I've thought about this in terms of people passing away and the domain no longer being renewed afterwards.
10 years limit on domain registrations seems ridiculous, we need lifetime-span registration capabilities, at least.
Finding vulnerable Twitter accounts with expired domains
91–100 of 128 posts
Re: Finding vulnerable Twitter accounts with expired domains
#92Earlier quoted context omitted.
>If you rely on bio-authentication methods, you risk your privacy especially when the master database gets compromised. It's my understanding that these methods (TouchID, FaceID) don't actually store your thumb prints or images of your face rather they store hashes of the output. Similar to how passwords should never be stored in plain text.
Its more than a hash since it needs to be able to match similar inputs (face at different angle, partially obscured), its probably just a bunch of raw measurements but not actually a photo of your face. The upside is its only stored on the device itself and not in a master database and also isn't used for any remote authentication so can't be exploited by hackers over the internet.
Theory: it can be a hash of measurements of the face, rounded to a certain precision.
Re: Finding vulnerable Twitter accounts with expired domains
#93Earlier quoted context omitted.
The problem is that every new source of identity added is another new attack vector. If there are 10 different ways for me to prove I am who I say I am, it only takes a security flaw in one for my account to be compromised.
If you set login to require 3/10 then 3 of those ways would need a security flaw before your account is compromised.
and then you'd need 3 factors just to log in, let alone any additional MFA those have
Re: Finding vulnerable Twitter accounts with expired domains
#94This has been standing practice for a while and is not connected to just Twitter. Sometimes you can find public NDR's online via bug reports and such and easily grab a service account.
Re: Finding vulnerable Twitter accounts with expired domains
#95Earlier quoted context omitted.
Its more than a hash since it needs to be able to match similar inputs (face at different angle, partially obscured), its probably just a bunch of raw measurements but not actually a photo of your face. The upside is its only stored on the device itself and not in a master database and also isn't used for any remote authentication so can't be exploited by hackers over the internet.
Theory: it can be a hash of measurements of the face, rounded to a certain precision.
Rounding drastically reduces the search space of possible values. A cryptographic hash is no good if you know that the original message can only take on a finite set of values that can easily be enumerated.
Re: Finding vulnerable Twitter accounts with expired domains
#96At some point in time we decided that email addresses control the keys to the kingdom. If you lose access to your email, there goes your social media accounts, your bank accounts, your gaming accounts, and potentially many of your commercial accounts as well. And then we decided that custom domains are the most professional. Which does make sense, there can only be one 'robert@gmail.com'. But, this is coupled with th…
There are other aspects here. If you use a third party service for your email ID, the third party can ban you or like you mention - disappear and basically take your identity away. If you rely on national ID cards, you have another set of problems. If you rely on phone numbers, these can be sim-jacked. If you rely on bio-authentication methods, you risk your privacy especially when the master database gets compromise…
For me, email has much more credibility than phone numbers.
The email market has worldwide competition, phone providers compete at a local level only. You can choose from thousands of different email providers, while phone provider choices for any given person are ~5.
The effective 'god' of domain names is IANA, which, while imperfect is more trustworthy than the 'gods' of phone numbers: local governments and telcos.
Re: Finding vulnerable Twitter accounts with expired domains
#97Heh. I did something like that: https://xach.livejournal.com/227751.html
Re: Finding vulnerable Twitter accounts with expired domains
#98This domain hijacking idea reminds me of an incident with Google I discovered a couple of years ago that landed me a bug bounty with them. I found out they created email logins with a not-registered domain for their candidacy account. I ended up registering that domain and "sold" it back to them in good faith. At least I can die with a smile on my face -- I once sold Google a domain. details: http://www.tnhh.net/post…
Did you get the job you were looking for?
Re: Finding vulnerable Twitter accounts with expired domains
#99Earlier quoted context omitted.
And when I lose that chip, or it is damaged or stolen?
I guess the approaches taken with U2F tokens here (and FIDO2) makes sense - have more than one token enrolled, and allow either to be used. It's not perfect and there are usability issues around this, but they're mostly solvable. Needing both keys around to enrol into each service can be an issue, but this could be addressed by letting a user enrol other public keys as a delegate, and present a signed delegation toke…
Yeah, I just can't see getting my 75 year old dad to be able to use a system like that.
Re: Finding vulnerable Twitter accounts with expired domains
#100Earlier quoted context omitted.
I want a private key embedded in a chip, that never leaves that chip, so all encryption and decryption happens on that chip—similar to how chip-and-pin credit cards work now. I'm identified by the corresponding public key. Then I want to embed that chip in my hand. Then I can unlock my car, house, computer, or phone and sign into any online service the same way: you send me a challenge token, I sign it with my privat…
And when I lose that chip, or it is damaged or stolen?
Well, lost or stolen hopefully wouldn't happen if it's embedded in my hand—that's the point of embedding it in my hand!
To protect against damage—which is a very real possibility, of course—I'd put identical chips in each hand, and if one fails or gets damaged, then you'd have to rotate keys by replacing both chips.
And you could have a third identical chip/key (or a different private key on another device in a safe somewhere) as a further backup, as my sibling comment recommends.