Shakedown Social

Erik van Straten<a href="https://social.wildeboer.net/@jwildeboer" class="u-url mention" rel="nofollow noopener" target="_blank">@jwildeboer</a> : modern certificates are used for authentication only, not for secure connections.OTOH, if you have no certainty that your software is communicating with the server you intended, a secure connection to it is pointless - but the connection remains secure.Using TLS v1.3, the connection is even secured before the server is authenticated (if, after encrypting the connection, the authentication of the server fails, then the client should at least warn the user - if not immediately disconnect).Yes, I know, these are boring details, but they are misunderstood way too often by people who SHOULD know how this works (I know you do, but please don't simplify things too much). <a href="https://infosec.exchange/tags/TLS" class="mention hashtag" rel="nofollow noopener" target="_blank">#TLS</a> <a href="https://infosec.exchange/tags/https" class="mention hashtag" rel="nofollow noopener" target="_blank">#https</a> <a href="https://infosec.exchange/tags/X509" class="mention hashtag" rel="nofollow noopener" target="_blank">#X509</a> <a href="https://infosec.exchange/tags/Certificates" class="mention hashtag" rel="nofollow noopener" target="_blank">#Certificates</a> <a href="https://infosec.exchange/tags/Certs" class="mention hashtag" rel="nofollow noopener" target="_blank">#Certs</a> <a href="https://infosec.exchange/tags/Identification" class="mention hashtag" rel="nofollow noopener" target="_blank">#Identification</a> <a href="https://infosec.exchange/tags/Authentication" class="mention hashtag" rel="nofollow noopener" target="_blank">#Authentication</a> <a href="https://infosec.exchange/tags/Impersonation" class="mention hashtag" rel="nofollow noopener" target="_blank">#Impersonation</a> <a href="https://infosec.exchange/tags/TLSv1_3" class="mention hashtag" rel="nofollow noopener" target="_blank">#TLSv1_3</a> <a href="https://infosec.exchange/tags/ForwardSecrecy" class="mention hashtag" rel="nofollow noopener" target="_blank">#ForwardSecrecy</a> <a href="https://infosec.exchange/tags/DH" class="mention hashtag" rel="nofollow noopener" target="_blank">#DH</a> <a href="https://infosec.exchange/tags/DHE" class="mention hashtag" rel="nofollow noopener" target="_blank">#DHE</a> <a href="https://infosec.exchange/tags/DiffieHellman" class="mention hashtag" rel="nofollow noopener" target="_blank">#DiffieHellman</a>

IT NewsOpenAI’s ChatGPT Agent casually clicks through “I am not a robot” verification test - Maybe they should change the button to say, "I am a robot"? ... - <a href="https://arstechnica.com/information-technology/2025/07/openais-chatgpt-agent-casually-clicks-through-i-am-not-a-robot-verification-test/" rel="nofollow noopener" translate="no" target="_blank">https://arstechnica.com/information-technology/2025/07/openais-chatgpt-agent-casually-clicks-through-i-am-not-a-robot-verification-test/</a> <a href="https://schleuss.online/tags/computer" class="mention hashtag" rel="nofollow noopener" target="_blank">#computer</a>-usingagent <a href="https://schleuss.online/tags/aidevelopmenttools" class="mention hashtag" rel="nofollow noopener" target="_blank">#aidevelopmenttools</a> <a href="https://schleuss.online/tags/computerusemodel" class="mention hashtag" rel="nofollow noopener" target="_blank">#computerusemodel</a> <a href="https://schleuss.online/tags/machinelearning" class="mention hashtag" rel="nofollow noopener" target="_blank">#machinelearning</a> <a href="https://schleuss.online/tags/authentication" class="mention hashtag" rel="nofollow noopener" target="_blank">#authentication</a> <a href="https://schleuss.online/tags/websecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#websecurity</a> <a href="https://schleuss.online/tags/aibehavior" class="mention hashtag" rel="nofollow noopener" target="_blank">#aibehavior</a> <a href="https://schleuss.online/tags/aisecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#aisecurity</a> <a href="https://schleuss.online/tags/cloudflare" class="mention hashtag" rel="nofollow noopener" target="_blank">#cloudflare</a> <a href="https://schleuss.online/tags/agenticai" class="mention hashtag" rel="nofollow noopener" target="_blank">#agenticai</a> <a href="https://schleuss.online/tags/aiagents" class="mention hashtag" rel="nofollow noopener" target="_blank">#aiagents</a> <a href="https://schleuss.online/tags/captcha" class="mention hashtag" rel="nofollow noopener" target="_blank">#captcha</a> <a href="https://schleuss.online/tags/chatgpt" class="mention hashtag" rel="nofollow noopener" target="_blank">#chatgpt</a> <a href="https://schleuss.online/tags/biz" class="mention hashtag" rel="nofollow noopener" target="_blank">#biz</a>⁢ <a href="https://schleuss.online/tags/openai" class="mention hashtag" rel="nofollow noopener" target="_blank">#openai</a> <a href="https://schleuss.online/tags/ai" class="mention hashtag" rel="nofollow noopener" target="_blank">#ai</a>

🧿🪬🍄🌈🎮💻🚲🥓🎃💀🏴🛻🇺🇸> <a href="https://mastodon.social/tags/Google" class="mention hashtag" rel="nofollow noopener" target="_blank">#Google</a> informed me that I already had a <a href="https://mastodon.social/tags/passkey" class="mention hashtag" rel="nofollow noopener" target="_blank">#passkey</a> on my device. If that's the case, why didn't it work when I attempted to log into my Google account on the tablet? When I was logging into the tablet, Google should have been aware I had <a href="https://mastodon.social/tags/passkeys" class="mention hashtag" rel="nofollow noopener" target="_blank">#passkeys</a> on my Pixel 9 Pro and request <a href="https://mastodon.social/tags/authentication" class="mention hashtag" rel="nofollow noopener" target="_blank">#authentication</a> with either a fingerprint or face scan. It didn't. No passkey was recognized… even though it's there.> It's a recursive nightmare from which I can't seem to escape.<a href="https://www.zdnet.com/article/passkeys-wont-be-ready-for-primetime-until-google-and-other-companies-fix-this/" rel="nofollow noopener" translate="no" target="_blank">https://www.zdnet.com/article/passkeys-wont-be-ready-for-primetime-until-google-and-other-companies-fix-this/</a><a href="https://mastodon.social/tags/security" class="mention hashtag" rel="nofollow noopener" target="_blank">#security</a>

Grumpy WebsiteThis dialog always confuses me. I have to read small print to really understand what does it want<a href="https://mastodon.online/tags/Apple" class="mention hashtag" rel="nofollow noopener" target="_blank">#Apple</a> <a href="https://mastodon.online/tags/macOS" class="mention hashtag" rel="nofollow noopener" target="_blank">#macOS</a> <a href="https://mastodon.online/tags/Dialog" class="mention hashtag" rel="nofollow noopener" target="_blank">#Dialog</a> <a href="https://mastodon.online/tags/VisualHierarchy" class="mention hashtag" rel="nofollow noopener" target="_blank">#VisualHierarchy</a> <a href="https://mastodon.online/tags/Fingerprint" class="mention hashtag" rel="nofollow noopener" target="_blank">#Fingerprint</a> <a href="https://mastodon.online/tags/Authentication" class="mention hashtag" rel="nofollow noopener" target="_blank">#Authentication</a>

Mad A. Argon :qurio:Thought it is high time to finally set <a href="https://is-a.cat/tags/2FA" class="mention hashtag" rel="nofollow noopener" target="_blank">#2FA</a> on my <a href="https://is-a.cat/tags/DeviantArt" class="mention hashtag" rel="nofollow noopener" target="_blank">#DeviantArt</a> account... Turned out it's premium feature for paid accounts :neocatBlushHide:<a href="https://is-a.cat/tags/security" class="mention hashtag" rel="nofollow noopener" target="_blank">#security</a> <a href="https://is-a.cat/tags/authentication" class="mention hashtag" rel="nofollow noopener" target="_blank">#authentication</a>

Teodor Sandu<a href="https://mastodon.online/tags/funny" class="mention hashtag" rel="nofollow noopener" target="_blank">#funny</a> <a href="https://mastodon.online/tags/meme" class="mention hashtag" rel="nofollow noopener" target="_blank">#meme</a> <a href="https://mastodon.online/tags/authentication" class="mention hashtag" rel="nofollow noopener" target="_blank">#authentication</a> <a href="https://mastodon.online/tags/security" class="mention hashtag" rel="nofollow noopener" target="_blank">#security</a> <a href="https://mastodon.online/tags/it" class="mention hashtag" rel="nofollow noopener" target="_blank">#it</a> <a href="https://mastodon.online/tags/programming" class="mention hashtag" rel="nofollow noopener" target="_blank">#programming</a> <a href="https://mastodon.online/tags/development" class="mention hashtag" rel="nofollow noopener" target="_blank">#development</a> <a href="https://mastodon.online/tags/fun" class="mention hashtag" rel="nofollow noopener" target="_blank">#fun</a> <a href="https://mastodon.online/tags/memes" class="mention hashtag" rel="nofollow noopener" target="_blank">#memes</a> <a href="https://mastodon.online/tags/joke" class="mention hashtag" rel="nofollow noopener" target="_blank">#joke</a> <a href="https://mastodon.online/tags/jokes" class="mention hashtag" rel="nofollow noopener" target="_blank">#jokes</a> <a href="https://mastodon.online/tags/dev" class="mention hashtag" rel="nofollow noopener" target="_blank">#dev</a> <a href="https://mastodon.online/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#cybersecurity</a> <a href="https://mastodon.online/tags/hacking" class="mention hashtag" rel="nofollow noopener" target="_blank">#hacking</a>

Erik van Straten<a href="https://mastodon.ar.al/@aral" class="u-url mention" rel="nofollow noopener" target="_blank">@aral</a> wrote: "If your friends and family are trying to phish you, you have bigger problems."Phishing means that an adversary *claiming to be* someone you know (including friends and family) convinces you to click on a link.The purpose of a certificate, telling a receiver *WHO* (human readable) owns the associated private key (the last resort to distinguish between fake and authentic), now has completely vanished.As if phishing is not already the nr. 1 problem on the internet.Note: I'm fine with the idea provided that browsers clearly inform users about the reliability of authenticity (I've read your article, did you read <a href="https://infosec.exchange/@ErikvanStraten/113079966331873386" rel="nofollow noopener" translate="no" target="_blank">https://infosec.exchange/@ErikvanStraten/113079966331873386</a> ?)<a href="https://infosec.exchange/@letsencrypt" class="u-url mention" rel="nofollow noopener" target="_blank">@letsencrypt</a> <a href="https://infosec.exchange/tags/Phishing" class="mention hashtag" rel="nofollow noopener" target="_blank">#Phishing</a> <a href="https://infosec.exchange/tags/LetsEncrypt" class="mention hashtag" rel="nofollow noopener" target="_blank">#LetsEncrypt</a> <a href="https://infosec.exchange/tags/DNS" class="mention hashtag" rel="nofollow noopener" target="_blank">#DNS</a> <a href="https://infosec.exchange/tags/DomainNames" class="mention hashtag" rel="nofollow noopener" target="_blank">#DomainNames</a> <a href="https://infosec.exchange/tags/Identification" class="mention hashtag" rel="nofollow noopener" target="_blank">#Identification</a> <a href="https://infosec.exchange/tags/Authentication" class="mention hashtag" rel="nofollow noopener" target="_blank">#Authentication</a>

Shubham Tiwari🚀 Mastering API Handling in React & Vanilla JS – One Step at a Time!This week, I deep-dived into handling APIs in React and Vanilla JavaScript – not just fetching data, but doing it efficiently and securely which includes: Fetch, CRUD, Query Params, Auth, and AbortController Explained<a href="https://mastodon.social/tags/ReactJS" class="mention hashtag" rel="nofollow noopener" target="_blank">#ReactJS</a> <a href="https://mastodon.social/tags/JavaScript" class="mention hashtag" rel="nofollow noopener" target="_blank">#JavaScript</a> <a href="https://mastodon.social/tags/WebDevelopment" class="mention hashtag" rel="nofollow noopener" target="_blank">#WebDevelopment</a> <a href="https://mastodon.social/tags/Frontend" class="mention hashtag" rel="nofollow noopener" target="_blank">#Frontend</a> <a href="https://mastodon.social/tags/APIs" class="mention hashtag" rel="nofollow noopener" target="_blank">#APIs</a> <a href="https://mastodon.social/tags/AbortController" class="mention hashtag" rel="nofollow noopener" target="_blank">#AbortController</a> <a href="https://mastodon.social/tags/Authentication" class="mention hashtag" rel="nofollow noopener" target="_blank">#Authentication</a> <a href="https://mastodon.social/tags/Authorization" class="mention hashtag" rel="nofollow noopener" target="_blank">#Authorization</a> <a href="https://mastodon.social/tags/AsyncAwait" class="mention hashtag" rel="nofollow noopener" target="_blank">#AsyncAwait</a> <a href="https://mastodon.social/tags/LinkedInLearning" class="mention hashtag" rel="nofollow noopener" target="_blank">#LinkedInLearning</a> <a href="https://mastodon.social/tags/100DaysOfCode" class="mention hashtag" rel="nofollow noopener" target="_blank">#100DaysOfCode</a><a href="https://dev.to/shubhamtiwari909/handling-apis-in-frontend-a-complete-guide-fmo" rel="nofollow noopener" translate="no" target="_blank">https://dev.to/shubhamtiwari909/handling-apis-in-frontend-a-complete-guide-fmo</a>

Eduardo Padoan"The author of this library would like everyone to know that he was, in fact, well-aware of this requirement, thought about it a lot while designing the library, and then, somehow, forgot to actually make sure the check was in the code. That is, it's not that he didn't know what he was doing, it's that he knew what he was doing but flubbed it." <a href="https://mastodon.coffee/tags/GenAI" class="mention hashtag" rel="nofollow noopener" target="_blank">#GenAI</a> <a href="https://mastodon.coffee/tags/LLM" class="mention hashtag" rel="nofollow noopener" target="_blank">#LLM</a> <a href="https://mastodon.coffee/tags/Cloudfare" class="mention hashtag" rel="nofollow noopener" target="_blank">#Cloudfare</a> <a href="https://mastodon.coffee/tags/Security" class="mention hashtag" rel="nofollow noopener" target="_blank">#Security</a> <a href="https://mastodon.coffee/tags/CodeAssistants" class="mention hashtag" rel="nofollow noopener" target="_blank">#CodeAssistants</a> <a href="https://mastodon.coffee/tags/Copilot" class="mention hashtag" rel="nofollow noopener" target="_blank">#Copilot</a> <a href="https://mastodon.coffee/tags/Agentic" class="mention hashtag" rel="nofollow noopener" target="_blank">#Agentic</a> <a href="https://mastodon.coffee/tags/CVE" class="mention hashtag" rel="nofollow noopener" target="_blank">#CVE</a> <a href="https://mastodon.coffee/tags/Authentication" class="mention hashtag" rel="nofollow noopener" target="_blank">#Authentication</a> <a href="https://mastodon.coffee/tags/FOSS" class="mention hashtag" rel="nofollow noopener" target="_blank">#FOSS</a> <a href="https://nvd.nist.gov/vuln/detail/cve-2025-4143" rel="nofollow noopener" translate="no" target="_blank">https://nvd.nist.gov/vuln/detail/cve-2025-4143</a>

🧿🪬🍄🌈🎮💻🚲🥓🎃💀🏴🛻🇺🇸<a href="https://mastodon.social/tags/Passkeys" class="mention hashtag" rel="nofollow noopener" target="_blank">#Passkeys</a> are for people who only use one device to access the Internet, or multiple devices that are all made by AAPL/GOOG.If you use Firefox on Ubuntu, Edge on Windows, Safari on Mac OS, and Chrome on ChromeOS you will have a bad time.<a href="https://mastodon.social/tags/webauthn" class="mention hashtag" rel="nofollow noopener" target="_blank">#webauthn</a> <a href="https://mastodon.social/tags/fido2" class="mention hashtag" rel="nofollow noopener" target="_blank">#fido2</a> <a href="https://mastodon.social/tags/passkey" class="mention hashtag" rel="nofollow noopener" target="_blank">#passkey</a> <a href="https://mastodon.social/tags/auth" class="mention hashtag" rel="nofollow noopener" target="_blank">#auth</a> <a href="https://mastodon.social/tags/authentication" class="mention hashtag" rel="nofollow noopener" target="_blank">#authentication</a>

🧿🪬🍄🌈🎮💻🚲🥓🎃💀🏴🛻🇺🇸Explain <a href="https://mastodon.social/tags/passkeys" class="mention hashtag" rel="nofollow noopener" target="_blank">#passkeys</a> to me like I'm your grandparents.<a href="https://mastodon.social/tags/2fa" class="mention hashtag" rel="nofollow noopener" target="_blank">#2fa</a> <a href="https://mastodon.social/tags/authentication" class="mention hashtag" rel="nofollow noopener" target="_blank">#authentication</a> <a href="https://mastodon.social/tags/security" class="mention hashtag" rel="nofollow noopener" target="_blank">#security</a> <a href="https://mastodon.social/tags/fido" class="mention hashtag" rel="nofollow noopener" target="_blank">#fido</a> <a href="https://mastodon.social/tags/webauthn" class="mention hashtag" rel="nofollow noopener" target="_blank">#webauthn</a> <a href="https://mastodon.social/tags/fido2" class="mention hashtag" rel="nofollow noopener" target="_blank">#fido2</a> <a href="https://mastodon.social/tags/otp" class="mention hashtag" rel="nofollow noopener" target="_blank">#otp</a> <a href="https://mastodon.social/tags/yubikey" class="mention hashtag" rel="nofollow noopener" target="_blank">#yubikey</a> <a href="https://mastodon.social/tags/password" class="mention hashtag" rel="nofollow noopener" target="_blank">#password</a> <a href="https://mastodon.social/tags/auth" class="mention hashtag" rel="nofollow noopener" target="_blank">#auth</a>

Ethan ShollySelf-Host Weekly (6 June 2025)Open-sourced government apps, software updates and launches, a spotlight on <a href="https://fosstodon.org/tags/Tinyauth" class="mention hashtag" rel="nofollow noopener" target="_blank">#Tinyauth</a> -- a simple <a href="https://fosstodon.org/tags/authentication" class="mention hashtag" rel="nofollow noopener" target="_blank">#authentication</a> middleware, and more in this week's self-hosted recap!<a href="https://selfh.st/weekly/2025-06-06/" rel="nofollow noopener" translate="no" target="_blank">https://selfh.st/weekly/2025-06-06/</a><a href="https://fosstodon.org/tags/selfhost" class="mention hashtag" rel="nofollow noopener" target="_blank">#selfhost</a> <a href="https://fosstodon.org/tags/selfhosted" class="mention hashtag" rel="nofollow noopener" target="_blank">#selfhosted</a> <a href="https://fosstodon.org/tags/selfhosting" class="mention hashtag" rel="nofollow noopener" target="_blank">#selfhosting</a> <a href="https://fosstodon.org/tags/newsletter" class="mention hashtag" rel="nofollow noopener" target="_blank">#newsletter</a> <a href="https://fosstodon.org/tags/opensource" class="mention hashtag" rel="nofollow noopener" target="_blank">#opensource</a> <a href="https://fosstodon.org/tags/foss" class="mention hashtag" rel="nofollow noopener" target="_blank">#foss</a> <a href="https://fosstodon.org/tags/homelab" class="mention hashtag" rel="nofollow noopener" target="_blank">#homelab</a> <a href="https://fosstodon.org/tags/homeserver" class="mention hashtag" rel="nofollow noopener" target="_blank">#homeserver</a> <a href="https://fosstodon.org/tags/privacy" class="mention hashtag" rel="nofollow noopener" target="_blank">#privacy</a> <a href="https://fosstodon.org/tags/nextcloud" class="mention hashtag" rel="nofollow noopener" target="_blank">#nextcloud</a> <a href="https://fosstodon.org/tags/raspberrypi" class="mention hashtag" rel="nofollow noopener" target="_blank">#raspberrypi</a> <a href="https://fosstodon.org/tags/irs" class="mention hashtag" rel="nofollow noopener" target="_blank">#irs</a> <a href="https://fosstodon.org/tags/dumbassets" class="mention hashtag" rel="nofollow noopener" target="_blank">#dumbassets</a>

Lars WirzeniusIf your software stores passwords in a way that they can be retrieved, and your software isn't a password manager, your software is broken.Verifying that a password provided by a user is correct does not require you to store the password. As an industry we knew this in 1978. It has been 0 days since I saw software that violates this.<a href="https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html" rel="nofollow noopener" translate="no" target="_blank">https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html</a><a href="https://toot.liw.fi/tags/security" class="mention hashtag" rel="nofollow noopener" target="_blank">#security</a> <a href="https://toot.liw.fi/tags/password" class="mention hashtag" rel="nofollow noopener" target="_blank">#password</a> <a href="https://toot.liw.fi/tags/passwordStorage" class="mention hashtag" rel="nofollow noopener" target="_blank">#passwordStorage</a> <a href="https://toot.liw.fi/tags/authentication" class="mention hashtag" rel="nofollow noopener" target="_blank">#authentication</a> <a href="https://toot.liw.fi/tags/rant" class="mention hashtag" rel="nofollow noopener" target="_blank">#rant</a>

Frontend DogmaPasskeys for Normal People, by <a href="https://infosec.exchange/@troyhunt" class="u-url mention" rel="nofollow noopener" target="_blank">@troyhunt</a>:<a href="https://www.troyhunt.com/passkeys-for-normal-people/" rel="nofollow noopener" translate="no" target="_blank">https://www.troyhunt.com/passkeys-for-normal-people/</a><a href="https://mas.to/tags/security" class="mention hashtag" rel="nofollow noopener" target="_blank">#security</a> <a href="https://mas.to/tags/authentication" class="mention hashtag" rel="nofollow noopener" target="_blank">#authentication</a> <a href="https://mas.to/tags/passkeys" class="mention hashtag" rel="nofollow noopener" target="_blank">#passkeys</a> <a href="https://mas.to/tags/examples" class="mention hashtag" rel="nofollow noopener" target="_blank">#examples</a> <a href="https://mas.to/tags/concepts" class="mention hashtag" rel="nofollow noopener" target="_blank">#concepts</a>

Erik van Straten🚨 Identity fraud on MastodonJust a reminder that there is a lot of identity fraud happening on the internet, increasingly on Mastodon as well.Often impersonators are easy to detect (like the ones below) - but sometimes existing accounts are taken over by criminals. Always keep in mind that someone on the internet interacting with you may (currently) not be who they claim to be.This includes my account. If it does not sound like me, it may not be me. Having doubts and double checking are good habits. Reputation (good or bad) is a useful property for knowing who you're dealing with, and to help detect anomalies.Accounts with a few or 0 followers, and hardly any or just plain pointless toots, may be bots or criminals coming after your money.If someone appears to only follow random Mastodonts with lots of followers, either they're noobs or they're here with less friendly intentions. If they then start following possibly lonely people, they *may* be trying to gain their attention and trust - maybe for nefarious purposes.🤔 Recently the following people started following the automated channel <a href="https://mastodon.world/@auschwitzmuseum/followers" rel="nofollow noopener" translate="no" target="_blank">https://mastodon.world/@auschwitzmuseum/followers</a>:Kendal Jenner [1] Jennifer Aniston [2] Stephen King [3] Keanu Reeves [4] Keanu Reeves [5]They all abuse the pictures of the real persons they impersonate (they're not just following the Auschwitz Memorial BTW).[1] <a href="https://mastodon.social/@kendall01/following" rel="nofollow noopener" translate="no" target="_blank">https://mastodon.social/@kendall01/following</a> [2] <a href="https://mastodon.social/@Jenniferaniston123/following" rel="nofollow noopener" translate="no" target="_blank">https://mastodon.social/@Jenniferaniston123/following</a> [3] <a href="https://mastodon.social/@Stevenkvng/following" rel="nofollow noopener" translate="no" target="_blank">https://mastodon.social/@Stevenkvng/following</a> [4] <a href="https://mastodon.social/@keanureeves1928/following" rel="nofollow noopener" translate="no" target="_blank">https://mastodon.social/@keanureeves1928/following</a> [5] <a href="https://mastodon.social/@reeves001/following" rel="nofollow noopener" translate="no" target="_blank">https://mastodon.social/@reeves001/following</a> (screenshot below)<a href="https://infosec.exchange/tags/IdentityFraud" class="mention hashtag" rel="nofollow noopener" target="_blank">#IdentityFraud</a> <a href="https://infosec.exchange/tags/Impersonation" class="mention hashtag" rel="nofollow noopener" target="_blank">#Impersonation</a> <a href="https://infosec.exchange/tags/Authentication" class="mention hashtag" rel="nofollow noopener" target="_blank">#Authentication</a> <a href="https://infosec.exchange/tags/Identity" class="mention hashtag" rel="nofollow noopener" target="_blank">#Identity</a> <a href="https://infosec.exchange/tags/IdentityVerification" class="mention hashtag" rel="nofollow noopener" target="_blank">#IdentityVerification</a> <a href="https://infosec.exchange/tags/Auschwitz" class="mention hashtag" rel="nofollow noopener" target="_blank">#Auschwitz</a>

Erik van Straten<a href="https://mastodon.ar.al/@aral" class="u-url mention" rel="nofollow noopener" target="_blank">@aral</a> : most Let's Encrypt (and other Domain Validated) certificates are issued to junk- or plain criminal websites.They're the ultimate manifestation of evil big tech.They were introduced to encrypt the "last mile" because Internet Service Providers were replacing ads in webpages and, in the other direction, inserting fake clicks.DV has destroyed the internet. People loose their ebank savings and companies get ransomwared; phishing is dead simple. EDIW/EUDIW will become an identity fraud disaster (because of AitM phishing atracks).Even the name "Let's Encrypt" is wrong for a CSP: nobody needs a certificate to encrypt a connection. The primary purpose of a certificate is AUTHENTICATION (of the owner of the private key, in this case the website).However, for human beings, just a domain name simply does not provide reliable identification information. It renders impersonation a peace of cake.Decent online authentication is HARD. Get used to it instead of denying it.REASONS/EXAMPLES🔹 Troy Hunt fell in the DV trap: <a href="https://infosec.exchange/@ErikvanStraten/114222237036021070" rel="nofollow noopener" translate="no" target="_blank">https://infosec.exchange/@ErikvanStraten/114222237036021070</a>🔹 Google (and Troy Hunt!) killed non-DV certs (for profit) because of the stripe.com PoC. Now Chrome does not give you any more info than what Google argumented: <a href="https://infosec.exchange/@ErikvanStraten/114224682101772569" rel="nofollow noopener" translate="no" target="_blank">https://infosec.exchange/@ErikvanStraten/114224682101772569</a>🔹 https:⧸⧸cancel-google.com/captcha was live yesterday: <a href="https://infosec.exchange/@ErikvanStraten/114224264440704546" rel="nofollow noopener" translate="no" target="_blank">https://infosec.exchange/@ErikvanStraten/114224264440704546</a>🔹 Stop phishing proposal: <a href="https://infosec.exchange/@ErikvanStraten/113079966331873386" rel="nofollow noopener" translate="no" target="_blank">https://infosec.exchange/@ErikvanStraten/113079966331873386</a>🔹 Lots of reasons why LE sucks: <a href="https://infosec.exchange/@ErikvanStraten/112914047006977222" rel="nofollow noopener" translate="no" target="_blank">https://infosec.exchange/@ErikvanStraten/112914047006977222</a> (corrected link 09:20 UTC)🔹 This website stopped registering junk .bond domain names, probably because there were too many every day (the last page I found): <a href="https://newly-registered-domains.abtdomain.com/2024-08-15-bond-newly-registered-domains-part-1/" rel="nofollow noopener" translate="no" target="_blank">https://newly-registered-domains.abtdomain.com/2024-08-15-bond-newly-registered-domains-part-1/</a>. However, this gang is still active, open the RELATIONS tab in <a href="https://www.virustotal.com/gui/ip-address/13.248.197.209/relations" rel="nofollow noopener" translate="no" target="_blank">https://www.virustotal.com/gui/ip-address/13.248.197.209/relations</a>. You have to multiply the number of LE certs by approx. 5 because they also register subdomains and don't use wildcard certs. Source: <a href="https://www.bleepingcomputer.com/news/security/revolver-rabbit-gang-registers-500-000-domains-for-malware-campaigns/" rel="nofollow noopener" translate="no" target="_blank">https://www.bleepingcomputer.com/news/security/revolver-rabbit-gang-registers-500-000-domains-for-malware-campaigns/</a><a href="https://ec.social-network.europa.eu/@EUCommission" class="u-url mention" rel="nofollow noopener" target="_blank">@EUCommission</a> <a href="https://infosec.exchange/@letsencrypt" class="u-url mention" rel="nofollow noopener" target="_blank">@letsencrypt</a> <a href="https://social.nlnet.nl/@nlnet" class="u-url mention" rel="nofollow noopener" target="_blank">@nlnet</a> <a href="https://infosec.exchange/tags/Authentication" class="mention hashtag" rel="nofollow noopener" target="_blank">#Authentication</a> <a href="https://infosec.exchange/tags/Impersonation" class="mention hashtag" rel="nofollow noopener" target="_blank">#Impersonation</a> <a href="https://infosec.exchange/tags/Spoofing" class="mention hashtag" rel="nofollow noopener" target="_blank">#Spoofing</a> <a href="https://infosec.exchange/tags/Phishing" class="mention hashtag" rel="nofollow noopener" target="_blank">#Phishing</a> <a href="https://infosec.exchange/tags/DV" class="mention hashtag" rel="nofollow noopener" target="_blank">#DV</a> <a href="https://infosec.exchange/tags/GoogleIsEvil" class="mention hashtag" rel="nofollow noopener" target="_blank">#GoogleIsEvil</a> <a href="https://infosec.exchange/tags/BigTechIsEvil" class="mention hashtag" rel="nofollow noopener" target="_blank">#BigTechIsEvil</a> <a href="https://infosec.exchange/tags/Certificates" class="mention hashtag" rel="nofollow noopener" target="_blank">#Certificates</a> <a href="https://infosec.exchange/tags/httpsVShttp" class="mention hashtag" rel="nofollow noopener" target="_blank">#httpsVShttp</a> <a href="https://infosec.exchange/tags/AitM" class="mention hashtag" rel="nofollow noopener" target="_blank">#AitM</a> <a href="https://infosec.exchange/tags/MitM" class="mention hashtag" rel="nofollow noopener" target="_blank">#MitM</a> <a href="https://infosec.exchange/tags/FakeWebsites" class="mention hashtag" rel="nofollow noopener" target="_blank">#FakeWebsites</a> <a href="https://infosec.exchange/tags/CloudflareIsEvil" class="mention hashtag" rel="nofollow noopener" target="_blank">#CloudflareIsEvil</a> <a href="https://infosec.exchange/tags/bond" class="mention hashtag" rel="nofollow noopener" target="_blank">#bond</a> <a href="https://infosec.exchange/tags/dotBond" class="mention hashtag" rel="nofollow noopener" target="_blank">#dotBond</a> <a href="https://infosec.exchange/tags/Spam" class="mention hashtag" rel="nofollow noopener" target="_blank">#Spam</a> <a href="https://infosec.exchange/tags/Infosec" class="mention hashtag" rel="nofollow noopener" target="_blank">#Infosec</a> <a href="https://infosec.exchange/tags/Ransomware" class="mention hashtag" rel="nofollow noopener" target="_blank">#Ransomware</a> <a href="https://infosec.exchange/tags/Banks" class="mention hashtag" rel="nofollow noopener" target="_blank">#Banks</a> <a href="https://infosec.exchange/tags/CloudflareIsEvil" class="mention hashtag" rel="nofollow noopener" target="_blank">#CloudflareIsEvil</a> <a href="https://infosec.exchange/tags/FakeWebsites" class="mention hashtag" rel="nofollow noopener" target="_blank">#FakeWebsites</a>

Grumpy WebsiteWe noticed you were working. How about you do a meaningless chore for us instead?<a href="https://mastodon.online/tags/Slack" class="mention hashtag" rel="nofollow noopener" target="_blank">#Slack</a> <a href="https://mastodon.online/tags/Login" class="mention hashtag" rel="nofollow noopener" target="_blank">#Login</a> <a href="https://mastodon.online/tags/Logout" class="mention hashtag" rel="nofollow noopener" target="_blank">#Logout</a> <a href="https://mastodon.online/tags/Authentication" class="mention hashtag" rel="nofollow noopener" target="_blank">#Authentication</a> <a href="https://mastodon.online/tags/Popup" class="mention hashtag" rel="nofollow noopener" target="_blank">#Popup</a> <a href="https://mastodon.online/tags/Timeout" class="mention hashtag" rel="nofollow noopener" target="_blank">#Timeout</a>

julian2FA codes sent over ActivityPub when?

Georgiana BrummellFirst, they shut down the Basic HTML site, forcing many of us to switch to clients such as Thunderbird. Now, they're using qr codes which are not only inaccessible to the blind but also to those who don't use smartphones! This is ridiculous! Yes, they do still have the option to click whether it's you trying to sign in or not (which still requires a smartphone and a carrier, which they claim to be concerned about), but how long before they remove that, too?<a href="https://www.pcmag.com/news/google-is-replacing-sms-codes-with-qr-codes-for-gmail-authentication" rel="nofollow noopener" target="_blank">pcmag.com/news/google-is-repla…</a><a href="https://friendica.world/search?tag=accessibility" class="mention hashtag" rel="nofollow noopener" target="_blank">#accessibility</a> <a href="https://friendica.world/search?tag=Android" class="mention hashtag" rel="nofollow noopener" target="_blank">#Android</a> <a href="https://friendica.world/search?tag=authentication" class="mention hashtag" rel="nofollow noopener" target="_blank">#authentication</a> <a href="https://friendica.world/search?tag=blind" class="mention hashtag" rel="nofollow noopener" target="_blank">#blind</a> <a href="https://friendica.world/search?tag=Google" class="mention hashtag" rel="nofollow noopener" target="_blank">#Google</a> <a href="https://friendica.world/search?tag=GMail" class="mention hashtag" rel="nofollow noopener" target="_blank">#GMail</a> <a href="https://friendica.world/search?tag=IOS" class="mention hashtag" rel="nofollow noopener" target="_blank">#IOS</a> <a href="https://friendica.world/search?tag=Narrator" class="mention hashtag" rel="nofollow noopener" target="_blank">#Narrator</a> <a href="https://friendica.world/search?tag=NVDA" class="mention hashtag" rel="nofollow noopener" target="_blank">#NVDA</a> <a href="https://friendica.world/search?tag=sms" class="mention hashtag" rel="nofollow noopener" target="_blank">#sms</a> <a href="https://friendica.world/search?tag=Talkback" class="mention hashtag" rel="nofollow noopener" target="_blank">#Talkback</a> <a href="https://friendica.world/search?tag=technology" class="mention hashtag" rel="nofollow noopener" target="_blank">#technology</a> <a href="https://friendica.world/search?tag=Voiceover" class="mention hashtag" rel="nofollow noopener" target="_blank">#Voiceover</a> <a href="https://friendica.world/search?tag=Windows" class="mention hashtag" rel="nofollow noopener" target="_blank">#Windows</a>

Aral BalkanNew Kitten release• Fixes redirection from sign-in page when person is already authenticated.<a href="https://kitten.small-web.org" rel="nofollow noopener" translate="no" target="_blank">https://kitten.small-web.org</a>To learn more about how Kitten automatically implements authentication for your Small Web sites and apps using public-key cryptography (so even your own server doesn’t know your secret)¹, please see the Authentication tutorial:<a href="https://kitten.small-web.org/tutorials/authentication/" rel="nofollow noopener" translate="no" target="_blank">https://kitten.small-web.org/tutorials/authentication/</a>Enjoy!:kitten:💕¹ The security (and privacy) of Domain/Kitten are based on a 32-byte cryptographically random secret string that only the person who owns/controls a domain knows.This is basically a Base256-encoded ed25519 secret key where the Base256 alphabet is a set of curated emoji surrogate pairs without any special modifiers chosen mainly from the animals, plants, and food groups with some exceptions (to avoid common phobias or triggers, etc.) that we call KittenMoji.…When setting up a Small Web app via Domain, this key is generated in the person’s browser, on their own computer, and is never communicated to either the Domain instance or the Kitten app being installed. Instead the ed25519 public key is sent to both and signed token authentication is used when the server needs to verify the owner’s identity (e.g., before allowing access to the administration area).The expected/encouraged behaviour is for the person to store this secret in their password manager of choice.More: <a href="https://kitten.small-web.org/reference/#cryptographic-properties" rel="nofollow noopener" translate="no" target="_blank">https://kitten.small-web.org/reference/#cryptographic-properties</a><a href="https://mastodon.ar.al/tags/Kitten" class="mention hashtag" rel="nofollow noopener" target="_blank">#Kitten</a> <a href="https://mastodon.ar.al/tags/SmallWeb" class="mention hashtag" rel="nofollow noopener" target="_blank">#SmallWeb</a> <a href="https://mastodon.ar.al/tags/SmallTech" class="mention hashtag" rel="nofollow noopener" target="_blank">#SmallTech</a> <a href="https://mastodon.ar.al/tags/authentication" class="mention hashtag" rel="nofollow noopener" target="_blank">#authentication</a> <a href="https://mastodon.ar.al/tags/publicKeyCryptography" class="mention hashtag" rel="nofollow noopener" target="_blank">#publicKeyCryptography</a> <a href="https://mastodon.ar.al/tags/web" class="mention hashtag" rel="nofollow noopener" target="_blank">#web</a> <a href="https://mastodon.ar.al/tags/dev" class="mention hashtag" rel="nofollow noopener" target="_blank">#dev</a> <a href="https://mastodon.ar.al/tags/NodeJS" class="mention hashtag" rel="nofollow noopener" target="_blank">#NodeJS</a> <a href="https://mastodon.ar.al/tags/JavaScript" class="mention hashtag" rel="nofollow noopener" target="_blank">#JavaScript</a> <a href="https://mastodon.ar.al/tags/HTML" class="mention hashtag" rel="nofollow noopener" target="_blank">#HTML</a> <a href="https://mastodon.ar.al/tags/CSS" class="mention hashtag" rel="nofollow noopener" target="_blank">#CSS</a>

Recent searches

Search options

Administered by:

Server stats:

#authentication