Vesi posted:

anatoliy pltkrvkay posted:

and it will be fishmeched again in the future. fishmeching never ends.

in secfuck news apparently bevmo was storing entire CC numbers because PCI auditors are good at their jobs.

Raere posted:

What's the consensus on running AV on Macs (for myself)? Do they just increase the attack surface like they tend to do on PCs, or is it actually a useful extra layer of defense?

BattleMaster posted:

it's also why mongo db makes me vaguely uncomfortable (aside from the things that are obviously wrong with it )

Lain Iwakura posted:

https://twitter.com/KateLibc/status/1082687485887471616

Shame Boy posted:

yeah those have been going around, i posted a few in the last thread. did it say you have ~UNBRIDLED FANTASY~ 'cuz that's my favorite one

Powerful Two-Hander posted:

good to see the speed running community are still setting new times in Hitman

Cocoa Crispies posted:

my brothers and I got our parents a smart lock for Christmas

flakeloaf posted:

https://twitter.com/jinnysims/status/1087763839469277184

jesus christ

Shame Boy posted:

while waiting in the parking lot of my wife's office today i noticed that there was an open, unprotected wifi network...

...called "WiFi_ODBII"

Volmarias posted:

Sounds like Apple would be within their rights to nuke all of their certs at this point

my bitter bi rival posted:

https://twitter.com/tombschrader/status/1090033464731099136

rjmccall posted:

hmm, probably does not count as intent to obtain a benefit, to injure or defraud another or to facilitate an unlawful activity

Salt Fish posted:

DNA has 4 amino acids as it's alphabet, how do you encode an escape sequence? Like what the heck kind of processing is that lovely?

apseudonym posted:

Security Fuckup Megathread - v17.1 - Validate your DNA inputs

haveblue posted:

the best phish training email I've seen was one that claimed to be from our security team containing a list of people who fell for the last phish training email

Soricidus posted:

could have been worse, could have been blockchain

redleader posted:

nah, blockchain is old news and no longer hip

GWBBQ posted:

someone compromised an email provider's primary and backup servers, formatted them, and destroyed 20 years of data. the company apparently had no cold storage backups.

https://arstechnica.com/information...ZigasqormT3brUE

Ashcans posted:

Also this morning, I come to you with a tale of IT security. We use a secure file service, where people can upload documents to you and you get an email notification, log in and access them, I assume this is a pretty typical tool. When we started using this, you could allocate permissions so that someone else in the system could look at your received files. Which is ideal for when you have some old senior staff who are not prepared to handle document security, they just forward the notification to their staff and someone can log in and access the documents.

Well, a little while ago the secure file service stripped out this feature because, I dunno, I guess maybe sharing access was not considered best practice? Or more accurately, they made it so that in order to access anyone else's files, you have to be an administrator. So we were faced with two options; give all these staff admin privileges, or force senior staff to learn to use the service and spend time accessing/sharing documents. Yea, no. So the office settles on a third option; put our senior staff login information and passwords in a word file on the server, so when they forward something you can login as them and get what you need. But that's clearly not great either, so.... they password-lock the word file. But now how do people get the password for the word file with the passwords they need to get the files?

It is written on a notepad, which is kept under someone's file tray on their desk.

This is definitely a better system.

BIGFOOT EROTICA posted:

there was a talk that i believe was posted in this thread (or its progenitors) a while back about hacking airline booking backends (and i think through exposed portals for travel agents??) including being able to get any persons boarding passes and stuff like that

anyone remember this?

pseudorandom name posted:

gage is a correct spelling

duz posted:

the it aup we all had to sign at my school included that we would not use the computers to influence the vote of a senator

evil_bunnY posted:

https://twitter.com/aionescu/status/1103364995251810304

Methanar posted:

When lowtax dies. ZDR still has the keys to get in right?

Optimus_Rhyme posted:

https://twitter.com/cissp_googling/status/1106699482220191746?s=19

Bhodi posted:

listen kid, you aren't a real security professional unless you know a group that was last relevant before you were born

DrPossum posted:

l0l

~Coxy posted:

our IS implemented some kind of internal firewall that kills any extant connection after an hour, no matter what

boy it was fun implementing auto-reconnect in our DB layer

crazypenguin posted:

I'm about to accept (I think) a new job where my task might be to fix this mess for the whole industry. I'd say more, but I don't really know yet and/or am under NDA.

Any general thoughts you're willing to share on the "automate all the networking configuration bullshit, and make it Actually Good" front? This isn't my background (my background is that "sanity-checking requires a lot of complicated logic" part), so I have a lot to learn on the state of the industry and what the pain-points are.

Diva Cupcake posted:

this is fun
https://twitter.com/KimZetter/status/1110167942749052928

Shinku ABOOKEN posted:

i love seeing traffic from java.exe. what could it be? who cares.

Cybernetic Vermin posted:

fde keyed to your key fob is the correct solution either way, no need to invent less convenient solutions just because doing the fde requires a slight redesign