There is no evidence that a Twitter employee did these changes. In fact, the MO matches a hacked account that was sold on the dark web.
582 karma · joined July 25, 2011
I built Farseer Physics Engine 3.0, SimpleS3 and about 25 other open source projects. Check them out over at https://github.com/genbox
I am also the founder and director of Chronos, a platform for investigating large-scale security incidents using forensics techniques.
Website: https://www.id.ee/en/
Timeline of implementations: https://e-estonia.com/story/
Github: https://github.com/open-eid
This way you can have deduplication of data, and only an attacker that knows the content of the file can decrypt the file, but since they already have the file, it does not matter.
Private: Spent a few years on building Farseer Physics Engine. Back in 2007 it was used by almost all 2D games for Xbox and Windows Phone. Then Unity took over in 2013.
The paper includes comparisons with Ribbon filter
[1] Graf, T. M., & Lemire, D. (2022). Binary Fuse Filters: Fast and Smaller Than Xor Filters. arXiv. https://doi.org/10.1145/3510449
[1] https://kotlinlang.org/docs/exceptions.html#java-interoperab...
In either case, I would imagine it requires a directional and high-gain setup to reach 3,8km. Does that not limit the potential of the attack vector on large scale?
Formally verified applications is such a foreign concept to people that when you say "verified correct" they get skeptical and mistrust the whole concept.
Saying something is "secure" when it has been formally verified will be received with a grain of salt, but it is much easier to say than:
"we wrote a detailed specification that define the whole system via algebra, and then we let a theorem prover run all possible permutations of the specification It has now tested a billion edge-cases and we have reached a state where it no longer finds any deviation from the specification."
At least it is provable better than someone saying "it is secure because we think it is".
Back in the old days when cryptography was a weird concept nobody understood, we had the Linear Congruential Generator (LCG)[1] to generate pseudo random numbers. It looked random, so we used it.
Then some egghead said "give me a few outputs of your LCG and I can reverse it back to a seed"[2]. Oh damn! What do we do? The obvious solution: Reseed the RNG before you use it.
Then another egghead said "I've invented Mersenne Twister (MT). It is faster and more secure"[3]. So we switched to that. No need to reseed the RNG anymore!
But then someone said "We have broken MT. Take some numbers. Give it to this app, and it will give you the seed"[4]. And so we started to reseed the RNG again.
Today it is hash-chaining, XOR-shift and improved linear-feedback shift register algorithms.
Do you want to put your money on that we have now reached bug-free well-enough PRNGs that we no longer have fiddle with reseeding? It is a dangerous gamble. More than anything I wish we were clever enough to create robust, correctness proven and high-performance PRNGs so we could stop all this nonsense - but alas, here we are.
[1] https://academic.oup.com/comjnl/article/1/2/83/425243
[2] https://en.wikipedia.org/wiki/Marsaglia%27s_theorem
[3] http://www.math.sci.hiroshima-u.ac.jp/m-mat/MT/ARTICLES/mt.p...
1. There has been a precedent in Windows to run everything as local administrator. Linux has always had the user vs. root paradigm, but Windows - at least in the client versions - has always just defaulted to administrative accounts.
2. Features designed to provide more fine-grained control of token privileges, such as UAC, process integrity, and virtualization, have been excluded from security bug bounties as being "not a real security boundary". This stance is somewhat counterintuitive and quite dangerous.
Combine those two with the fact that Microsoft never provided sane secure defaults for any of their software; it just goes to show that Microsoft is not concerned nor bothered with securing their software.
That shifts the issue of "don't run as admin, stupid" responsibility from the user to Microsoft to a large extent.
I'm pretty sure you already know of sharplab.io. A lot of us C# devs prefer it over Compiler Explorer for a bunch of reasons, but the main one is really the speed.
My guess is that Sharplab gets it speed because it hooks directly into the JIT compiler itself. There is no overhead from touching disk or the linker.
Watch the same 3-4 series again and again. Never watch any of the featured content. It is not quality content.
> There are no immovable mountain. Everything is vulnerable, everything exists because it, or something esle, didn't break/transform it into something else.
Vulnerability is what humans would use do describe how something alive and conceptually "whole". It is something can can be exploited to inverse those properties. If we are all just matter in different configurations, in a universe full of matter in infinite combinations, "vulnerable" loses its meaning.
So perhaps, in the larger scale of things, nothing is truly vulnerable.
- You contact their hosting provider and report it.
- Check if the top-level domain registrar has a form for it and report it.
- If your trademark has been infringed, you can create a Uniform Domain Name Dispute Resolution Policy (UDRP) against the registrant [1]
- You setup DKIM, SPF and DMARC on your domain to avoid them from spoofing your domain.
[1] https://www.icann.org/resources/pages/filing-udrp-2013-05-21...
The activity in 2011 was never confirmed to be a breach. It was a overcautious response on LastPass's part after seeing an outlier in the logs. The investigating party gave a report saying they couldn't find anything, and the CEO later gave a statement saying they overreacted to an outliter out of an abundance of caution.
Notifying customers of a breach is a much more ethical approach than sitting on the information. In some countries it is even mandetory to report breaches to affected users, which I personally think is better than not doing it.
That is how it works. You can't prove a negative, so the data is not compromised until the investigation shows that it is.
The developer's credentials was compromised, but those credentials don't give access to the production databases where customer data is stored, then there is a good reason to assume no customer data was breached. Of course you still do due diligence and investigate anyway, just to be 110% sure.
It would require Microsoft to use a different authentication scheme based on ephemeral signed tokens instead of OAUth to be beneficial for security. That is very unlikely to happen.
That scheme would also only reduce the access timeframe from whatever the OAuth token's lifetime is, to a timeframe constrained to the amount of time the computer (the key) is online.
You are correct. There is no such thing as "multiple OS-level controls". In Google Chrome on Windows, the cookies in question are stored in an SQLite database at '%localappdata%\Google\Chrome\User Data\Default\Network\Cookies'. The cookie is named TSAUTHCOOKIE and contains an authentication token.
There is the same level of protection on this file, as there is on the Microsoft Teams Cookies database.
Source: I build forensics investigation tools for a living.
Having tokens in clear text is not a serious security issue as long as the files cannot be accessed by anyone else.
The best way of storing credentials today is to either:
A. Use asymmetric cryptography and store the private keys in a non-exportable format like the Trusted Platform Module.
B. Use an API like the Data Protection API in Windows and store the secrets under "User scope". This encrypts the secrets with the user's logon password.
Only solution A above protects against malware running as the current user, however, the solution is also not very portable and technically difficult to maintain across platforms.
There is no way Microsoft (or any other software vendor on the market today) can truly protect against credential stealing if malware is running in the context of the user. The exception is solution A above, but even then the attacker would have brief access to the remote systems as long as the user is concurrently using those systems.
[1] https://www.vectra.ai/blogpost/undermining-microsoft-teams-s...
What do you mean by that? Dry-cask storage is very manageable and have been used for decades.
> radioactive waste will have to be stored for a million years
Uranium-235 is a naturally formed isotope of uranium, and it has a half-life of 703 million years. In a nuclear reactor, U-235 is split into many different fission products such as Caesium-137, Caesium-135, Zirconium-93 and many others. The longest living fission product is Iodine-129, which has a half-life of about 1.57 million years.
In essence, we have high-radiation and high half-life isotopes naturally formed everywhere on earth. Once they are mined and burnt in a fission reactor, these stable isotopes are split them into many different isotopes, which last for a shorter amount of time. It is a little bit nonsense to say we need to store it for a million years. It would be the same as saying we currently need to store U-235 for 703 million years.
It is all about concentrations and the type of radiation that is emitted. Nuclear waste is not "a problem" - it is a process. Right not it is safe, relatively cheap and somewhat efficient.
A lot of models do not take age distribution into account. For example, if you have a "boomer" generation that is transition into a high-risk-of-dying age group, then the projected number of deaths will be low and the deaths high, making it look like you have a lot of excess mortality.
Slightly more complex models that project the number of deaths from a larger timeframe (for example 5 years) minimize this kind of error, but there are still many more factors to take into account.
EuroMOMO is a European standard for calculating excess mortality. They calculate data variance and thresholds where the model would consider deaths outside of statistical error[1].
Across European 28 countries (420 million people) their model shows[2] a considerable amount of excess deaths in 2020, 2021 and 2022. So according to that model, the pandemic is very much still a present danger.
PCR banks 0 to 7 have well-defined values, so an accumulator in the TPM hashes the values and BitLocker uses the values as part of the encryption key derivation algorithm. If the PCR hash changes, the BitLocker key will become invalid.
However, BitLocker can have several "protectors" as they are called. One that is enabled by default is a "Recovery Key" protector, which is not protected by the TPM. It is a 48 digit password that must either be printed, stored on a non-encrypted medium (like an USB device) or uploaded to an Azure AD or Microsoft account.
Your colleagues must have enabled BitLocker themselves, as it is not enabled by default. They must also have been through the "backup recovery key" process, as BitLocker requires manual user interaction for this part.
It sucks when there is an update to PCR banks - and usually the update won't install if PCR7 binding is enabled - but users that enable advanced security features also have part of the responsibility to ensure they don't get locked out of their own systems.