332 private links
After the two exploits of this week, another one is published.
On the other hand: what passwords have going for them is that they’re very intuitive, everyone knows how they work, people have been using them since time immemorial, and you can choose where you store them and who you share them with. Keep this in mind.
What’s neat about TOTP is that it doesn’t rely on text messages or email or even the internet at all. Your authenticator software simply generates a random-looking number every 30 seconds based on the current time (and a random starting number called a “seed” or a “key” that is unique to you), and this is all that a website needs to verify you’re you.
Similar to passwords, TOTP can be stored the way the user want.
In fact there are many different things called “passkeys” and the FIDO Alliance has intentionally named all of them the same thing. I believe this was done in order to deliberately confuse users and encourage them not to look too closely at the fine text.
There are multiple properties for a passkeys:
- copyable or not copyable
- transferable or not transferable
- hardware-backed or software-backed
- user present or non-user-present
- user verified or non-user-verified
- attested or non-attested: They’re called authenticator data flags in the WebAuthn standard.
A platform can now say: "sorry, we only accept the User-Present User-Verified Non-Copyable Hardware-Backed varieties of passkey here" or just: "unfortunately your passkey isn’t secure enough; download our app.” But it’s an open standard, isn’t it?
Attested passkeys is the glitch (authenticator data flag AT, if you were wondering). This is the feature that means you no longer get to make the calls about your passkeys. "Critically, remote attestation requires the co-operation of your cryptoprocessor, your passkey manager software, your device’s operating system, and your device’s firmware to all pass the remote attestation check".
My expectation is that the industry will start off with very few constraints on your passkeys, and gradually add more and more, not all at the same time, but staggered on different sites, and then in a few years people will forget that they were ever offered a choice in which security measures they want to enable on their passkey.
For intelligence agencies, and for corporations like Microsoft, Google, Apple, Facebook, Amazon – giving you convenience and security is likely not their primary goal. I think they have an entirely ulterior motive. They can use passkeys to prevent you from running unapproved software.
L’hypothèse la plus partagée est celle du bug, que privilégie aussi Nomad. Un téraoctet en dix jours représente un flux continu d’environ 1,1 mégaoctet par seconde, un volume que beaucoup jugent impossible à justifier. Ils imaginent plutôt une erreur d’unité, comme un délai prévu en secondes mais lu en millisecondes, ou une boucle qui renvoie des paquets sans jamais marquer de pause.
.GH, .SL, and .AS were compromised. The
Il y a des fuites de données sérieuses quand même. L'ANTS a partagé l'access_token avec une entreprise de collecte des données.
Pourquoi un tel changement ? Pour les mêmes raisons que dans les changements annoncés dans les rythmes de Chrome ou Firefox : tenir compte du déluge de corrections entrainé par l’utilisation des LLM dans la recherche de failles. On voit depuis plusieurs mois une explosion des correctifs, par exemple chez Mozilla (qui a bénéficié de Mythos 5 d’Anthropic, via Glasswing), ou encore chez Microsoft et son infrastructure Perception.
La cadence des publications s'intensifie afin de corriger les failles de sécurité.
Fin août, Greg Kroah-Hartman, mainteneur principal du noyau, relevait qu’une version du noyau corrigeait en moyenne 500 vulnérabilités (CVE) entre les moutures 6.9 et 6.19. Mais la version 7.0 en a corrigé plus de 1 000 et la 7.2 a dépassé les 1 500. À ce rythme, le noyau 7.3 pourrait passer la barre des 2 000.
A wormable vulnerability allowed anyone able to inject text in a build log on builds.sr.ht (or other instances) to take over accounts who viewed them
HEIF Heist is Hacktron's name for a class of remote attack paths targeting services that decode attacker-controlled HEIF, HEIC, or AVIF images. By exploiting underlying native libraries, these vulnerabilities allow an attacker to bypass application-level defenses and trigger memory corruption, data exposure, or remote code execution (RCE).
OpenAI's AI uploaded on RubyGems malicious packages.
Meanwhile the agents also hijacked german website.
A 862-bits RSA-260 key, so we have time for the 2048 bits key. The CPU (and cloud infrastructure) will have enough power to break 2048 bits key at some point.
ID verification on the Internet. Well there is already a leak ofidscan.net for a year.
In millions:
153 millions drivers license
10 millions identification card
2 millions travel card
and more
La meilleure application gérant les OTPs pour de l'authentification deux facteurs que j'ai trouvé jusqu'à maintenant.
Comment éviter le .env, un fichier en clair
Secure, single-binary Rust CRUD application for managing CSAF 2.0 and 2.1 security advisories. Provides both a server-side rendered web UI (Hyper + Bootstrap 5 + HTMX) and a RESTful HATEOAS JSON API under /api/v1/.
La société française paie l'absence du NIS2 dans les textes légaux actuellement. L'obligation de l'authentification multi-facteurs auraient épargné un certain nombre de piratage.
Le NIS2 semble être un excellent standard à suivre. Pourquoi la France prend-t-elle autant de temps alors qu'elle se numérise ?
La CJUE est saisie afin d'imposer des sanctions financières à la France jusqu'à ce que le texte soit totalement transposé.
C'est la double peine.
The technology giant won the award for publishing a May blog post that threatened security researchers with legal action if they publish zero-days about its products.