Mathstodon

0 posts0 participants0 posts today

Kevin Karhan :verified:<a href="https://infosec.exchange/@0x40k" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@0x40k</a> well, <a href="https://infosec.space/tags/Microsoft" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Microsoft</a> to this day has a <a href="https://infosec.space/tags/Backdoor" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Backdoor</a> in the <a href="https://infosec.space/tags/CryptoAPI" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#CryptoAPI</a> that <a href="http://github.com/kkarhan/windows-ca-backdoor-fix" rel="nofollow noopener noreferrer" target="_blank">remains unfixed to this day</a>...<ul><li>And since Microsoft doesn't acknowledge the concept of <a href="https://infosec.space/tags/consent" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#consent</a> in <a href="https://infosec.space/tags/Windows" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Windows</a> (and doesn't even fake it!) and they are both <a href="https://infosec.space/tags/PRISM" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#PRISM</a> collaborators AND subject to <a href="https://infosec.space/tags/CloudAct" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#CloudAct</a>, they <a href="https://infosec.space/tags/CantFix" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#CantFix</a> & <a href="https://infosec.space/tags/WontFix" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#WontFix</a> it!</li></ul>

Kevin Karhan :verified:<a href="https://nrw.social/@roman78" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@roman78</a> <a href="https://astronomy.social/@admin" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@admin</a> <a href="https://nrw.social/@olifantenbaer" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@olifantenbaer</a> angesichts der Lücken in <a href="https://infosec.space/tags/CryptoAPI" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#CryptoAPI</a> inklusive <a href="https://infosec.space/tags/Backdoors" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Backdoors</a> ist das digitales <a href="https://infosec.space/tags/FlexTape" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#FlexTape</a> bei durchgerrostetem Rohr...<ul><li>Hinzu kommt dass <a href="https://infosec.space/tags/WindowsUpdate" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#WindowsUpdate</a> entsprechende Einstellungen resetted.<a href="https://github.com/kkarhan/windows-ca-backdoor-fix" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://github.com/kkarhan/windows-ca-backdoor-fix</a></li></ul>

Kevin Karhan :verified:<a href="https://social.tchncs.de/@gborn" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@gborn</a> <a href="https://hessen.social/@MichaelD" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@MichaelD</a> <a href="https://det.social/@Bundesligatrainer" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@Bundesligatrainer</a> <a href="https://chaos.social/@Ihazchaos" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@Ihazchaos</a> nein, eben nicht.Dass <a href="https://infosec.space/tags/Windows10" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Windows10</a> [und besonders <a href="https://infosec.space/tags/Windows11" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Windows11</a>] nicht <a href="https://infosec.space/tags/DSGVO" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#DSGVO</a>- & <a href="https://infosec.space/tags/BDSG" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#BDSG</a>-konform sein können ist <a href="https://www.lda.bayern.de/media/windows_10_report.pdf" rel="nofollow noopener noreferrer" target="_blank">evidenzierte Tatsache</a> und ich habe noch keine*n Anwält*in gesehen die etwas anderes behaupten und dafür im Zweifelsfalle auch die <a href="https://infosec.space/tags/Haftung" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Haftung</a> übernehmen würden.<ul><li>Wohingegen ich mir sicher bin dass <a href="https://fosstodon.org/@SUSE" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@SUSE</a> & <a href="https://ubuntu.social/@ubuntu" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@ubuntu</a> mir im Zweifelsfalle sogar ne <a href="https://infosec.space/tags/Versicherung" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Versicherung</a> der <a href="https://infosec.space/tags/Compliance" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Compliance</a> ab Werk anbieten würden, was <a href="https://infosec.space/tags/Microsoft" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Microsoft</a> aufgrund von <a href="https://infosec.space/tags/CloudAct" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#CloudAct</a> inhärent nicht kann!</li><li>Außerdem verbietet sich das Procurement von Anbietern die in "illegaler Agententätigkeit" [u.a. <a href="https://infosec.space/tags/PRISM" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#PRISM</a>] involviert sind (!!!) schon aus oberflächlicher due diligence...</li></ul>Von <a href="https://github.com/kkarhan/windows-ca-backdoor-fix/" rel="nofollow noopener noreferrer" target="_blank">einfach ausnutzbaren</a> <a href="https://infosec.space/tags/Govware" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Govware</a> - <a href="https://infosec.space/tags/Backdoors" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Backdoors</a> in der <a href="https://infosec.space/tags/CryptoAPI" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#CryptoAPI</a> unter <a href="https://infosec.space/tags/Windows" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Windows</a> hab ich noch garnicht angefangen! <ul><li>TLDR: <a href="https://infosec.space/tags/Windows" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Windows</a> gehört in den <a href="https://infosec.space/tags/M%C3%BCll" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Müll</a> und notfalls auf ne <a href="https://infosec.space/tags/airgapped" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#airgapped</a> Kiste bzw. <a href="https://infosec.space/tags/offline" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#offline</a> VM! Ich fass' den shice nicht an!!!</li></ul><a href="https://infosec.space/tags/EOD" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#EOD</a>

Kevin Karhan :verified:<a href="https://transfem.social/@puppygirlhornypost2" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@puppygirlhornypost2</a> <a href="https://social.vlhl.dev/users/navi" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@navi</a> yeah, but that's a common problem based off <a href="https://infosec.space/tags/TechIlliteracy" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#TechIlliteracy</a> and lack of proper explaination!<ul><li>Given the <a href="https://infosec.space/tags/CryptoAPI" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#CryptoAPI</a> of <a href="https://infosec.space/tags/Windows" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Windows</a> is <a href="https://infosec.space/tags/backdoored" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#backdoored</a> for <a href="https://infosec.space/tags/Govware" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Govware</a> [<a href="https://infosec.space/tags/NSAKEY_" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#NSAKEY_</a> & <a href="https://infosec.space/tags/SSL" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#SSL</a>-<a href="https://github.com/kkarhan/windows-ca-backdoor-fix" rel="nofollow noopener noreferrer" target="_blank">Updates</a> I'd consider <a href="https://infosec.space/tags/BitLocker" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#BitLocker</a> insecure and the least of it's problems!</li></ul>Bonus points if <a href="https://infosec.space/tags/TPM" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#TPM</a> bs prevents <a href="https://infosec.space/tags/DataRecovery" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#DataRecovery</a>.<ul><li>My biggest problem with <a href="https://infosec.space/tags/FDE" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#FDE</a>/ <a href="https://infosec.space/tags/FullDiskEncryption" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#FullDiskEncryption</a> is that is mandates direct access to a system to authenticate, thus one needs to manually mount stuff on servers post-boot instead.</li></ul>

Kevin Karhan :verified:<a href="https://goatdaddy.net/profile/vvelox" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@vvelox</a> <a href="https://infosec.exchange/@SecurityWriter" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@SecurityWriter</a> I trust noone, but unlike <a href="https://infosec.space/tags/Microsoft" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Microsoft</a>, <a href="https://infosec.space/tags/RedHad" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#RedHad</a> didn't betray it's paying customers by literally shoving <a href="https://infosec.space/tags/Govware" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Govware</a> <a href="https://infosec.space/tags/Backdoors" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Backdoors</a> into critical compontents like the <a href="https://infosec.space/tags/CryptoAPI" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#CryptoAPI</a>... <a href="https://github.com/kkarhan/windows-ca-backdoor-fix" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://github.com/kkarhan/windows-ca-backdoor-fix</a>

Kevin Karhan :verified:<a href="https://mas.to/@tokyo_0" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@tokyo_0</a> <a href="https://infosec.space/tags/TrueCrypt" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#TrueCrypt</a> is <a href="https://infosec.space/tags/abandonware" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#abandonware</a> with serious security issues. <ul><li>DO NOT USE TRUECRYPT FFS!!!</li></ul>Use <a href="https://infosec.space/tags/VeraCrypt" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#VeraCrypt</a> or even better: migrate machines to <a href="https://infosec.space/tags/Linux" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Linux</a> and use <a href="https://infosec.space/tags/LUKS" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#LUKS</a> / <a href="https://infosec.space/tags/dmcrypt" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#dmcrypt</a> instead, as it's the best option at hand.<ul><li>If you need to shuttle data to <a href="https://infosec.space/tags/Windows" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Windows</a> and <a href="https://infosec.space/tags/macOS" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#macOS</a> machines and using <a href="https://infosec.space/tags/SFTP" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#SFTP</a> / <a href="https://infosec.space/tags/SSHFS" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#SSHFS</a> to mount a secure storage over the network isn't an option, than you're stuck with VeraCrypt, as <a href="https://infosec.space/tags/Windows" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Windows</a>' <a href="https://infosec.space/tags/CryptoAPI" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#CryptoAPI</a> is evidently <a href="https://infosec.space/tags/backdoored" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#backdoored</a> to the point that every <a href="https://infosec.space/tags/Browser" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Browser</a> except <a href="https://infosec.space/tags/Firefox" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Firefox</a> is susceptible to <a href="https://infosec.space/tags/SSL" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#SSL</a> hijacking with background updates...</li></ul><a href="https://github.com/kkarhan/windows-ca-backdoor-fix" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://github.com/kkarhan/windows-ca-backdoor-fix</a>

xoron :verified:"Encryption at Rest" for JavaScript ProjectsFollowing a previous post (<a href="https://infosec.exchange/@xoron/113446067764347249" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://infosec.exchange/@xoron/113446067764347249</a>), which can be summarized as: I'm tackling state management with an extra twist: integrating encryption at rest!I created some updates to the WIP pull-request. The behavior is as follows.- The user is prompted for a password if one isn't provided programmatically. - This will allow for developers to create a custom password prompts in their application. The default fallback is to use a JavaScript prompt(). - It also seems possible to enable something like "fingerprint/face encryption" for some devices using the webauthn api. (This works, but the functionality is a bit flaky and needs to be fixed before rolling out.) - Using AES-GCM with 1000000 iterations of PBKDF2 to derive the key from the password. - The iterations can be increased in exchange for slower performance. It isn't currently configurable, but it might be in the future. - The salt and AAD need to be deterministic and so to simplify user input, the salt as AAD are derived as the sha256 hash of the password. (Is this a good idea?)The latest version of the code can be seen in the PR: <a href="https://github.com/positive-intentions/dim/pull/9" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://github.com/positive-intentions/dim/pull/9</a>I'm keen to get feedback on the approach and the implementation before i merge it into the main branch.<a href="https://infosec.exchange/tags/JavaScript" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#JavaScript</a> <a href="https://infosec.exchange/tags/Encryption" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Encryption</a> <a href="https://infosec.exchange/tags/IndexedDB" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#IndexedDB</a> <a href="https://infosec.exchange/tags/WebDevelopment" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#WebDevelopment</a> <a href="https://infosec.exchange/tags/CryptoAPI" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#CryptoAPI</a> <a href="https://infosec.exchange/tags/FrontendDev" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#FrontendDev</a> <a href="https://infosec.exchange/tags/ReactHooks" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ReactHooks</a> <a href="https://infosec.exchange/tags/StateManagement" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#StateManagement</a> <a href="https://infosec.exchange/tags/WebSecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#WebSecurity</a> <a href="https://infosec.exchange/tags/OpenSource" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#OpenSource</a> <a href="https://infosec.exchange/tags/PersonalProjects" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#PersonalProjects</a>

xoron :verified:"Encryption at Rest" for JavaScript ProjectsI'm developing a JavaScript UI framework for personal projects, and I'm tackling state management with an extra twist: integrating encryption at rest!Inspired by this React Hook: Async State Management (<a href="https://positive-intentions.com/blog/async-state-management" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://positive-intentions.com/blog/async-state-management</a>), I’m extending it to support encrypted persistent data. Here's how:✨ The Approach:Using IndexedDB for storage.Data is encrypted before saving and decrypted when loading using the Browser Cryptography API.Event listeners will also be encrypted/decrypted to avoid issues like browser extensions snooping on events.The password (should never be stored) is entered by the user at runtime to decrypt the data. (Currently hardcoded for now!)The salt will be stored unencrypted in IndexedDB to generate the key.🔗 Proof of Concept: You can try it out here: GitHub PR (<a href="https://github.com/positive-intentions/dim/pull/8" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://github.com/positive-intentions/dim/pull/8</a>). Clone or run it in Codespaces and let me know what you think!❓ Looking for Feedback: Have I missed anything? Are there better ways to make this storage secure?Let's make secure web UIs a reality together! 🔒<a href="https://infosec.exchange/tags/JavaScript" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#JavaScript</a> <a href="https://infosec.exchange/tags/Encryption" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Encryption</a> <a href="https://infosec.exchange/tags/IndexedDB" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#IndexedDB</a> <a href="https://infosec.exchange/tags/WebDevelopment" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#WebDevelopment</a> <a href="https://infosec.exchange/tags/CryptoAPI" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#CryptoAPI</a> <a href="https://infosec.exchange/tags/FrontendDev" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#FrontendDev</a> <a href="https://infosec.exchange/tags/ReactHooks" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ReactHooks</a> <a href="https://infosec.exchange/tags/StateManagement" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#StateManagement</a> <a href="https://infosec.exchange/tags/WebSecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#WebSecurity</a> <a href="https://infosec.exchange/tags/OpenSource" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#OpenSource</a> <a href="https://infosec.exchange/tags/PersonalProjects" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#PersonalProjects</a>

Kevin Karhan :verified:<a href="https://mstdn.social/@rysiek" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@rysiek</a> <a href="https://infosec.space/tags/Microsoft" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Microsoft</a> blaming the <a href="https://infosec.space/tags/EU" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#EU</a> for <a href="https://infosec.space/tags/CrowdStrike" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#CrowdStrike</a> when the most affected customers are <a href="https://infosec.space/tags/Airlines" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Airlines</a> from the <a href="https://infosec.space/tags/USA" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#USA</a> that don't eben service Airports in <a href="https://infosec.space/tags/Europe" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Europe</a> at all is the biggest insult to the intellect of everyone since they denied <a href="https://infosec.space/tags/_NSAKEY" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#_NSAKEY</a> and their <a href="https://infosec.space/tags/CryptoAPI" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#CryptoAPI</a> <a href="https://infosec.space/tags/backdoor" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#backdoor</a>:<a href="https://github.com/kkarhan/windows-ca-backdoor-fix" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://github.com/kkarhan/windows-ca-backdoor-fix</a>

Kevin Karhan :verified:<a href="https://infosec.exchange/@malwaretech" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@malwaretech</a> thanks for adding another legendary <a href="https://infosec.space/tags/ITsec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ITsec</a> <a href="https://infosec.space/tags/fuckup" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#fuckup</a> by <a href="https://infosec.space/tags/Microsoft" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Microsoft</a> to the long list of *"<a href="https://infosec.space/tags/WontFix" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#WontFix</a>" <a href="https://infosec.space/tags/Exploits" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Exploits</a> that prevent me from even touching <a href="https://infosec.space/tags/Windows" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Windows</a> at all...If a literal <a href="https://infosec.space/tags/Govware" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Govware</a> <a href="https://infosec.space/tags/Backdoor" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Backdoor</a> in the <a href="https://infosec.space/tags/CryptoAPI" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#CryptoAPI</a> <a href="https://github.com/kkarhan/windows-ca-backdoor-fix" rel="nofollow noopener noreferrer" target="_blank">wasn't worse enough already</a>...

Kevin Karhan :verified:<a href="https://infosec.exchange/@bojkotiMalbona" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@bojkotiMalbona</a> <a href="https://mas.to/@diebarschlampe" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@diebarschlampe</a> <a href="https://hackers.town/@lmorchard" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@lmorchard</a> <a href="https://linuxmom.net/@vkc" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@vkc</a> nodds in agreementI hate the <a href="https://infosec.space/tags/GAFAM" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#GAFAM</a>-driven <a href="https://infosec.space/tags/Enshittification" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Enshittification</a> and the <a href="https://infosec.space/tags/Microsoft" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Microsoft</a> tech stack.<ul><li>I can accept it when someone needs something specific, but every single time I asked people who claimed they need i.e. <a href="https://infosec.space/tags/Excel" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Excel</a> they refused to tell me what they use it for or what function they need <a href="https://infosec.space/tags/LibreOffice" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#LibreOffice</a> doesn't offer them.</li></ul>I get hired and paid to prevent <a href="https://infosec.space/tags/LockIn" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#LockIn</a> effects and to enshure <a href="https://infosec.space/tags/ITsec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ITsec</a> is up to code, but that necessitates not surrendering to <a href="https://infosec.space/tags/PRISM" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#PRISM</a>-Collaborators and <a href="https://infosec.space/tags/Govware" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Govware</a> integrators...<ul><li>As shitty as <a href="https://infosec.space/tags/IBM" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#IBM</a> & <a href="https://infosec.space/tags/RedHat" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#RedHat</a> are, <a href="https://infosec.space/tags/RHEL" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#RHEL</a> at least doesn't come with a <a href="https://infosec.space/tags/backdoored" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#backdoored</a> <a href="https://infosec.space/tags/CryptoAPI" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#CryptoAPI</a> that they refuse to acknowledge or fix - unlike <a href="https://infosec.space/tags/Windows" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Windows</a>!<a href="https://github.com/kkarhan/windows-ca-backdoor-fix" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://github.com/kkarhan/windows-ca-backdoor-fix</a></li></ul>

Kevin Karhan :verified:<a href="https://infosec.exchange/@happygeek" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@happygeek</a> Morpheus Voice "What if I told you it *never*was safe to begin with?Cuz <a href="https://infosec.space/tags/Microsoft" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Microsoft</a> not only is a <a href="https://infosec.space/tags/PRISM" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#PRISM</a> collaborator but also knowingly leaves <a href="https://infosec.space/tags/Govware" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Govware</a> <a href="https://infosec.space/tags/Backdoors" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Backdoors</a> open and refuses to fix known issues.<ul><li>Like the <a href="https://infosec.space/tags/CryptoAPI" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#CryptoAPI</a> <a href="https://infosec.space/tags/backdoor" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#backdoor</a> that is <a href="https://www.heise.de/ct/ausgabe/2013-17-Zweifelhafte-Updates-gefaehrden-SSL-Verschluesselung-2317589.html" rel="nofollow noopener noreferrer" target="_blank">> 11 years old now</a>...</li></ul>And the only "<a href="https://github.com/kkarhan/windows-ca-backdoor-fix/" rel="nofollow noopener noreferrer" target="_blank">fix</a>" isn't even persistent but easy to backroll by <a href="https://infosec.space/tags/WindowsUpdate" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#WindowsUpdate</a> or it's subsystem...It doesn't even require elevated privilegues on the machine to exploit, just malformed / hijacked <a href="https://infosec.space/tags/DNS" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#DNS</a> as Microsoft doesn't check it's <a href="https://infosec.space/tags/SSL" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#SSL</a> <a href="https://infosec.space/tags/Certificate" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Certificate</a> updates for <a href="https://infosec.space/tags/integrity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#integrity</a> or <a href="https://infosec.space/tags/signatures" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#signatures</a> at all...

Kevin Karhan :verified:And if you think <a href="https://infosec.space/tags/BanJS" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#BanJS</a> is too radical then ask the people of <a href="https://mastodon.social/@torproject" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@torproject</a> why they banned <a href="https://infosec.space/tags/JavaScript" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#JavaScript</a> in it...<ul><li>It think <a href="https://infosec.space/tags/JS" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#JS</a> is a 'net negative' to the world and deserves to be banned right after <a href="https://infosec.space/tags/Windows" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Windows</a> amd espechally <a href="https://infosec.space/tags/WindowsServer" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#WindowsServer</a>, because those are just vile <a href="https://infosec.space/tags/Govware" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Govware</a> that should be outlawed since <a href="https://infosec.space/tags/PRISM" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#PRISM</a> & <a href="https://infosec.space/tags/EthernalBlue" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#EthernalBlue</a> and the <a href="https://infosec.space/tags/CryptoAPI" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#CryptoAPI</a> <a href="https://infosec.space/tags/backdoor" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#backdoor</a> <a href="http://github.com/kkarhan/windows-ca-backdoor-fix" rel="nofollow noopener noreferrer" target="_blank">got public</a>! </li></ul>I mean, how long will y'all just accept being abused, lied and being gaslit by <a href="https://infosec.space/tags/Microsoft" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Microsoft</a> in specific amd <a href="https://infosec.space/tags/GAFAMs" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#GAFAMs</a> in general???

Kevin Karhan :verified:<a href="https://cyberplace.social/@GossiTheDog" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@GossiTheDog</a> OFC there is - Microsoft still keeps their own <a href="https://infosec.space/tags/CryptoAPI" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#CryptoAPI</a> <a href="https://infosec.space/tags/backdoored" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#backdoored</a> to this day...Not shure if <a href="http://github.com/kkarhan/windows-ca-backdoor-fix" rel="nofollow noopener noreferrer" target="_blank">a fix</a> even works anymore amd since I'm 100% <a href="https://infosec.space/tags/Windows" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Windows</a>-free I'd rather drink a bottle of vinegar or snort a line of soda than ever touching that cursed <a href="https://infosec.space/tags/Govware" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Govware</a> ever again in my life...

Kevin Karhan :verified:<a href="https://social.cologne/@md" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@md</a> <a href="https://mastodon.social/@bkastl" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@bkastl</a> außer es ist halt <a href="https://infosec.space/tags/Govware" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Govware</a> von <a href="https://infosec.space/tags/Microsoft" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Microsoft</a> wie <a href="https://infosec.space/tags/Windows" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Windows</a>...Da ist das Betriebssystem unfixbar kaputt...<a href="https://github.com/kkarhan/windows-ca-backdoor-fix" rel="nofollow noopener noreferrer" target="_blank">Egal ob</a> <a href="https://infosec.space/tags/CryptoAPI" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#CryptoAPI</a> <a href="https://github.com/xaitax/TotalRecall" rel="nofollow noopener noreferrer" target="_blank">oder</a> <a href="https://infosec.space/tags/Recall" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Recall</a> oder <a href="https://infosec.space/tags/CensorBoot" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#CensorBoot</a> <a href="https://gist.github.com/acepace/df34b5213f1e0fae6529eb703d947187" rel="nofollow noopener noreferrer" target="_blank">aka.</a> <a href="https://github.com/lgibson02/GoldenKeysUSB" rel="nofollow noopener noreferrer" target="_blank">"Secure Boot"</a>... Und die <a href="https://infosec.space/tags/CDU" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#CDU</a> <a href="https://infosec.space/@kkarhan/112641907638340663" rel="nofollow noopener noreferrer" target="_blank">hat alle kompetenten Leute vergrault</a>...

Kevin Karhan :verified:<a href="https://haunted.computer/@chompie1337" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@chompie1337</a> I guess yu should just put it up on <a href="https://infosec.space/tags/GitHub" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#GitHub</a> and taunt <a href="https://infosec.space/tags/Microsoft" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Microsoft</a> with the communications unredacted and in full lenght as part of the documentation.<ul><li>After all, they can't he assed to fix the <a href="https://infosec.space/tags/CryptoAPI" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#CryptoAPI</a> <a href="https://infosec.space/tags/backdoor" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#backdoor</a> since <a href="https://infosec.space/tags/WindowsXP" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#WindowsXP</a> anyway...</li></ul>

Kevin Karhan :verified:<a href="https://awscommunity.social/@Quinnypig" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@Quinnypig</a> the sheer fact that <a href="https://infosec.space/tags/Microsoft" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Microsoft</a> and <a href="https://infosec.space/tags/Windows11" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Windows11</a> ain't banned across the <a href="https://infosec.space/tags/EU" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#EU</a> to this day is an indictment to the <a href="https://infosec.space/tags/TechIlliteracy" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#TechIlliteracy</a> of politicans in the <a href="https://ec.social-network.europa.eu/@EUCommission" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@EUCommission</a> & <a href="https://respublicae.eu/@europarl_en" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@europarl_en</a> despite<ul><li><a href="https://infosec.space/tags/PRISM" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#PRISM</a></li><li><a href="https://infosec.space/tags/GoldenKeyBoot" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#GoldenKeyBoot</a> (aka. <a href="https://infosec.space/tags/CensorBoot" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#CensorBoot</a> got owned!)</li><li><a href="https://infosec.space/tags/CryptoAPI" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#CryptoAPI</a> <a href="https://infosec.space/tags/backdoors" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#backdoors</a> <a href="https://github.com/kkarhan/windows-ca-backdoor-fix" rel="nofollow noopener noreferrer" target="_blank">they refuse to acknowledge or fix at all</a>!</li><li><a href="https://infosec.space/tags/CloudAct" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#CloudAct</a></li><li>Unwillingness to comply with <a href="https://infosec.space/tags/GDPR" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#GDPR</a> out if the box</li></ul>and now<ul><li><a href="https://infosec.space/tags/Recall" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Recall</a> aka. the worst disguised <a href="https://infosec.space/tags/Govware" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Govware</a> / <a href="https://infosec.space/tags/Spyware" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Spyware</a> in existance that allows anyone to <a href="https://github.com/xaitax/TotalRecall" rel="nofollow noopener noreferrer" target="_blank">simply extract credentials</a> without the need to install a <a href="https://infosec.space/tags/Keylogger" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Keylogger</a>, <a href="https://infosec.space/tags/ScreenRecorder" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ScreenRecorder</a> and/or commit <a href="https://infosec.space/tags/ProvilegueEscalatiom" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ProvilegueEscalatiom</a> successfully at all...</li></ul>And since <a href="https://cyberplace.social/@GossiTheDog" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@GossiTheDog</a> managed to get it running on a system w/o "<a href="https://infosec.space/tags/AI" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#AI</a>" acceleration aka. "<a href="https://infosec.space/tags/NPU" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#NPU</a>" it's safe to assume that it'll be perfectly possible to retroactively shove it down everyones' throats without recourse!<ul><li>Actually there are options for recourse besides "<a href="https://infosec.space/tags/ThoughtsAndPrayers" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ThoughtsAndPrayers</a>" that regulators like <a href="https://social.bund.de/@bsi" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@bsi</a> would actually take this seriously: </li></ul>Like: Stop using <a href="https://infosec.space/tags/Windows" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Windows</a> and <a href="https://www.youtube.com/watch?v=PkKfV0ATrH4" rel="nofollow noopener noreferrer" target="_blank">get some help</a> migrating away from it to a good <a href="https://infosec.space/tags/Linux" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Linux</a> distro!<a href="https://infosec.space/tags/WhatYouAllowIsWhatWillContinue" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#WhatYouAllowIsWhatWillContinue</a>

Kevin Karhan :verified:<a href="https://hachyderm.io/@evacide" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@evacide</a> I don't believe a single.sillable of that shite - not since they did even worse shite in the past, like <a href="http://github.com/kkarhan/windows-ca-backdoor-fix" rel="nofollow noopener noreferrer" target="_blank">backdooring</a> the <a href="https://infosec.space/tags/CryptoAPI" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#CryptoAPI</a> of <a href="https://infosec.space/tags/Windows" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Windows</a>...

Kevin Karhan :verified:<a href="https://mastodon.social/@fradie_new" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@fradie_new</a> wer so todeslost ist, der darf auch keine Webseiten nutzen die irgendeine <a href="https://infosec.space/tags/FLOSS" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#FLOSS</a>'te <a href="https://infosec.space/tags/SSL" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#SSL</a>-Bibliothek nutzt...<ul><li>Viel erfolg, denn effektiv nutzen alle <a href="https://infosec.space/tags/OpenSSL" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#OpenSSL</a> oder andere <a href="https://infosec.space/tags/OpenSource" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#OpenSource</a>-lizensierten Varianten!</li></ul>Wenn überhaupt ist <a href="https://infosec.space/tags/CCSS" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#CCSS</a> gämzlich zu misstrauen... Vorallem in Sachen <a href="https://infosec.space/tags/Sicherheit" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Sicherheit</a>...<ul><li>Siehe <a href="https://infosec.space/tags/Windows" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Windows</a> <a href="https://infosec.space/tags/CryptoAPI" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#CryptoAPI</a> als <a href="https://infosec.space/tags/Govware" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Govware</a>-<a href="https://infosec.space/tags/Backdoor" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Backdoor</a> in <a href="https://github.com/kkarhan/windows-ca-backdoor-fix" rel="nofollow noopener noreferrer" target="_blank">Windows</a>!</li></ul>

Kevin Karhan :verified:<a href="https://grimgreenfo.rest/@SweetCoffy" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@SweetCoffy</a> nodds in agreementIt"s a shitty <a href="https://infosec.space/tags/Govware" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Govware</a> full of <a href="https://infosec.space/tags/Backdiors" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Backdiors</a>, like it's <a href="https://infosec.space/tags/CryptoAPI" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#CryptoAPI</a>!<a href="https://github.com/kkarhan/windows-ca-backdoor-fix" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://github.com/kkarhan/windows-ca-backdoor-fix</a>

Recent searches

Search options

Administered by:

Server stats:

#cryptoapi