Security Fuckup Megathread - v13.69 - plugins may violate privacy

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > YOSPOS > Security Fuckup Megathread - v13.69 - plugins may violate privacy

kitten emergency: Jan 13, 2008; get meow this wack-ass crystal prison

Wheany posted:

yes, the fingerprint wasn't literally whateverthefuck, i'm not going to transcribe some screenshot for a yospost

the point was that as far as i can tell, there is no way of finding out the saved fingerprint for a given server so that i can compare them

well, with putty you can get some really long hex string from the registry, but its way too long and it's not in the same format as the one in the dialog. (two hex digits, colon, two hex digits, colon etc)

so the warning is "YOUR poo poo MIGHT HAVE BEEN HACKED, check this fingerprint:" and there is no way to get a known-good value from another instance of winscp or putty to compare them.

im pretty sure you can convert the fingerprint to the hash or w/e, it's the same thing that's in authorized_keys

# ¿ Jan 9, 2017 11:59

Adbot: ADBOT LOVES YOU

# ¿ May 2, 2024 11:16

kitten emergency: Jan 13, 2008; get meow this wack-ass crystal prison

wait, I'm high, isn't that literally just the pubkey? and the thing that's displayed is the md5 hash?

# ¿ Jan 9, 2017 12:01

kitten emergency: Jan 13, 2008; get meow this wack-ass crystal prison

that was aggressively terrible

# ¿ Jan 30, 2017 01:15

kitten emergency: Jan 13, 2008; get meow this wack-ass crystal prison

OSI bean dip posted:

a seemingly ill person who thinks that they can remake the world with bitcoin and poo poo crypto

he should come here to explain why his crypto will work and give us a real technical explanation of things

trust me, you really don't want this to happen

# ¿ Feb 9, 2017 23:17

kitten emergency: Jan 13, 2008; get meow this wack-ass crystal prison

i see this is your first eripsa encounter then

# ¿ Feb 9, 2017 23:44

kitten emergency: Jan 13, 2008; get meow this wack-ass crystal prison

Volmarias posted:

This has the same problem that FDE systems with alternate passwords have: "no, i don't believe you, show me your real account" even though that's the only one.

have the duress password also trigger a message to your lawyer with your sign-in location so they can try and come scoop you?

# ¿ Feb 12, 2017 16:13

kitten emergency: Jan 13, 2008; get meow this wack-ass crystal prison

Subjunctive posted:

it may surprise you to discover that it's well-covered ground at many of the companies who make these services

not really. it's also not surprising that they don't implement said features.

# ¿ Feb 12, 2017 19:43

kitten emergency: Jan 13, 2008; get meow this wack-ass crystal prison

Lutha Mahtin posted:

beautiful

e: lol

https://mobile.twitter.com/paaleksey/status/833355010637455367

how many bitcoins can you mine in the time it takes for a CI build to run?

# ¿ Feb 20, 2017 19:35

kitten emergency: Jan 13, 2008; get meow this wack-ass crystal prison

Shaggar posted:

they might be hijacking the build so unless the CI server doesn't have a max run time for a build it would run until killed by someone else.

yeah but basically every public project that uses some public CI service is gonna have sane defaults for that, right? 🤔

# ¿ Feb 20, 2017 20:31

kitten emergency: Jan 13, 2008; get meow this wack-ass crystal prison

tsayyy lmao

# ¿ Feb 21, 2017 02:38

Adbot: ADBOT LOVES YOU

# ¿ May 2, 2024 11:16

kitten emergency: Jan 13, 2008; get meow this wack-ass crystal prison

Daman posted:

hey has anyone used splunks universal forwarder as an alternative to expensive endpoint security poo poo (carbon black)?

it says it can log new processes, services, logins, runkeys, etc which is probably enough to detect if an endpoint got owned.

is this good enough? budget is $0, and there's like no trail for these things in the corporation at present. only other things I can think to do is run LimaCharlie or Eljefe on hosts, and that would only serve to tell us they did double click the exe they downloaded, or the webapp on this server was popped because a process spawned as a child of php-fpm. it would also serve to make another server exist, to promptly break when I'm not there to babysit the company in a few months... idk how robust those are

have fun with your 500mb/day ingestion limit!

our ops dude set up splunk to do audit logging of AD alone and we blew past 5gb/day with just AD lol

# ¿ Feb 26, 2017 06:50

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > YOSPOS > Security Fuckup Megathread - v13.69 - plugins may violate privacy