Notices by Ben Aveling (benaveling@infosec.exchange)

Relevant: https://jorts.horse/@ecosurrealism/114088955703056555

@Frantasaur @charleekress @broadwaybabyto

#aposematism

Did you use AI to generate the article? @troyhunt @dalias

@patrickcmiller Need scare quotes around "reasons"

@Uair @feld cold weather does cause colds, via precisely the mechanism you identified. Old wives are worth listening to.

With apologies to Benjamin Schwartz. #NewYorkerCartoons #NewYorkerCartoonsUpdated #fads #AI #Crypto #Quantum #Hype #VC

@adamshostack They spend more on lawyers than they spend on security.

@pluralistic @Starkimarm
Wolf: let me explain why fences are bad for sheep

@patrickcmiller It's almost as if being a Nazi's disqualifies you from having a sense of humour.

@hramrach engagement based on anger is a sugar hit. It’s real, and compelling in the moment. But it also makes visiting whatever site less attractive @mekkaokereke @UP8 @dalias

@ryanc I found it here https://www.manufactum.com/door-mat-wire-mesh-a88879/
I haven't checked if they'd deliver it to where you are, but I assume you can find something similar locally anyway.
@gsuberland

@ryanc I've seen people using a wire mat under a conventional mat.
But there are also a sort of combined thing available that possibly works better.
@gsuberland

@GossiTheDog @iaintshootinmis we’re told there’s some simple mitigations that will be included in the announcement on the 6th.
Probably worth scheduling someone to watch for those, with stakeholder contact details and access to whatever mgt tooling you use for deploying changes/running commands across the fleet.
For some companies that means scheduling a change/outage window, so there might be some prep required for that.
#EvilSocket #EvilSocketVuln

@jeffowski They will never admit they were fooled. They will however magically pivot to never having supported him.

@mcc I got a HD in 1st year quantum physics. I understood nothing about quantum physics, but I could apply the formulae.

@ryanc Looking around, current consensus seems to be that if quantum ever happens, then ECDH is not going to be resistant.
On the other paw, 1. it's not clear that quantum will happen (because noise) and 2. even if we were sure that quantum will happen, it's not clear that any of the current alternatives are better.
Perhaps the old adage still holds, the only enduring secret is the one that isn't written down.
@ada

@ryanc if you’re mitm’d then it doesn’t matter how good your password is…

@ryanc how did we segue to phishing?

@ryanc interesting.
back of the envelope calculation for that attack, assuming 6 letter words, chosen randomly, 3 letters, chosen randomly, 5 guesses, attacker has full knowledge of those 3 letters => almost 70% chance of guessing.
Much harder if the attacker knows the letters but not the exact locations.
Also a lot harder if the bank is deliberate in its choosing of letters rather than completely random - many words have some combination of 3 letters that are a complete 100% giveaway and other combinations that are very much not.

@ryanc … but you only get a few wrong guesses before it locks.

@aris @ryanc …implies that it must have happened repeatedly.