Conversation

Notices

1. Embed this notice
   bert hubert 🇺🇦🇪🇺 (bert_hubert@fosstodon.org)'s status on Friday, 24-Jan-2025 02:23:19 JST bert hubert 🇺🇦🇪🇺

   Yesterday a user told me they couldn't log in to my parliamentary monitoring site. On investigating, I found that Microsoft email security was logging in on behalf of my user by executing a POST. This broke the single-use sign-on link. Executing POSTs is usually considered unacceptable, and in this way Microsoft again transgresses an important norm. Here's how to deal with the specific POST problem & what might be done about these transgressions in general:
   https://berthub.eu/articles/posts/shifting-cyber-norms-microsoft-post/

   • Embed this notice
     Rich Felker (dalias@hachyderm.io)'s status on Saturday, 25-Jan-2025 16:59:59 JST Rich Felker

     in reply to

     @bert_hubert You're nowhere near harsh enough on the "changing norms" that are direct violations of consent and entirely one-sided, not agreed upon by parties on both sides.

   • Embed this notice
     Rich Felker (dalias@hachyderm.io)'s status on Saturday, 25-Jan-2025 17:01:24 JST Rich Felker

     in reply to

     @bert_hubert In your specific example here, Microsoft should be criminally prosecuted in US under CFAA, for using someone else's credentials to log in without authorization.