home.social

Search

1000 results for “erikjan”

  1. The good news is US forces rescued the F-15 crew member (WSO). The bad news is the enormous amount of material losses in planes and helicopters. Iran can claim a “win” in some way. It also shows the Iranian regime is not defeated. Future ground operations will not be easy.
    #iran #usa #pilotrescue #F15 #war #geopolitics @geopolitics

  2. @gvenema : ik heb dezelfde ervaring, ik blijf op het oude adres mails ontvangen na het wijzigen.

    Ook bij T-Mobile had ik mijn e-mailadres gewijzigd. Zowel het oude als het nieuwe zijn gelekt door Odido.

    Odido heeft vervolgens een geschoonde database aan de politie gegeven waar mijn oude adres NIET in stond, terwijl HaveIBeenPwned (met van het dark web afkomstige gegevens) aangaf dat beide adressen door Odido waren gelekt (dat wist ik al doordat ik, kort na de Odido hack, op beide aliases, ineens veel spam kreeg - deels dezelfde mails). Voor meer info zie security.nl/posting/928540/RTL.

    Helaas doet iedereen zijn eigen ding en bestaat er geen standaard voor het wijzigen van contactgegevens.

    @apenkop @harld

    #Odido #OdidoDataLek #AVG #GDPR

  3. @gvenema : ik heb dezelfde ervaring, ik blijf op het oude adres mails ontvangen na het wijzigen.

    Ook bij T-Mobile had ik mijn e-mailadres gewijzigd. Zowel het oude als het nieuwe zijn gelekt door Odido.

    Odido heeft vervolgens een geschoonde database aan de politie gegeven waar mijn oude adres NIET in stond, terwijl HaveIBeenPwned (met van het dark web afkomstige gegevens) aangaf dat beide adressen door Odido waren gelekt (dat wist ik al doordat ik, kort na de Odido hack, op beide aliases, ineens veel spam kreeg - deels dezelfde mails). Voor meer info zie security.nl/posting/928540/RTL.

    Helaas doet iedereen zijn eigen ding en bestaat er geen standaard voor het wijzigen van contactgegevens.

    @apenkop @harld

    #Odido #OdidoDataLek #AVG #GDPR

  4. @gvenema : ik heb dezelfde ervaring, ik blijf op het oude adres mails ontvangen na het wijzigen.

    Ook bij T-Mobile had ik mijn e-mailadres gewijzigd. Zowel het oude als het nieuwe zijn gelekt door Odido.

    Odido heeft vervolgens een geschoonde database aan de politie gegeven waar mijn oude adres NIET in stond, terwijl HaveIBeenPwned (met van het dark web afkomstige gegevens) aangaf dat beide adressen door Odido waren gelekt (dat wist ik al doordat ik, kort na de Odido hack, op beide aliases, ineens veel spam kreeg - deels dezelfde mails). Voor meer info zie security.nl/posting/928540/RTL.

    Helaas doet iedereen zijn eigen ding en bestaat er geen standaard voor het wijzigen van contactgegevens.

    @apenkop @harld

    #Odido #OdidoDataLek #AVG #GDPR

  5. If you want to understand the importance of prompts in AI, it is interesing to read all Anthropic system prompts which are actually published (other companies don't). Simon Willison gave me the tip in his excellent blog. simonwillison.net/2026/Apr/18/
    Claude prompts:
    platform.claude.com/docs/en/re
    #AI #prompts #anthropic

  6. The whole crisis around Iran and Hormuz will be a blessing in disguise for renewable energy and electrification. It was already clear but now even more that from an economic perspective it is simply smart to go for renewable energy and ditch fossil fuels as much as possible. But now there is an additional incentive because of high prices and the wish to be less dependent. Without even mentioning the environmental benefits.
    #USA #Iran #EV #electrification #geopolitics #Trump

  7. @jtb : yes, but AFAIK passkey private keys cannot be exported from "Apple Passwords" and neither from "Google Passwords". Which are probably used most.

    Why would people install a third party password manager (often payed, and/or a privacy/security risk - remember Lastpass) if your phone comes with such an app and they're unaware of the risks?

    Edited to add: my Feb. 2024 write up on Full Disclosure still mostly applies.

    Screenshots, chronological:

    1) Top right: contents of Google Password Manager after creating a passkey on webauthn.io

    2) Left: tapping the "Delete data" button in chrome.google.com/sync

    3) Bottom right: contents of Google Password Manager after tapping the "Delete data" button in chrome.google.com/sync. The passkey is gone.

    People are wrongly made to believe that Google passkeys are stored safely on their device; they are not.

    @rmondello @brandonbutler

    #AndroidPasskeysGone #Passkeys #AccountLockout

  8. @jtb : yes, but AFAIK passkey private keys cannot be exported from "Apple Passwords" and neither from "Google Passwords". Which are probably used most.

    Why would people install a third party password manager (often payed, and/or a privacy/security risk - remember Lastpass) if your phone comes with such an app and they're unaware of the risks?

    Edited to add: my Feb. 2024 write up on Full Disclosure still mostly applies.

    Screenshots, chronological:

    1) Top right: contents of Google Password Manager after creating a passkey on webauthn.io

    2) Left: tapping the "Delete data" button in chrome.google.com/sync

    3) Bottom right: contents of Google Password Manager after tapping the "Delete data" button in chrome.google.com/sync. The passkey is gone.

    People are wrongly made to believe that Google passkeys are stored safely on their device; they are not.

    @rmondello @brandonbutler

    #AndroidPasskeysGone #Passkeys #AccountLockout

  9. @jtb : yes, but AFAIK passkey private keys cannot be exported from "Apple Passwords" and neither from "Google Passwords". Which are probably used most.

    Why would people install a third party password manager (often payed, and/or a privacy/security risk - remember Lastpass) if your phone comes with such an app and they're unaware of the risks?

    Edited to add: my Feb. 2024 write up on Full Disclosure still mostly applies.

    Screenshots, chronological:

    1) Top right: contents of Google Password Manager after creating a passkey on webauthn.io

    2) Left: tapping the "Delete data" button in chrome.google.com/sync

    3) Bottom right: contents of Google Password Manager after tapping the "Delete data" button in chrome.google.com/sync. The passkey is gone.

    People are wrongly made to believe that Google passkeys are stored safely on their device; they are not.

    @rmondello @brandonbutler

    #AndroidPasskeysGone #Passkeys #AccountLockout

  10. @jtb : yes, but AFAIK passkey private keys cannot be exported from "Apple Passwords" and neither from "Google Passwords". Which are probably used most.

    Why would people install a third party password manager (often payed, and/or a privacy/security risk - remember Lastpass) if your phone comes with such an app and they're unaware of the risks?

    Edited to add: my Feb. 2024 write up on Full Disclosure still mostly applies.

    Screenshots, chronological:

    1) Top right: contents of Google Password Manager after creating a passkey on webauthn.io

    2) Left: tapping the "Delete data" button in chrome.google.com/sync

    3) Bottom right: contents of Google Password Manager after tapping the "Delete data" button in chrome.google.com/sync. The passkey is gone.

    People are wrongly made to believe that Google passkeys are stored safely on their device; they are not.

    @rmondello @brandonbutler

    #AndroidPasskeysGone #Passkeys #AccountLockout

  11. @rmondello : what makes passkeys strong:

    1. Software checks the domain name, which makes phishing hard;

    2. Https is enforced, which helps prevent AitM attacks (unless Cloudflare et al. come into play);

    3. A unique, long, unguessible, randomly generated "password" (public key) per account: dumb password rules and broken human RNG's no longer apply.

    The rest is marketing (including the -hyped- asymmetric cryptography).

    The "advantage" of denying the owner access to their own private keys hardly makes sense as long as session cookies are not device-bound.

    The disadvantage of not being able to back up ones own private keys is the risk of vendor lock-in and the underestimated huge risk of account lockout [1]. And the latter leads to the necessity of being able to log in using weak authentication after the user loses access to their private keys.

    @brandonbutler

    [1] seclists.org/fulldisclosure/20

    #Passkeys #Phishing #PhishingResistant #AsymmetricCryptography #AndroidPasskeys #androidPasskeysGone #iOSpasskeys #iPadOSpasskeys #ApplePasskeys #BackUp #Export #BackUpPasskeys #ExportPassKeys #PasskeyBackUps #PasskeyExports

  12. @rmondello : what makes passkeys strong:

    1. Software checks the domain name, which makes phishing hard;

    2. Https is enforced, which helps prevent AitM attacks (unless Cloudflare et al. come into play);

    3. A unique, long, unguessible, randomly generated "password" (public key) per account: dumb password rules and broken human RNG's no longer apply.

    The rest is marketing (including the -hyped- asymmetric cryptography).

    The "advantage" of denying the owner access to their own private keys hardly makes sense as long as session cookies are not device-bound.

    The disadvantage of not being able to back up ones own private keys is the risk of vendor lock-in and the underestimated huge risk of account lockout [1]. And the latter leads to the necessity of being able to log in using weak authentication after the user loses access to their private keys.

    @brandonbutler

    [1] seclists.org/fulldisclosure/20

    #Passkeys #Phishing #PhishingResistant #AsymmetricCryptography #AndroidPasskeys #androidPasskeysGone #iOSpasskeys #iPadOSpasskeys #ApplePasskeys #BackUp #Export #BackUpPasskeys #ExportPassKeys #PasskeyBackUps #PasskeyExports

  13. @rmondello : what makes passkeys strong:

    1. Software checks the domain name, which makes phishing hard;

    2. Https is enforced, which helps prevent AitM attacks (unless Cloudflare et al. come into play);

    3. A unique, long, unguessible, randomly generated "password" (public key) per account: dumb password rules and broken human RNG's no longer apply.

    The rest is marketing (including the -hyped- asymmetric cryptography).

    The "advantage" of denying the owner access to their own private keys hardly makes sense as long as session cookies are not device-bound.

    The disadvantage of not being able to back up ones own private keys is the risk of vendor lock-in and the underestimated huge risk of account lockout [1]. And the latter leads to the necessity of being able to log in using weak authentication after the user loses access to their private keys.

    @brandonbutler

    [1] seclists.org/fulldisclosure/20

    #Passkeys #Phishing #PhishingResistant #AsymmetricCryptography #AndroidPasskeys #androidPasskeysGone #iOSpasskeys #iPadOSpasskeys #ApplePasskeys #BackUp #Export #BackUpPasskeys #ExportPassKeys #PasskeyBackUps #PasskeyExports