TechHub

Kevin Karhan :verified:<a href="https://infosec.exchange/@briankrebs" class="u-url mention" rel="nofollow noopener" target="_blank">@briankrebs</a> That explains all the shite I've seen, incl. the <a href="https://infosec.space/tags/CryptoAPI" class="mention hashtag" rel="nofollow noopener" target="_blank">#CryptoAPI</a> <a href="https://infosec.space/tags/backdoor" class="mention hashtag" rel="nofollow noopener" target="_blank">#backdoor</a> in <a href="https://infosec.space/tags/Windows" class="mention hashtag" rel="nofollow noopener" target="_blank">#Windows</a> itself...<a href="https://github.com/kkarhan/windows-ca-backdoor-fix" rel="nofollow noopener" translate="no" target="_blank">https://github.com/kkarhan/windows-ca-backdoor-fix</a>

Kevin Karhan :verified:<a href="https://social.heise.de/@iX_Magazin" class="u-url mention" rel="nofollow noopener" target="_blank">@iX_Magazin</a> <a href="https://infosec.space/tags/Windows" class="mention hashtag" rel="nofollow noopener" target="_blank">#Windows</a> ist inhärent unfixbar unsicher...Siehe <a href="https://infosec.space/tags/CryptoAPI" class="mention hashtag" rel="nofollow noopener" target="_blank">#CryptoAPI</a> - <a href="https://infosec.space/tags/Backdoor" class="mention hashtag" rel="nofollow noopener" target="_blank">#Backdoor</a>!

Kevin Karhan :verified:<a href="https://infosec.exchange/@euroinfosec" class="u-url mention" rel="nofollow noopener" target="_blank">@euroinfosec</a> which doesn't matter when they literally <a href="https://infosec.space/tags/backdoor" class="mention hashtag" rel="nofollow noopener" target="_blank">#backdoor</a> the <a href="https://infosec.space/tags/CryptoAPI" class="mention hashtag" rel="nofollow noopener" target="_blank">#CryptoAPI</a> and integrate <a href="https://infosec.space/tags/Govware" class="mention hashtag" rel="nofollow noopener" target="_blank">#Govware</a> like <a href="https://infosec.space/tags/Recall" class="mention hashtag" rel="nofollow noopener" target="_blank">#Recall</a>! <a href="http://github.com/kkarhan/windows-ca-backdoor-fix" rel="nofollow noopener" translate="no" target="_blank">http://github.com/kkarhan/windows-ca-backdoor-fix</a>

Kevin Karhan :verified:<a href="https://infosec.exchange/@cR0w" class="u-url mention" rel="nofollow noopener" target="_blank">@cR0w</a> too many.<ul><li>Jist like there are way too many applications suceptible to the <a href="https://infosec.space/tags/CryptoAPI" class="mention hashtag" rel="nofollow noopener" target="_blank">#CryptoAPI</a> <a href="https://infosec.space/tags/backdoor" class="mention hashtag" rel="nofollow noopener" target="_blank">#backdoor</a> of <a href="https://infosec.space/tags/Windows" class="mention hashtag" rel="nofollow noopener" target="_blank">#Windows</a>.</li></ul><a href="http://github.com/kkarhan/windows-ca-backdoor-fix" rel="nofollow noopener" translate="no" target="_blank">http://github.com/kkarhan/windows-ca-backdoor-fix</a>So far testing by <a href="https://social.heise.de/@ct_Magazin" class="u-url mention" rel="nofollow noopener" target="_blank">@ct_Magazin</a> / <a href="https://social.heise.de/@heiseonline" class="u-url mention" rel="nofollow noopener" target="_blank">@heiseonline</a> (and myseof later on) revealed only few <a href="https://infosec.space/tags/Apps" class="mention hashtag" rel="nofollow noopener" target="_blank">#Apps</a> not vulnerable to this specifics <a href="https://infosec.space/tags/Govware" class="mention hashtag" rel="nofollow noopener" target="_blank">#Govware</a>:<ul><li><a href="https://infosec.space/tags/Firefox" class="mention hashtag" rel="nofollow noopener" target="_blank">#Firefox</a> (uses <a href="https://mastodon.cc/@Mozilla" class="u-url mention" rel="nofollow noopener" target="_blank">@Mozilla</a> / <a href="https://mastodon.social/@mozilla_support" class="u-url mention" rel="nofollow noopener" target="_blank">@mozilla_support</a> / <a href="https://infosec.space/tags/Mozilla" class="mention hashtag" rel="nofollow noopener" target="_blank">#Mozilla</a> <a href="https://infosec.space/tags/NSS" class="mention hashtag" rel="nofollow noopener" target="_blank">#NSS</a> & has it's own <a href="https://infosec.space/tags/SSL" class="mention hashtag" rel="nofollow noopener" target="_blank">#SSL</a> certificate storage)</li><li><a href="https://mastodon.online/@thunderbird" class="u-url mention" rel="nofollow noopener" target="_blank">@thunderbird</a> (Mozilla NSS)</li><li><a href="https://mastodon.social/@torproject" class="u-url mention" rel="nofollow noopener" target="_blank">@torproject</a> / <a href="https://infosec.space/tags/TorBrowser" class="mention hashtag" rel="nofollow noopener" target="_blank">#TorBrowser</a> (Mozilla NSS; custom certificates)</li><li><a href="https://infosec.space/tags/curl" class="mention hashtag" rel="nofollow noopener" target="_blank">#curl</a> (uses <a href="https://mastodon.social/@bagder" class="u-url mention" rel="nofollow noopener" target="_blank">@bagder</a> <a href="https://infosec.space/tags/WolfSSL" class="mention hashtag" rel="nofollow noopener" target="_blank">#WolfSSL</a> and manages it's own certs)</li></ul>Anything else that uses the CryptoAPI is, espechally *all <a href="https://infosec.space/tags/Chromium" class="mention hashtag" rel="nofollow noopener" target="_blank">#Chromium</a>-Forks (aka. All Browsers except Firefox, Tor Browser, <a href="https://infosec.space/tags/dillo" class="mention hashtag" rel="nofollow noopener" target="_blank">#dillo</a>, <a href="https://infosec.space/tags/LynxBrowser" class="mention hashtag" rel="nofollow noopener" target="_blank">#LynxBrowser</a>…)

Kevin Karhan :verified:USpol, Trump, US-centric Internet Infrastructure, National Internet Blackout

Kevin Karhan :verified:<a href="https://social.linux.pizza/@marjolica" class="u-url mention" rel="nofollow noopener" target="_blank">@marjolica</a> <a href="https://mastodon.social/@utf_7" class="u-url mention" rel="nofollow noopener" target="_blank">@utf_7</a> <a href="https://techhub.social/@dashjackson" class="u-url mention" rel="nofollow noopener" target="_blank">@dashjackson</a> <a href="https://social.glitched.systems/@froge" class="u-url mention" rel="nofollow noopener" target="_blank">@froge</a> <a href="https://mastodon.social/@arstechnica" class="u-url mention" rel="nofollow noopener" target="_blank">@arstechnica</a> It'll impact any application that uses <a href="https://infosec.space/tags/Windows" class="mention hashtag" rel="nofollow noopener" target="_blank">#Windows</a>' <a href="https://infosec.space/tags/CryptoAPI" class="mention hashtag" rel="nofollow noopener" target="_blank">#CryptoAPI</a> and doesn't come with it's own <a href="https://infosec.space/tags/Encryption" class="mention hashtag" rel="nofollow noopener" target="_blank">#Encryption</a> Library and <a href="https://infosec.space/tags/CertificateManagment" class="mention hashtag" rel="nofollow noopener" target="_blank">#CertificateManagment</a>.<ul><li>IDK if the "<a href="https://infosec.space/tags/Linux" class="mention hashtag" rel="nofollow noopener" target="_blank">#Linux</a> Subsystem for <a href="https://infosec.space/tags/Windows" class="mention hashtag" rel="nofollow noopener" target="_blank">#Windows</a>" (The real "<a href="https://infosec.space/tags/WindowsSubsystemForLinux" class="mention hashtag" rel="nofollow noopener" target="_blank">#WindowsSubsystemForLinux</a>" is <a href="https://infosec.space/tags/Wine" class="mention hashtag" rel="nofollow noopener" target="_blank">#Wine</a>!) may or may not be as <a href="https://infosec.space/tags/cursed" class="mention hashtag" rel="nofollow noopener" target="_blank">#cursed</a> as to just wrap said functions into the <a href="https://infosec.space/tags/CryptoAPI" class="mention hashtag" rel="nofollow noopener" target="_blank">#CryptoAPI</a> instead of doing it with the applications' dependencies.</li></ul>Needless to say all <a href="https://infosec.space/tags/Chromium" class="mention hashtag" rel="nofollow noopener" target="_blank">#Chromium</a> variants and <a href="https://infosec.space/tags/IE" class="mention hashtag" rel="nofollow noopener" target="_blank">#IE</a> / <a href="https://infosec.space/tags/Edge" class="mention hashtag" rel="nofollow noopener" target="_blank">#Edge</a> are vulnerable to this <a href="https://infosec.space/tags/Backdoor" class="mention hashtag" rel="nofollow noopener" target="_blank">#Backdoor</a> which exists since at least <a href="https://infosec.space/tags/WindowsXP" class="mention hashtag" rel="nofollow noopener" target="_blank">#WindowsXP</a> to this day!<ul><li>Thus consider said <a href="https://infosec.space/tags/OS" class="mention hashtag" rel="nofollow noopener" target="_blank">#OS</a> inherently unsafe!</li></ul>

Kevin Karhan :verified:<a href="https://cyberplace.social/@GossiTheDog" class="u-url mention" rel="nofollow noopener" target="_blank">@GossiTheDog</a> <a href="https://mastodon.world/@signalapp" class="u-url mention" rel="nofollow noopener" target="_blank">@signalapp</a> it merely prevents <a href="https://infosec.space/tags/Screenshots" class="mention hashtag" rel="nofollow noopener" target="_blank">#Screenshots</a> by claiming it's <a href="https://infosec.space/tags/DRM" class="mention hashtag" rel="nofollow noopener" target="_blank">#DRM</a>'d content.<ul><li>It's a mere ask and <a href="https://infosec.space/tags/Microsoft" class="mention hashtag" rel="nofollow noopener" target="_blank">#Microsoft</a> could specifically close that <a href="https://infosec.space/tags/API" class="mention hashtag" rel="nofollow noopener" target="_blank">#API</a> and make it subject to contractual agreements (as they did with their <a href="https://infosec.space/tags/Antivirus" class="mention hashtag" rel="nofollow noopener" target="_blank">#Antivirus</a> API calls to disable <a href="https://infosec.space/tags/WindowsDefender" class="mention hashtag" rel="nofollow noopener" target="_blank">#WindowsDefender</a>!) if they decide this is against their wishes.</li><li>It also doesn't prevent the <a href="https://infosec.space/tags/Keylogger" class="mention hashtag" rel="nofollow noopener" target="_blank">#Keylogger</a> nor works against the <a href="http://github.com/kkarhan/windows-ca-backdoor-fix" rel="nofollow noopener" target="_blank">known</a> <a href="https://infosec.space/tags/CryptoAPI" class="mention hashtag" rel="nofollow noopener" target="_blank">#CryptoAPI</a> <a href="https://infosec.space/tags/backdoor" class="mention hashtag" rel="nofollow noopener" target="_blank">#backdoor</a> affecting all <a href="https://infosec.space/tags/Browsers" class="mention hashtag" rel="nofollow noopener" target="_blank">#Browsers</a> (except <a href="https://infosec.space/tags/Firefox" class="mention hashtag" rel="nofollow noopener" target="_blank">#Firefox</a> and <a href="https://mastodon.social/@torproject" class="u-url mention" rel="nofollow noopener" target="_blank">@torproject</a> / <a href="https://infosec.space/tags/TorBrowser" class="mention hashtag" rel="nofollow noopener" target="_blank">#TorBrowser</a>) which can be triggered by a single <a href="https://infosec.space/tags/HTTPS" class="mention hashtag" rel="nofollow noopener" target="_blank">#HTTPS</a> request.</li></ul>The correct solution for <a href="https://infosec.space/tags/Signal" class="mention hashtag" rel="nofollow noopener" target="_blank">#Signal</a> would be to alert all their users and specifically block <a href="https://infosec.space/tags/Windows" class="mention hashtag" rel="nofollow noopener" target="_blank">#Windows</a> in general or at least <a href="https://infosec.space/tags/Windows11" class="mention hashtag" rel="nofollow noopener" target="_blank">#Windows11</a> simply because it is a <a href="https://infosec.space/tags/Govware" class="mention hashtag" rel="nofollow noopener" target="_blank">#Govware</a> and empirically cannot be made private or secure.But that would require them to actually give a shit, which thed don't, cuz otherwise they would've stopped demanding <a href="https://infosec.space/tags/PII" class="mention hashtag" rel="nofollow noopener" target="_blank">#PII</a> like a <a href="https://infosec.space/tags/PhoneNumber" class="mention hashtag" rel="nofollow noopener" target="_blank">#PhoneNumber</a> and moved out of juristiction of <a href="https://infosec.space/tags/CloudAct" class="mention hashtag" rel="nofollow noopener" target="_blank">#CloudAct</a>.<ul><li>I mean, what's gonna prevent the <a href="https://infosec.space/tags/Trump" class="mention hashtag" rel="nofollow noopener" target="_blank">#Trump</a>-Regime from threatening <a href="https://mastodon.world/@Mer__edith" class="u-url mention" rel="nofollow noopener" target="_blank">@Mer__edith</a> et. al. with lifetime in jail for not kicking the <a href="https://infosec.space/tags/ICC" class="mention hashtag" rel="nofollow noopener" target="_blank">#ICC</a> (or anyone else he and his fans dislike) from <a href="https://infosec.space/tags/Signal" class="mention hashtag" rel="nofollow noopener" target="_blank">#Signal</a>'s infrastructure?</li></ul>Since they are highly centralized.they certainly are capable to comply with "<a href="https://infosec.space/tags/Sanctions" class="mention hashtag" rel="nofollow noopener" target="_blank">#Sanctions</a>" (or whatever bs he'll claim!)...

Kevin Karhan :verified:<a href="https://tiggi.es/@DeltaWye" class="u-url mention" rel="nofollow noopener" target="_blank">@DeltaWye</a> <a href="https://chaos.social/@kfh" class="u-url mention" rel="nofollow noopener" target="_blank">@kfh</a> I'd say <a href="https://mastodon.social/@torproject" class="u-url mention" rel="nofollow noopener" target="_blank">@torproject</a> / <a href="https://infosec.space/tags/TorBrowser" class="mention hashtag" rel="nofollow noopener" target="_blank">#TorBrowser</a> as it's <a href="https://infosec.space/tags/Firefox" class="mention hashtag" rel="nofollow noopener" target="_blank">#Firefox</a> but <a href="https://infosec.space/@kkarhan/114388251948556423" rel="nofollow noopener" target="_blank">without</a> <a href="https://infosec.space/tags/tracking" class="mention hashtag" rel="nofollow noopener" target="_blank">#tracking</a>, <a href="https://infosec.space/tags/adware" class="mention hashtag" rel="nofollow noopener" target="_blank">#adware</a> and <a href="https://infosec.space/tags/analytics" class="mention hashtag" rel="nofollow noopener" target="_blank">#analytics</a>! But if you're using <a href="https://infosec.space/tags/Govware" class="mention hashtag" rel="nofollow noopener" target="_blank">#Govware</a> like <a href="https://infosec.space/tags/Windows" class="mention hashtag" rel="nofollow noopener" target="_blank">#Windows</a>, any <a href="https://infosec.space/tags/Browser" class="mention hashtag" rel="nofollow noopener" target="_blank">#Browser</a> that doesn't use the <a href="https://infosec.space/tags/backdoored" class="mention hashtag" rel="nofollow noopener" target="_blank">#backdoored</a> <a href="https://infosec.space/tags/CryptoAPI" class="mention hashtag" rel="nofollow noopener" target="_blank">#CryptoAPI</a> (i.e. all <a href="https://infosec.space/tags/Chromium" class="mention hashtag" rel="nofollow noopener" target="_blank">#Chromium</a>-Forks do use it!) is better...<ul><li>And yes, even <a href="https://github.com/kkarhan/windows-ca-backdoor-fix" rel="nofollow noopener" target="_blank">the "fix" I released</a> isn't propably permanent as any <a href="https://infosec.space/tags/WindowsUpdate" class="mention hashtag" rel="nofollow noopener" target="_blank">#WindowsUpdate</a> can revert it!</li></ul>

Kevin Karhan :verified:<a href="https://infosec.exchange/@paco" class="u-url mention" rel="nofollow noopener" target="_blank">@paco</a> <a href="https://infosec.space/tags/Copilot" class="mention hashtag" rel="nofollow noopener" target="_blank">#Copilot</a> & <a href="https://infosec.space/tags/Recall" class="mention hashtag" rel="nofollow noopener" target="_blank">#Recall</a> are the perfect <a href="https://infosec.space/tags/InfoStealer" class="mention hashtag" rel="nofollow noopener" target="_blank">#InfoStealer</a> <a href="https://infosec.space/tags/malware" class="mention hashtag" rel="nofollow noopener" target="_blank">#malware</a> combo!<ul><li>This makes <a href="https://github.com/kkarhan/windows-ca-backdoor-fix/" rel="nofollow noopener" target="_blank">the</a> <a href="https://infosec.space/tags/CryptoAPI" class="mention hashtag" rel="nofollow noopener" target="_blank">#CryptoAPI</a> - <a href="https://infosec.space/tags/Backdoor" class="mention hashtag" rel="nofollow noopener" target="_blank">#Backdoor</a> look chill by comparison!</li></ul>

Kevin Karhan :verified:<a href="https://infosec.exchange/@cryptrz" class="u-url mention" rel="nofollow noopener" target="_blank">@cryptrz</a> add to that the fact that the <a href="https://infosec.space/tags/CryptoAPI" class="mention hashtag" rel="nofollow noopener" target="_blank">#CryptoAPI</a> is <a href="https://infosec.space/tags/backdoored" class="mention hashtag" rel="nofollow noopener" target="_blank">#backdoored</a> and that said <a href="https://infosec.space/tags/backdoor" class="mention hashtag" rel="nofollow noopener" target="_blank">#backdoor</a> can be triggered with a simple <a href="https://infosec.space/tags/HTTPS" class="mention hashtag" rel="nofollow noopener" target="_blank">#HTTPS</a> request in any <a href="https://infosec.space/tags/Browser" class="mention hashtag" rel="nofollow noopener" target="_blank">#Browser</a> [except <a href="https://infosec.space/tags/Firefox" class="mention hashtag" rel="nofollow noopener" target="_blank">#Firefox</a> & <a href="https://infosec.space/tags/TorBrowser" class="mention hashtag" rel="nofollow noopener" target="_blank">#TorBrowser</a> as they use <a href="https://infosec.space/tags/NSS" class="mention hashtag" rel="nofollow noopener" target="_blank">#NSS</a> instead!] (or <a href="https://infosec.space/tags/PowerShell" class="mention hashtag" rel="nofollow noopener" target="_blank">#PowerShell</a>'s horrible <code>wget</code> implementation)...And we have sufficient proof thaf <a href="https://infosec.space/tags/Windows" class="mention hashtag" rel="nofollow noopener" target="_blank">#Windows</a> is a <a href="https://infosec.space/tags/Govware" class="mention hashtag" rel="nofollow noopener" target="_blank">#Govware</a> that noone should use and that should be banned across the globe.<a href="http://github.com/kkarhan/windows-ca-backdoor-fix" rel="nofollow noopener" translate="no" target="_blank">http://github.com/kkarhan/windows-ca-backdoor-fix</a>

Kevin Karhan :verified:<a href="https://infosec.exchange/@0x40k" class="u-url mention" rel="nofollow noopener" target="_blank">@0x40k</a> well, <a href="https://infosec.space/tags/Microsoft" class="mention hashtag" rel="nofollow noopener" target="_blank">#Microsoft</a> to this day has a <a href="https://infosec.space/tags/Backdoor" class="mention hashtag" rel="nofollow noopener" target="_blank">#Backdoor</a> in the <a href="https://infosec.space/tags/CryptoAPI" class="mention hashtag" rel="nofollow noopener" target="_blank">#CryptoAPI</a> that <a href="http://github.com/kkarhan/windows-ca-backdoor-fix" rel="nofollow noopener" target="_blank">remains unfixed to this day</a>...<ul><li>And since Microsoft doesn't acknowledge the concept of <a href="https://infosec.space/tags/consent" class="mention hashtag" rel="nofollow noopener" target="_blank">#consent</a> in <a href="https://infosec.space/tags/Windows" class="mention hashtag" rel="nofollow noopener" target="_blank">#Windows</a> (and doesn't even fake it!) and they are both <a href="https://infosec.space/tags/PRISM" class="mention hashtag" rel="nofollow noopener" target="_blank">#PRISM</a> collaborators AND subject to <a href="https://infosec.space/tags/CloudAct" class="mention hashtag" rel="nofollow noopener" target="_blank">#CloudAct</a>, they <a href="https://infosec.space/tags/CantFix" class="mention hashtag" rel="nofollow noopener" target="_blank">#CantFix</a> & <a href="https://infosec.space/tags/WontFix" class="mention hashtag" rel="nofollow noopener" target="_blank">#WontFix</a> it!</li></ul>

Kevin Karhan :verified:<a href="https://nrw.social/@roman78" class="u-url mention" rel="nofollow noopener" target="_blank">@roman78</a> <a href="https://astronomy.social/@admin" class="u-url mention" rel="nofollow noopener" target="_blank">@admin</a> <a href="https://nrw.social/@olifantenbaer" class="u-url mention" rel="nofollow noopener" target="_blank">@olifantenbaer</a> angesichts der Lücken in <a href="https://infosec.space/tags/CryptoAPI" class="mention hashtag" rel="nofollow noopener" target="_blank">#CryptoAPI</a> inklusive <a href="https://infosec.space/tags/Backdoors" class="mention hashtag" rel="nofollow noopener" target="_blank">#Backdoors</a> ist das digitales <a href="https://infosec.space/tags/FlexTape" class="mention hashtag" rel="nofollow noopener" target="_blank">#FlexTape</a> bei durchgerrostetem Rohr...<ul><li>Hinzu kommt dass <a href="https://infosec.space/tags/WindowsUpdate" class="mention hashtag" rel="nofollow noopener" target="_blank">#WindowsUpdate</a> entsprechende Einstellungen resetted.<a href="https://github.com/kkarhan/windows-ca-backdoor-fix" rel="nofollow noopener" translate="no" target="_blank">https://github.com/kkarhan/windows-ca-backdoor-fix</a></li></ul>

Kevin Karhan :verified:<a href="https://social.tchncs.de/@gborn" class="u-url mention" rel="nofollow noopener" target="_blank">@gborn</a> <a href="https://hessen.social/@MichaelD" class="u-url mention" rel="nofollow noopener" target="_blank">@MichaelD</a> <a href="https://det.social/@Bundesligatrainer" class="u-url mention" rel="nofollow noopener" target="_blank">@Bundesligatrainer</a> <a href="https://chaos.social/@Ihazchaos" class="u-url mention" rel="nofollow noopener" target="_blank">@Ihazchaos</a> nein, eben nicht.Dass <a href="https://infosec.space/tags/Windows10" class="mention hashtag" rel="nofollow noopener" target="_blank">#Windows10</a> [und besonders <a href="https://infosec.space/tags/Windows11" class="mention hashtag" rel="nofollow noopener" target="_blank">#Windows11</a>] nicht <a href="https://infosec.space/tags/DSGVO" class="mention hashtag" rel="nofollow noopener" target="_blank">#DSGVO</a>- & <a href="https://infosec.space/tags/BDSG" class="mention hashtag" rel="nofollow noopener" target="_blank">#BDSG</a>-konform sein können ist <a href="https://www.lda.bayern.de/media/windows_10_report.pdf" rel="nofollow noopener" target="_blank">evidenzierte Tatsache</a> und ich habe noch keine*n Anwält*in gesehen die etwas anderes behaupten und dafür im Zweifelsfalle auch die <a href="https://infosec.space/tags/Haftung" class="mention hashtag" rel="nofollow noopener" target="_blank">#Haftung</a> übernehmen würden.<ul><li>Wohingegen ich mir sicher bin dass <a href="https://fosstodon.org/@SUSE" class="u-url mention" rel="nofollow noopener" target="_blank">@SUSE</a> & <a href="https://ubuntu.social/@ubuntu" class="u-url mention" rel="nofollow noopener" target="_blank">@ubuntu</a> mir im Zweifelsfalle sogar ne <a href="https://infosec.space/tags/Versicherung" class="mention hashtag" rel="nofollow noopener" target="_blank">#Versicherung</a> der <a href="https://infosec.space/tags/Compliance" class="mention hashtag" rel="nofollow noopener" target="_blank">#Compliance</a> ab Werk anbieten würden, was <a href="https://infosec.space/tags/Microsoft" class="mention hashtag" rel="nofollow noopener" target="_blank">#Microsoft</a> aufgrund von <a href="https://infosec.space/tags/CloudAct" class="mention hashtag" rel="nofollow noopener" target="_blank">#CloudAct</a> inhärent nicht kann!</li><li>Außerdem verbietet sich das Procurement von Anbietern die in "illegaler Agententätigkeit" [u.a. <a href="https://infosec.space/tags/PRISM" class="mention hashtag" rel="nofollow noopener" target="_blank">#PRISM</a>] involviert sind (!!!) schon aus oberflächlicher due diligence...</li></ul>Von <a href="https://github.com/kkarhan/windows-ca-backdoor-fix/" rel="nofollow noopener" target="_blank">einfach ausnutzbaren</a> <a href="https://infosec.space/tags/Govware" class="mention hashtag" rel="nofollow noopener" target="_blank">#Govware</a> - <a href="https://infosec.space/tags/Backdoors" class="mention hashtag" rel="nofollow noopener" target="_blank">#Backdoors</a> in der <a href="https://infosec.space/tags/CryptoAPI" class="mention hashtag" rel="nofollow noopener" target="_blank">#CryptoAPI</a> unter <a href="https://infosec.space/tags/Windows" class="mention hashtag" rel="nofollow noopener" target="_blank">#Windows</a> hab ich noch garnicht angefangen! <ul><li>TLDR: <a href="https://infosec.space/tags/Windows" class="mention hashtag" rel="nofollow noopener" target="_blank">#Windows</a> gehört in den <a href="https://infosec.space/tags/M%C3%BCll" class="mention hashtag" rel="nofollow noopener" target="_blank">#Müll</a> und notfalls auf ne <a href="https://infosec.space/tags/airgapped" class="mention hashtag" rel="nofollow noopener" target="_blank">#airgapped</a> Kiste bzw. <a href="https://infosec.space/tags/offline" class="mention hashtag" rel="nofollow noopener" target="_blank">#offline</a> VM! Ich fass' den shice nicht an!!!</li></ul><a href="https://infosec.space/tags/EOD" class="mention hashtag" rel="nofollow noopener" target="_blank">#EOD</a>

Kevin Karhan :verified:<a href="https://transfem.social/@puppygirlhornypost2" class="u-url mention" rel="nofollow noopener" target="_blank">@puppygirlhornypost2</a> <a href="https://social.vlhl.dev/users/navi" class="u-url mention" rel="nofollow noopener" target="_blank">@navi</a> yeah, but that's a common problem based off <a href="https://infosec.space/tags/TechIlliteracy" class="mention hashtag" rel="nofollow noopener" target="_blank">#TechIlliteracy</a> and lack of proper explaination!<ul><li>Given the <a href="https://infosec.space/tags/CryptoAPI" class="mention hashtag" rel="nofollow noopener" target="_blank">#CryptoAPI</a> of <a href="https://infosec.space/tags/Windows" class="mention hashtag" rel="nofollow noopener" target="_blank">#Windows</a> is <a href="https://infosec.space/tags/backdoored" class="mention hashtag" rel="nofollow noopener" target="_blank">#backdoored</a> for <a href="https://infosec.space/tags/Govware" class="mention hashtag" rel="nofollow noopener" target="_blank">#Govware</a> [<a href="https://infosec.space/tags/NSAKEY_" class="mention hashtag" rel="nofollow noopener" target="_blank">#NSAKEY_</a> & <a href="https://infosec.space/tags/SSL" class="mention hashtag" rel="nofollow noopener" target="_blank">#SSL</a>-<a href="https://github.com/kkarhan/windows-ca-backdoor-fix" rel="nofollow noopener" target="_blank">Updates</a> I'd consider <a href="https://infosec.space/tags/BitLocker" class="mention hashtag" rel="nofollow noopener" target="_blank">#BitLocker</a> insecure and the least of it's problems!</li></ul>Bonus points if <a href="https://infosec.space/tags/TPM" class="mention hashtag" rel="nofollow noopener" target="_blank">#TPM</a> bs prevents <a href="https://infosec.space/tags/DataRecovery" class="mention hashtag" rel="nofollow noopener" target="_blank">#DataRecovery</a>.<ul><li>My biggest problem with <a href="https://infosec.space/tags/FDE" class="mention hashtag" rel="nofollow noopener" target="_blank">#FDE</a>/ <a href="https://infosec.space/tags/FullDiskEncryption" class="mention hashtag" rel="nofollow noopener" target="_blank">#FullDiskEncryption</a> is that is mandates direct access to a system to authenticate, thus one needs to manually mount stuff on servers post-boot instead.</li></ul>

Kevin Karhan :verified:<a href="https://goatdaddy.net/profile/vvelox" class="u-url mention" rel="nofollow noopener" target="_blank">@vvelox</a> <a href="https://infosec.exchange/@SecurityWriter" class="u-url mention" rel="nofollow noopener" target="_blank">@SecurityWriter</a> I trust noone, but unlike <a href="https://infosec.space/tags/Microsoft" class="mention hashtag" rel="nofollow noopener" target="_blank">#Microsoft</a>, <a href="https://infosec.space/tags/RedHad" class="mention hashtag" rel="nofollow noopener" target="_blank">#RedHad</a> didn't betray it's paying customers by literally shoving <a href="https://infosec.space/tags/Govware" class="mention hashtag" rel="nofollow noopener" target="_blank">#Govware</a> <a href="https://infosec.space/tags/Backdoors" class="mention hashtag" rel="nofollow noopener" target="_blank">#Backdoors</a> into critical compontents like the <a href="https://infosec.space/tags/CryptoAPI" class="mention hashtag" rel="nofollow noopener" target="_blank">#CryptoAPI</a>... <a href="https://github.com/kkarhan/windows-ca-backdoor-fix" rel="nofollow noopener" translate="no" target="_blank">https://github.com/kkarhan/windows-ca-backdoor-fix</a>

Kevin Karhan :verified:<a href="https://mas.to/@tokyo_0" class="u-url mention" rel="nofollow noopener" target="_blank">@tokyo_0</a> <a href="https://infosec.space/tags/TrueCrypt" class="mention hashtag" rel="nofollow noopener" target="_blank">#TrueCrypt</a> is <a href="https://infosec.space/tags/abandonware" class="mention hashtag" rel="nofollow noopener" target="_blank">#abandonware</a> with serious security issues. <ul><li>DO NOT USE TRUECRYPT FFS!!!</li></ul>Use <a href="https://infosec.space/tags/VeraCrypt" class="mention hashtag" rel="nofollow noopener" target="_blank">#VeraCrypt</a> or even better: migrate machines to <a href="https://infosec.space/tags/Linux" class="mention hashtag" rel="nofollow noopener" target="_blank">#Linux</a> and use <a href="https://infosec.space/tags/LUKS" class="mention hashtag" rel="nofollow noopener" target="_blank">#LUKS</a> / <a href="https://infosec.space/tags/dmcrypt" class="mention hashtag" rel="nofollow noopener" target="_blank">#dmcrypt</a> instead, as it's the best option at hand.<ul><li>If you need to shuttle data to <a href="https://infosec.space/tags/Windows" class="mention hashtag" rel="nofollow noopener" target="_blank">#Windows</a> and <a href="https://infosec.space/tags/macOS" class="mention hashtag" rel="nofollow noopener" target="_blank">#macOS</a> machines and using <a href="https://infosec.space/tags/SFTP" class="mention hashtag" rel="nofollow noopener" target="_blank">#SFTP</a> / <a href="https://infosec.space/tags/SSHFS" class="mention hashtag" rel="nofollow noopener" target="_blank">#SSHFS</a> to mount a secure storage over the network isn't an option, than you're stuck with VeraCrypt, as <a href="https://infosec.space/tags/Windows" class="mention hashtag" rel="nofollow noopener" target="_blank">#Windows</a>' <a href="https://infosec.space/tags/CryptoAPI" class="mention hashtag" rel="nofollow noopener" target="_blank">#CryptoAPI</a> is evidently <a href="https://infosec.space/tags/backdoored" class="mention hashtag" rel="nofollow noopener" target="_blank">#backdoored</a> to the point that every <a href="https://infosec.space/tags/Browser" class="mention hashtag" rel="nofollow noopener" target="_blank">#Browser</a> except <a href="https://infosec.space/tags/Firefox" class="mention hashtag" rel="nofollow noopener" target="_blank">#Firefox</a> is susceptible to <a href="https://infosec.space/tags/SSL" class="mention hashtag" rel="nofollow noopener" target="_blank">#SSL</a> hijacking with background updates...</li></ul><a href="https://github.com/kkarhan/windows-ca-backdoor-fix" rel="nofollow noopener" translate="no" target="_blank">https://github.com/kkarhan/windows-ca-backdoor-fix</a>

xoron :verified:"Encryption at Rest" for JavaScript ProjectsFollowing a previous post (<a href="https://infosec.exchange/@xoron/113446067764347249" rel="nofollow noopener" translate="no" target="_blank">https://infosec.exchange/@xoron/113446067764347249</a>), which can be summarized as: I'm tackling state management with an extra twist: integrating encryption at rest!I created some updates to the WIP pull-request. The behavior is as follows.- The user is prompted for a password if one isn't provided programmatically. - This will allow for developers to create a custom password prompts in their application. The default fallback is to use a JavaScript prompt(). - It also seems possible to enable something like "fingerprint/face encryption" for some devices using the webauthn api. (This works, but the functionality is a bit flaky and needs to be fixed before rolling out.) - Using AES-GCM with 1000000 iterations of PBKDF2 to derive the key from the password. - The iterations can be increased in exchange for slower performance. It isn't currently configurable, but it might be in the future. - The salt and AAD need to be deterministic and so to simplify user input, the salt as AAD are derived as the sha256 hash of the password. (Is this a good idea?)The latest version of the code can be seen in the PR: <a href="https://github.com/positive-intentions/dim/pull/9" rel="nofollow noopener" translate="no" target="_blank">https://github.com/positive-intentions/dim/pull/9</a>I'm keen to get feedback on the approach and the implementation before i merge it into the main branch.<a href="https://infosec.exchange/tags/JavaScript" class="mention hashtag" rel="nofollow noopener" target="_blank">#JavaScript</a> <a href="https://infosec.exchange/tags/Encryption" class="mention hashtag" rel="nofollow noopener" target="_blank">#Encryption</a> <a href="https://infosec.exchange/tags/IndexedDB" class="mention hashtag" rel="nofollow noopener" target="_blank">#IndexedDB</a> <a href="https://infosec.exchange/tags/WebDevelopment" class="mention hashtag" rel="nofollow noopener" target="_blank">#WebDevelopment</a> <a href="https://infosec.exchange/tags/CryptoAPI" class="mention hashtag" rel="nofollow noopener" target="_blank">#CryptoAPI</a> <a href="https://infosec.exchange/tags/FrontendDev" class="mention hashtag" rel="nofollow noopener" target="_blank">#FrontendDev</a> <a href="https://infosec.exchange/tags/ReactHooks" class="mention hashtag" rel="nofollow noopener" target="_blank">#ReactHooks</a> <a href="https://infosec.exchange/tags/StateManagement" class="mention hashtag" rel="nofollow noopener" target="_blank">#StateManagement</a> <a href="https://infosec.exchange/tags/WebSecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#WebSecurity</a> <a href="https://infosec.exchange/tags/OpenSource" class="mention hashtag" rel="nofollow noopener" target="_blank">#OpenSource</a> <a href="https://infosec.exchange/tags/PersonalProjects" class="mention hashtag" rel="nofollow noopener" target="_blank">#PersonalProjects</a>

xoron :verified:"Encryption at Rest" for JavaScript ProjectsI'm developing a JavaScript UI framework for personal projects, and I'm tackling state management with an extra twist: integrating encryption at rest!Inspired by this React Hook: Async State Management (<a href="https://positive-intentions.com/blog/async-state-management" rel="nofollow noopener" translate="no" target="_blank">https://positive-intentions.com/blog/async-state-management</a>), I’m extending it to support encrypted persistent data. Here's how:✨ The Approach:Using IndexedDB for storage.Data is encrypted before saving and decrypted when loading using the Browser Cryptography API.Event listeners will also be encrypted/decrypted to avoid issues like browser extensions snooping on events.The password (should never be stored) is entered by the user at runtime to decrypt the data. (Currently hardcoded for now!)The salt will be stored unencrypted in IndexedDB to generate the key.🔗 Proof of Concept: You can try it out here: GitHub PR (<a href="https://github.com/positive-intentions/dim/pull/8" rel="nofollow noopener" translate="no" target="_blank">https://github.com/positive-intentions/dim/pull/8</a>). Clone or run it in Codespaces and let me know what you think!❓ Looking for Feedback: Have I missed anything? Are there better ways to make this storage secure?Let's make secure web UIs a reality together! 🔒<a href="https://infosec.exchange/tags/JavaScript" class="mention hashtag" rel="nofollow noopener" target="_blank">#JavaScript</a> <a href="https://infosec.exchange/tags/Encryption" class="mention hashtag" rel="nofollow noopener" target="_blank">#Encryption</a> <a href="https://infosec.exchange/tags/IndexedDB" class="mention hashtag" rel="nofollow noopener" target="_blank">#IndexedDB</a> <a href="https://infosec.exchange/tags/WebDevelopment" class="mention hashtag" rel="nofollow noopener" target="_blank">#WebDevelopment</a> <a href="https://infosec.exchange/tags/CryptoAPI" class="mention hashtag" rel="nofollow noopener" target="_blank">#CryptoAPI</a> <a href="https://infosec.exchange/tags/FrontendDev" class="mention hashtag" rel="nofollow noopener" target="_blank">#FrontendDev</a> <a href="https://infosec.exchange/tags/ReactHooks" class="mention hashtag" rel="nofollow noopener" target="_blank">#ReactHooks</a> <a href="https://infosec.exchange/tags/StateManagement" class="mention hashtag" rel="nofollow noopener" target="_blank">#StateManagement</a> <a href="https://infosec.exchange/tags/WebSecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#WebSecurity</a> <a href="https://infosec.exchange/tags/OpenSource" class="mention hashtag" rel="nofollow noopener" target="_blank">#OpenSource</a> <a href="https://infosec.exchange/tags/PersonalProjects" class="mention hashtag" rel="nofollow noopener" target="_blank">#PersonalProjects</a>

Kevin Karhan :verified:<a href="https://mstdn.social/@rysiek" class="u-url mention" rel="nofollow noopener" target="_blank">@rysiek</a> <a href="https://infosec.space/tags/Microsoft" class="mention hashtag" rel="nofollow noopener" target="_blank">#Microsoft</a> blaming the <a href="https://infosec.space/tags/EU" class="mention hashtag" rel="nofollow noopener" target="_blank">#EU</a> for <a href="https://infosec.space/tags/CrowdStrike" class="mention hashtag" rel="nofollow noopener" target="_blank">#CrowdStrike</a> when the most affected customers are <a href="https://infosec.space/tags/Airlines" class="mention hashtag" rel="nofollow noopener" target="_blank">#Airlines</a> from the <a href="https://infosec.space/tags/USA" class="mention hashtag" rel="nofollow noopener" target="_blank">#USA</a> that don't eben service Airports in <a href="https://infosec.space/tags/Europe" class="mention hashtag" rel="nofollow noopener" target="_blank">#Europe</a> at all is the biggest insult to the intellect of everyone since they denied <a href="https://infosec.space/tags/_NSAKEY" class="mention hashtag" rel="nofollow noopener" target="_blank">#_NSAKEY</a> and their <a href="https://infosec.space/tags/CryptoAPI" class="mention hashtag" rel="nofollow noopener" target="_blank">#CryptoAPI</a> <a href="https://infosec.space/tags/backdoor" class="mention hashtag" rel="nofollow noopener" target="_blank">#backdoor</a>:<a href="https://github.com/kkarhan/windows-ca-backdoor-fix" rel="nofollow noopener" translate="no" target="_blank">https://github.com/kkarhan/windows-ca-backdoor-fix</a>

Kevin Karhan :verified:<a href="https://infosec.exchange/@malwaretech" class="u-url mention" rel="nofollow noopener" target="_blank">@malwaretech</a> thanks for adding another legendary <a href="https://infosec.space/tags/ITsec" class="mention hashtag" rel="nofollow noopener" target="_blank">#ITsec</a> <a href="https://infosec.space/tags/fuckup" class="mention hashtag" rel="nofollow noopener" target="_blank">#fuckup</a> by <a href="https://infosec.space/tags/Microsoft" class="mention hashtag" rel="nofollow noopener" target="_blank">#Microsoft</a> to the long list of *"<a href="https://infosec.space/tags/WontFix" class="mention hashtag" rel="nofollow noopener" target="_blank">#WontFix</a>" <a href="https://infosec.space/tags/Exploits" class="mention hashtag" rel="nofollow noopener" target="_blank">#Exploits</a> that prevent me from even touching <a href="https://infosec.space/tags/Windows" class="mention hashtag" rel="nofollow noopener" target="_blank">#Windows</a> at all...If a literal <a href="https://infosec.space/tags/Govware" class="mention hashtag" rel="nofollow noopener" target="_blank">#Govware</a> <a href="https://infosec.space/tags/Backdoor" class="mention hashtag" rel="nofollow noopener" target="_blank">#Backdoor</a> in the <a href="https://infosec.space/tags/CryptoAPI" class="mention hashtag" rel="nofollow noopener" target="_blank">#CryptoAPI</a> <a href="https://github.com/kkarhan/windows-ca-backdoor-fix" rel="nofollow noopener" target="_blank">wasn't worse enough already</a>...

Recent searches

Search options

Administered by:

Server stats:

#cryptoapi