Tag:reddit

I wasn’t clear what I meant by “who” – the owner of the domain. EV still doesn't give you that Not in anything that resembles a useful metric: In fact, Mozilla went even further and referenced the great work that Ian Carroll did when he registered a colliding entity name and got an EV cert …
Continue reading New comment on reddit

There are ways to know who you’re talking to (extended validation certificates for HTTPS, for example) Sorry, but EV does NOTHING to "know who you're talking to" October 07, 2019 at 09:39PM via reddit https://www.reddit.com/r/security/comments/denirw/can_you_trust_a_remote_binary/f2yulg6?utm_source=ifttt

Logs were our lifeblood. Now they’re our liability. https://vicki.substack.com/p/logs-were-our-lifeblood-now-theyre Submitted October 04, 2019 at 12:30PM via reddit https://www.reddit.com/r/Splunk/comments/dd9qcx/logs_were_our_lifeblood_now_theyre_our_liability/?utm_source=ifttt

CWE – 2019 CWE Top 25 Most Dangerous Software Errors https://cwe.mitre.org/top25/archive/2019/2019_cwe_top25.html Submitted September 27, 2019 at 03:11PM via reddit https://www.reddit.com/r/security/comments/da51jt/cwe_2019_cwe_top_25_most_dangerous_software_errors/?utm_source=ifttt

[1] | CWE-119 | Improper Restriction of Operations within the Bounds of a Memory Buffer | 75.56 September 27, 2019 at 03:12PM via reddit https://www.reddit.com/r/security/comments/da51jt/cwe_2019_cwe_top_25_most_dangerous_software_errors/f1n8oz9?utm_source=ifttt

As others suggest, it's most likely whatever password they setup the router with in the first place – which means you never changed it to prevent this from happening It's possible it wasn't customer-alterable, but your ISP "knowing" your wifi password is nothing at all like "My ISP is storing wifi passwords in plain text". …
Continue reading New comment on reddit

Never heard of John the Ripper til I saw this post, but have you tried their wiki: https://openwall.info/wiki/john? September 27, 2019 at 09:13AM via reddit https://www.reddit.com/r/security/comments/d9uinx/how_does_wordlist_hacking_work/f1mbl2n?utm_source=ifttt

I haven't even tried dualbooting in close to 15 years 🙂 Also haven't personally known anyone to do it in over 10 September 26, 2019 at 05:03PM via reddit https://www.reddit.com/r/security/comments/d9bb3q/protecting_multiboot_oss_from_each_other/f1k50kh?utm_source=ifttt

5G and IoT: How to Approach the Security Implications https://threatpost.com/5g-and-iot-how-to-approach-the-security-implications/148681/ Submitted September 26, 2019 at 02:59PM via reddit https://www.reddit.com/r/security/comments/d9o4yn/5g_and_iot_how_to_approach_the_security/?utm_source=ifttt

I'm using my own VPN & proxies – still happens As it does on ones not my own 🙂 September 26, 2019 at 12:32PM via reddit https://www.reddit.com/r/security/comments/d9ccib/introducing_warp_by_cloudflare/f1ivv7q?utm_source=ifttt

Any hacker would have unlimited attempts with a botnet or whatever. No, they don't have "unlimited attempts with a botnet or whatever" When an account is LOCKED OUT after 2 or 3 fails, it doesn't matter how many devices are trying to login – it's STILL going to be LOCKED OUT September 26, 2019 at …
Continue reading New comment on reddit

I'm surprised to hear that they block VPN and proxy traffic. Yeah, I was, too – especially when hearing them praised by folks like Troy Hunt September 26, 2019 at 10:52AM via reddit https://www.reddit.com/r/security/comments/d9ccib/introducing_warp_by_cloudflare/f1ienjt?utm_source=ifttt

To be safe, I changed my Amazon password AND my email from an AOL email to my Gmail since Gmail is more secure and I don't use AOL anymore Is Gmail really "more secure" than AOL? If you don't use an address anymore, by all means switch away from it … but saying Gmail is …
Continue reading New comment on reddit

Was "Asshole!1" used in the class as an example? If so, I totally agree with $BOSS telling you that's inappropriate. If it was the password you used for yourself when taking the class (eg as some kind of checkword that you could verify you took it) – storing it in the clear and then having …
Continue reading New comment on reddit

What is an FPOE? September 26, 2019 at 09:22AM via reddit https://www.reddit.com/r/security/comments/d96t5z/nice_one_blizzard_guess_my_password_was_too/f1i0vgp?utm_source=ifttt

As a counterpoint, Troy Hunt recently posted this: https://www.troyhunt.com/banks-arbitrary-password-restrictions-and-why-they-dont-matter/ An interesting quote from the post: Password Limits on Banks Don't Matter That very first tweet touched on the first reason why it doesn't matter: banks aggressively lock out accounts being brute forced. They have to because there's money at stake and once you have a …
Continue reading New comment on reddit

Here's the baseline SSL conf I use with Apache: https://antipaucity.com/2017/07/07/ssl-configuration-for-apache-2-4-on-centos-7-with-lets-encrypt/#.XYy9zyUpChY Here're a bunch of security tips for Apache: https://geekflare.com/10-best-practices-to-secure-and-harden-your-apache-web-server https://www.petefreitag.com/item/505.cfm https://www.techrepublic.com/article/how-to-secure-your-apache-2-server-in-four-steps https://help.dreamhost.com/hc/en-us/articles/226327268-The-most-important-steps-to-take-to-make-an-Apache-server-more-secure https://www.cisecurity.org/benchmark/apache_http_server https://www.tecmint.com/apache-security-tips And for IIS: https://calcomsoftware.com/hardening-iis-server-guide https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/dd450371(v=ws.10)?redirectedfrom=MSDN https://docs.microsoft.com/en-us/previous-versions/tn-archive/dd163531(v=technet.10)?redirectedfrom=MSDN https://techcommunity.microsoft.com/t5/Exchange-Team-Blog/Exchange-TLS-038-SSL-Best-Practices/ba-p/603798 https://www.cisecurity.org/benchmark/microsoft_iis https://www.upguard.com/articles/10-steps-for-improving-iis-security https://www.davidfroud.com/pci-going-beyond-the-standard-part-8-configuration-standards https://support.microsoft.com/en-us/help/324069/how-to-set-up-an-https-service-in-iis And, of course, there are guides from places like DISA: Apache 2.4: https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_Apache_Server_2-4_UNIX_STIG.zip IIS 8.5: https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_MS_IIS_8-5_Server_V1R8_STIG.zip September 26, 2019 at …
Continue reading New comment on reddit

Headline could equally read, "Mostly no one actually uses DNSSEC" … and be about as helpful September 26, 2019 at 08:57AM via reddit https://www.reddit.com/r/security/comments/d9gtn4/study_indicates_most_large_banking_institutions/f1hxnzl?utm_source=ifttt

Not sure as to why u/moasredbrook wouldn't, but the two biggies for me are: intentionally blocking traffic to their customers' sites just because you're on a VPN or proxy they do nothing to even try to prevent fraudlent account creation and DNS hijacking September 26, 2019 at 08:58AM via reddit https://www.reddit.com/r/security/comments/d9ccib/introducing_warp_by_cloudflare/f1hxw7e?utm_source=ifttt

People still multiboot? I thought that had pretty much gone away 10+ years ago TIL ??‍♂️ ? The "correct" answer is one of the following: fully separate boot devices (eg run each OS off its own encrypted USB drive) use VMs (running, of course, in a parent OS (whether full or hosted hypervisor) that's also …
Continue reading New comment on reddit

Better yet: Created forensic system device evidence images for potential malicious activity investigations September 26, 2019 at 09:16AM via reddit https://www.reddit.com/r/security/comments/d97x6y/need_help_creating_a_resume_bullet_point/f1i053a?utm_source=ifttt

Hannah Montana Linux? Was its alter ego Miley Stewart Linux? September 25, 2019 at 08:45AM via reddit https://www.reddit.com/r/security/comments/d8vd7b/we_used_to_get_an_alert_when_the_connection_was/f1e8189?utm_source=ifttt

Its latest exploit offers a free copy of the Snowden book as a Word document via email. The fact anyone falls for this nonsense nowadays is disturbing September 25, 2019 at 08:47AM via reddit https://www.reddit.com/r/security/comments/d90e1h/the_new_edward_snowden_book_is_being_used_to/f1e8897?utm_source=ifttt

Automatic License Plate Readers Are The Latest Neighborhood Perk https://www.techdirt.com/articles/20190915/11434242991/automatic-license-plate-readers-are-latest-neighborhood-perk.shtml Submitted September 24, 2019 at 11:09AM via reddit https://www.reddit.com/r/privacy/comments/d8oimk/automatic_license_plate_readers_are_the_latest/?utm_source=ifttt

Supply chain actors agree that everyone’s a security risk – except themselves, of course https://www.theregister.co.uk/2019/09/20/supply_chain_actors_agree_that_everyone_is_a_security_risk_except_themselves/ Submitted September 24, 2019 at 11:10AM via reddit https://www.reddit.com/r/security/comments/d8oj7t/supply_chain_actors_agree_that_everyones_a/?utm_source=ifttt