide on whether they want to require hardware resident keys (which cannot be synced via the cloud). From what I know, Apple igno…

> Not true. The original concept was always for them to be cloud synced. It was not. The original U2F spec was created before that idea was around and it talked about hardware secu…

I think in Apple stack they cannot be made hardware bound anymore. Platform claim is ignored on creation and the keypair is always in Keychain and syncable unless iCloud sync is di…

You don’t. You don’t store anything at all. On registration, a keypair is generated, then the private key is encrypted with the long-term key burned into your security key fob or h…

Or, you use `xargs -0` for null termination instead of white space termination. `find` conveniently supports `-print0` that will use null character as separator.

Was exactly my thought: why not to use null termination? Looks like a case where reading man page would have spared writing another copycat utility.

TP-Link is absolute crap of network hardware. Not to mention “leftover debug code”: https://nvd.nist.gov/vuln/detail/CVE-2024-21827

Genuine question, if you use bastion hosts, why do you need Tailscale? Why not to expose tcp/22 to the internet and allow public key authentication only (or, certificate based one,…

Rolex and Casio deal with simply when IERS introduces one. Beats is a new time measurement system, not just a new clock. So if the world (IERS) would stops it, they would have to h…

Enterprise PKI is not hard and has many uses besides issuing certificates to web servers. Any company of 1000+ users or endpoints should just set one up. I did it multiple times, m…

Or, just use IPv6 and host Internet services in a routable address. Then, use ACLs at web server / proxy / L7 lb level to allow acme-challenge unauthenticated but everything else a…

It looks like a poorly thought-out marketing project. For example, how to deal with the Earth rotation irregularity and leap seconds? One beat is way too long to correct with, so t…