Elektrine
Log in Register

#security

1769 posts · Last used 8m

ell1e coding things @ell1e@hachyderm.io
· 15h ago
Replying to
@rmondello@hachyderm.io I find the #attestation part of that article is actually fair in some aspects. Hardware attestation seems fundamentally #antiuser to me and is typically done via #closedsource #security theater. And I'm not the only one: https://www.gnu.org/philosophy/can-you-trust.html While #TOTP is fishable, and the article is weaker for not acknowledging it, I think there is a point to be made that it still is a useful defense against other threat models and has therefore arguably more than zero increased value - whether that makes it "great" or not. Some of us are of the opinion that if #passkeys aren't some trusted computing scheme, perhaps hardware #DRM shouldn't be part of the standard. Beyond at most cheap separate portable hardware key dongles (and even those seem questionable to me as a possibly enforced item). Yet #TPM attestation is in there: https://www.w3.org/TR/webauthn-2/#sctn-tpm-attestation I also find the claim that the writer of the article isn't "understanding the topic being discussed" is weakening your points! Nevertheless, your insight was useful and I appreciate you entering the discussion. #security #TOTP #passkeys
gnu.org

Can You Trust Your Computer? - GNU Project - Free Software Foundation

2
1
1
0
Owl Owl OÜ @ooo@c.im
· 3mo ago
AI did not create the FFmpeg MagicYUV bug. But it did create the patch race: faster discovery, faster reports, faster releases, and the same old human bottleneck of verifying what is actually running. Mastodon 4.6.2 was basically a one-line FFmpeg Dockerfile update. That tiny change says a lot. https://s.ee/5b6J #OpenSource #Security #Mastodon #AI
AI Did Not Create the Vulnerabilities. It Created the Patch Race.
Owl Owl OÜ

AI Did Not Create the Vulnerabilities. It Created the Patch Race.

Mastodon's FFmpeg-only 4.6.2 release shows the real AI-era security problem: patches now move faster than many operators can verify them.

2
0
1
1
Mysk🇨🇦🇩🇪 @mysk@mastodon.social
· 2mo ago
🚨 We're disclosing a macOS security bug that Apple says is not an issue. Using a simple archive-and-restore trick, an attacker can silently replace the main executable of virtually any application downloaded from the web—no password or warning is required. Here's a demo using Signal to steal its encryption key. 📝 Blog with technical details: link in the replies. Do you think this should be considered a security bug? 🎬👇 #Apple #privacy #infosec #security #macOS https://youtu.be/0bOC8S3NQxI

macOS Security: Replacing Trusted App Executables (Demo with Signal)

28
0
31
1
― @grahamperrin@mastodon.bsd.cafe
· 2mo ago
Innovation Labs by Identity Digital Convenes Infrastructure, Security, and Finance Leaders to Help Shape Accountability Framework for AI Agents https://www.globenewswire.com/news-release/2026/06/30/3319580/0/en/innovation-labs-by-identity-digital-convenes-infrastructure-security-and-finance-leaders-to-help-shape-accountability-framework-for-ai-agents.html ― Developing response to growing challenge in AI: establishing persistent ownership and accountability for agents operating across platforms, organizations, and environments ― David Conrad, Charles Ryan, Paul Sagan, Teresa Shea and Corey Thomas among founding members of Advisory Council following the launch of DNSid #AI #DNSid #accountability #Internet #infrastructure #agent #security #finance
globenewswire.com
0
0
0
1
moltenbit @moltenbit@infosec.exchange
· 4mo ago

I audited #OpenReception, a recently released open-source appointment booking platform. Found and reported 16 vulnerabilities, now 16 CVEs assigned.

4 critical:

  • WebAuthn passkey injection → account takeover
  • tenant admin self-promotes to GLOBAL_ADMIN
  • unauth GLOBAL_ADMIN account creation
  • staff crypto poisoning breaks the E2E recipient directory

rest: info disclosure, stored XSS, auth and IDOR bugs, all patched before public disclosure.

https://moltenbit.net/disclosures/

#infosec #security #CVE

moltenbit

Security Research

Coordinated disclosures by moltenbit: CVEs, advisories, and acknowledgments across helpdesk software, endpoint agents, and end-to-end-encrypted platforms.

2
0
0
1
heise Security @heisec@social.heise.de
· 3mo ago
Kundendaten bei Dienstleister abgeflossen: Datenschutzvorfall beim Lidl-Shop Unbekannte konnten auf eine Datei mit Kundendaten zugreifen und stahlen persönliche Kundendaten. Lidl hat reagiert und betroffene Kunden angeschrieben. https://www.heise.de/news/Kundendaten-bei-Dienstleister-abgeflossen-Datenschutzvorfall-beim-Lidl-Shop-11361337.html?wt_mc=sm.red.ho.mastodon.mastodon.md_beitraege.md_beitraege&utm_source=mastodon #Datenbanken #IT #Security #news
Kundendaten bei Dienstleister abgeflossen: Datenschutzvorfall beim Lidl-Shop
Security

Kundendaten bei Dienstleister abgeflossen: Datenschutzvorfall beim Lidl-Shop

Unbekannte konnten auf eine Datei mit Kundendaten zugreifen und stahlen persönliche Kundendaten. Lidl hat reagiert und betroffene Kunden angeschrieben.

16
0
17
2
NLnet Labs @nlnetlabs@social.nlnetlabs.nl
· 2mo ago
Another Unbound security release is now available, addressing a large set of multi-vendor vulnerabilities. In total, Unbound 1.25.2 fixes 24 CVEs. Many thanks to the security researchers who responsibly reported these issues. Release details: https://community.nlnetlabs.nl/t/unbound-1-25-2-released/3430 #DNS #DNSSEC #Security
Unbound 1.25.2 released
NLnet Labs Community

Unbound 1.25.2 released

Hi, Unbound 1.25.2 is available: https://nlnetlabs.nl/downloads/unbound/unbound-1.25.2.tar.gz sha256 0d92275c703d5f5f8baba3dab22117dd8c29b495588a5c229768ed6581566600 pgp https://nlnetlabs.nl/downloads/unbound/unbound-1.25.2.tar.gz.asc This release has a number of security fixes. The release is signed with the OpenPGP software signing key that is in use since Jan 1st 2026: User ID: NLnet Labs releases signing key G2 releases@nlnetlabs.nl Key ID: A144 323D EAAC DF45 Fingerprint: 2310 1869

12
0
12
1
Félicien Breton @breton@mstdn.social
· 31mo ago
Replying to on mstdn.social
  1. Incommunicado detention

"In normal times, a person who is targeted by the Israeli Security Agency, is arrested by the military, then taken into interrogation in a specific location operated by the I.S.A. […] "But those are the cases that we would learn about only months from now because all of them are still denied counsel. The I.S.A. does not allow visitors, and we’re unable to reach them."

#secrecy #services #secretAgents #security #counterTerrorism #israel #israelPalestine #warCrimes

0
10
0
0
ProPublica @ProPublica@newsie.social
· 3d ago
Boosted by @trending@homestead.social
NEW: Records show Texas Attorney General Ken Paxton has taken nearly 1,000 trips during his tenure, costing $3.3 million in security. We could only connect 138 of those trips and $553,000 in security costs to state business. https://www.propublica.org/article/ken-paxton-travel-security-costs?utm_source=mastodon&utm_medium=social&utm_campaign=mastodon-post#News #KenPaxton #Texas #TX #USPolitics #Security #Travel #Money #Ethics
Ken Paxton’s Security for Travel Cost Taxpayers Millions. Just 1 in 6 of His Trips Had a Stated Business Purpose.
ProPublica

Ken Paxton’s Security for Travel Cost Taxpayers Millions. Just 1 in 6 of His Trips Had a Stated Business Purpose.

Records show the Texas attorney general has taken nearly 1,000 trips during his tenure, costing $3.3 million in security. We could only connect 138 of those trips and $553,000 in security costs to state business.

68
6
134
2
Giorgio Maone 🚫✊🧅 @ma1@todon.eu
· 3d ago
Boosted by @gvenema@fairmove.net
The best possible #security for @FirefoxOfficial@mastodon.social -based, #chromium -based and @torproject@mastodon.social#browsers 🚫🧅. Thank you @OpenTechFund@mastodon.social for funding this independent @noscript@mastodon.social audit ❤️ https://www.opentech.fund/security-safety-audits/noscript-security-suite/
NoScript Security Suite
OTF

NoScript Security Suite

NoScript Security Suite is a free, open source security extension that provides extra protection for Firefox-based and Chromium-based browsers by making sure JavaScript, Flash, and other executable content run only from trusted domains.

7
0
2
1