Earlier quoted context omitted.
The argument is that IPv6 addresses are UUIDs and any random block is unlikely to collide with any other random address. It's not about low adoption, it's that there are unimaginably many IPv6 addresses. ...which is a major reason for why it has low adoption
Thanks for the reply. I'm reminded every now and then of the magnitude of the address space in v6. Then I do nothing with that information and slowly lose appreciation for the size again :)
My security camera shipped a GitHub admin token in its login page
91–100 of 265 posts
Re: My security camera shipped a GitHub admin token in its login page
#92The US Department of War IP adresses baked into the firmware is the bigger story here. Note to self: never buy a Korean security product.
I do know of at least one company who has black-holed the entire DoD ip space and are using it for internal space, which is why I gave a speculation warning... it's really strange regardless.
Yeah I wanted to do that at previous company. Got talked out of it, but it's nice have all those ips available.
Re: My security camera shipped a GitHub admin token in its login page
#93This blog's misuse of the external link icon irks me.
will fix it tomorrow
Re: My security camera shipped a GitHub admin token in its login page
#94I know you're a mastermind when it comes to security, but you should provide more context about the tools and methods you're using in your article so we can better understand what it's all about and not have to Google every single step you're taking.
Oh I thought exactly the opposite!
I feel like every security blog (or even just tech blog) I've read recently has had paragraphs and paragraphs of largely LLM generated explainer waffle. This felt refreshingly focused and to the point.
Re: My security camera shipped a GitHub admin token in its login page
#95Earlier quoted context omitted.
There's a lot of public keys that don't give you any special access, unless the dev is really bad. Anyone who cares about security will be using App Attest or the Google store equivalent.
>Anyone who cares about security I have something hilarious to tell you about IoT apps
Most of these companies try to penny pinch and give task to hardware engineer. As a result there are lot of security issues with IOT devices.
Re: My security camera shipped a GitHub admin token in its login page
#96I bought some ambient room lighting recently. You cannot control them without a proprietary app. This bugged me ... so I grabbed an APK from the Google store, unpacked it, and found essentially keys to the kingdom: api keys for the backend, api keys for shopify, etc. Haven't done anything with this knowledge yet.
There's a lot of public keys that don't give you any special access, unless the dev is really bad. Anyone who cares about security will be using App Attest or the Google store equivalent.
> Anyone who cares about security will be using App Attest or the Google store equivalent.
Why? I rarely have security objectives where remote attention would help, and it has a huge impact on user freedom. For B2C attestation is just an evil captcha.
Re: My security camera shipped a GitHub admin token in its login page
#97I know you're a mastermind when it comes to security, but you should provide more context about the tools and methods you're using in your article so we can better understand what it's all about and not have to Google every single step you're taking.
i’m not a mastermind, and I agree it could be more accessible. I treat this blog as somewhere to just dump my thoughts as unfiltered as I can while still being useful or entertaining, maybe for some other posts I will go more into depth
Re: My security camera shipped a GitHub admin token in its login page
#98Re: My security camera shipped a GitHub admin token in its login page
#99true open source!
Re: My security camera shipped a GitHub admin token in its login page
#100Not surprised, many of these vendors are doing crazy things, insane defaults, broken security, hardcoded values. Security is not a priority, I get that, but at the very least some baseline check would be nice (no hardcoded credentials for starting)
As they say: in IoT the S stands for security.
ID-IoT-S