Recent searches

No recent searches

Search options

Only available when logged in.
techhub.social is one of the many independent Mastodon servers you can use to participate in the fediverse.
A hub primarily for passionate technologists, but everyone is welcome

Administered by:

Server stats:

4.7K
active users

techhub.social: AboutStatusProfiles directoryPrivacy policy

Mastodon: AboutGet the appKeyboard shortcutsView source codev4.4.1

#privatekey

0 posts0 participants0 posts today
Erik van Straten

Public key cryptografie voor leken

Het is een beetje behelpen met "ASCII graphics", maar in security.nl/posting/884482/Pub probeer ik, ook aan minder digitaal vaardigen, uit te leggen hoe asymmetrische cryptografie werkt.

Doe er uw voordeel mee, want deze techniek is een belangrijk fundament van de steeds verder digtaliserende maatschappij.

U leert hoe een digitale handtekening werkt en wat een digitaal certificaat is.

Veel te weinig mensen begrijpen dat goed, en dat bemoeilijkt een fatsoenlijke discussie over deze technieken enorm.

Big tech is de lachende derde: zij maximaliseren hun winsten terwijl alle risico's voor uw rekening komen.

#BigTechIsEvil#GoogleIsEvil#DVcerts
Replied in thread
Kevin Karhan :verified:

@hon1nbo @foone yeah, but all these things would essentially necessitate a fundamentally incompatible #Fork of the #USB standard, creating #costs, #fragmentation and lessen the likelyhood of success.

  • Not to mention it'll require significant investments in #UserAwareness, #Training and would still have some issues...

I gues a sort-of "Secure HID Port" that mandates proper authentification and does full #E2EE from the Keyboard Matrix / Pointing Device controller up is an option, but you'd have to expect state-sponsored attackers willing to do "Kamikaze" Hacks...

#TLDW: It requires custom silicon and a hard root of trust…

infosec.space/@kkarhan/1137164

YouTubeHow a Mini drill tool defeated security on the Xbox 360 | MVGBy Modern Vintage Gamer
Replied in thread
Kevin Karhan :verified:

@puppygirlhornypost2 @navi And whilst it's easy to blame #GoldenKeyBoot, a leaked #PrivateKey that was impossible to be removed, the problem is that #Windows is architecturally "insecure-able" because any changes necessary to make this not a problem would inherently mean the end for Windows as it's known to most.

  • In fact, everything is done better by #Linux on the #Desktop for almost two decades, which is why classic #Malware isn't a thing on Linux systems.

Shure, you get some #Cryptojacking and some #CMS|es like #WordPress that are constantly being attacked but generally, the way #updates and #distribution of #Software works on Linux Distros for the most part is completely antithetical to Windows.

And anything #Microsoft could do at this point if they weren't horny for money but avtually cared is to scrap Windows and instead invest into #Wine to ease the transition...

Daniel Böhmer

Why is everyone using #base64 to encode their private SSH keys to store them in masked variables in #GitLab CI?! 🤔

⚠️ GitLab cannot effectively mask your private key in CI logs if you only give it a base64-encoded version of it!

Instead I found a solution that stores the *original* private key format from #OpenSSH in a one-line CI variable and recreates the begin/end markers for a valid OpenSSH identity file with commands inside the CI.

stackoverflow.com/a/79124959/4

Stack OverflowGitlab masking variablesI can't seem to mask a variable on Gitlab CI - I'm trying to upload a ssh private key and no matter what I do it refuses to mask it. That is I'm trying to store a private key on Gitlab for use ...
#ITsecurity#CICD#privatekey
*
parvXtl

#SecureBoot is completely broken on 200+ models from 5 big device makers: Keys were labeled "DO NOT TRUST." Nearly 500 device models use them anyway, 20240725,
by Dan G,
arstechnica.com/security/2024/

public perpetuation of test platform key #privateKey marked #DoNotShip #DoNotTrust, of #AMI corp, via centralized source code repository host
#Binarly corp
#temporaryIsPermanent

Ars Technica · Secure Boot is completely broken on 200+ models from 5 big device makersBy Dan Goodin
*
Erik van Straten

EvS infosec Myth#0: Authentication

MYTH:

1) Authentication: prove that you are you.

Factors: 1 or more (MFA, 2=2FA) of:
2.a) Something you know;
2.b) Something you have;
2.c) Something you are.

MAY BE MISUNDERSTOOD AS:

1) supplying full name + birth date.

2.a) 1 + 1 = 10 (in binary notation);
2.b) Kitchen;
2.c) Nerd.

TYPICAL WEAK USE CASE:

1) Supplying your SSN to verify your identity: this is IDENTIFICATION, not authentication aka VERIFICATION of identity: typical serving side stupidity, extremely misunderstood, causing lots of misery (identity fraud).

———— OR ————
2.a) Password: 12345
2.b) Phone number + OTP via SMS.

———— OR ————
2.a) Password: qwerty
2.b) TOTP-app with secrets not being backed up, or using insecure / privacy unfriendly cloud backups [5].

AUTHENTICATION SHOULD HAVE BEEN COMMUNICATED AS, FROM THE START:

1) Authentication: PREVENT IMPERSONATION [1], [2], [3], [4].

2) "MFA HAD FAILED" [5] (Microsoft, already in 2019). Reason: an ESSENTIAL REQUIREMENT of EACH FACTOR is that it cannot be easily obtained by an attacker (e.g. intercepted, copied, guessed, stolen etc.).

2.a) A strong (not predictable, not guessable, not brute forceable and not deducible via OSINT) secret that only YOU and MAX. 1 OTHER PARTY know, transported only via reliable, CLEARLY IDENTIFIED server-authenticated, E2EE connections. With more than a few accounts, normal humans will be unable to remember strong passwords (preferable solution in [5]);

2.b) Physical device with an "HSM" in your possession with strong anti-attacker-access measures in place;

2.c) "Neural hash" of biometrics (usually weak because your biometrics are not a secret), stored in (and never leaving) a strongly protected "HSM" (see 2.b), transported from the scanner to the "HSM" in a secure manner.

Plus, less often mentioned:

2.d) "Passport" / digital certificate issued by TTP: typically strong if the provisioning infrastructure (such as PKI) is highly trustworthy. Theft of passports and unwanted copying of private keys must me made as hard as possible. A scan or photocopy of a passport MUST be considered worthless w.r.t. authentication (as knowledge of PII such as an SSN);

2.e) Location: weak (easily spoofable).

CONCLUSION
A safer internet mandates that we stop oversimplifying complicated matters.

EXAMPLES / MORE INFO:

[1] english.defensie.nl/topics/tra
Note: this page contains a lie, at least in NL: "Making a photocopy of your identity document is prohibited by law". The Dutch government even provides a free app that may obfuscate "sensitive" parts of ID documents in order to create "secure" copies (idiots):
government.nl/topics/identity-

[2] In Dutch: security.nl/posting/792391/Aut

[3] infosec.exchange/@ErikvanStrat

[4] *NOT* Trump: twitter.com/realDonaldTrump/st

[5] infosec.exchange/@ErikvanStrat

english.defensie.nlIdentity fraud and document expertiseIn the case of identity fraud, criminals abuse false or stolen personal details. The Royal Netherlands Marechaussee makes an important contribution to combating and preventing identity and document fraud. Please always report to the police if you have become a victim of identity fraud.
#authentication#impersonation#identity
TrendingLive feeds
About