#privsec — Public Fediverse posts
Live and recent posts from across the Fediverse tagged #privsec, aggregated by home.social.
-
I mean, maybe if I can buy a phone preinstalled with a "degoogled" mod… but I'm not sure how many options there are for that. I'm not going to flash a mod on a phone with #Google malware preloaded. If I can't trust the factory-reset state, I can't trust the hardware. Just my conservative stance on personal #privsec.
-
@delta having *the same app* bridge people on existing email infra to the #privsec crowd has always been the biggest strength I appreciated Delta Chat for. forking, dropping legacy SMTP, or any such abandonment of that bridge would turn Delta Chat into just another chat protocol in my eye. if I'm going to push people to adopt secure messaging, Signal would always be the easier sell.
-
Germany fines Vodafone $51 million for privacy, security breaches:
-
Unpatched MS Office flaw may leak NTLM hashes to attackers (CVE-2024-38200) https://www.helpnetsecurity.com/2024/08/12/cve-2024-38200/ #authentication #Microsoft365 #Don'tmiss #Hotstuff #MSOffice #PrivSec #0-day #News
-
This is one of the best if not the best article I’ve read about personal Privacy/Security for a while https://open.substack.com/pub/privseclaw/p/know-your-rights-part-one-of-creating?utm_campaign=post&utm_medium=web
#privacy #security #privsec -
8/ Ultimately, when privacy and security work hand in hand, they foster trust, respect individual freedoms, and promote a safer and more resilient digital environment for everyone. Let's champion both privacy and security as fundamental rights. #DataPrivacy #PrivSec
-
Yubikey-Guide: a very complete (and long) Guide to use YubiKey as a SmartCard for storing GPG encryption, signing and authentication keys, which can also be used for SSH #PrivSec https://github.com/drduh/YubiKey-Guide
-
A reminder for #researchers and #privsec advocates:
If you are tweeting or tooting about data dumps and are using screenshots of TAs' posts, remember to redact any links in the posts.
I have just seen two examples in the past hour where people tweeted screenshots that show the whole world where to find personal information of students in one case and protected health information in the second case.
Tweet or toot responsibly. Remember to redact.
Have a great weekend.
-
#Apple Faces UK Ban on Updates Over Data Collection
https://cybersec84.wordpress.com/2023/08/27/apple-faces-uk-ban-on-updates-over-data-collection/
#Privacy #Privsec #E2EE -
CW: GrapheneOS matters to everybody. Also, Brave is good.
#GrapheneOS won't say it because they are rightly concerned with doing their work and don't need to sound like a radical artist, so I'll say it: They've been relentlessly attacked on all possible fronts from personal to financial because it's simply the most secure system you can have on the most insecure device you can own, designed by people with deep experience, and this is a major threat to the enemies of a free society. These enemies will even encourage the ubiquitous privacy theater that passes for good info, in the same way they encourage culture war to keep you too preoccupied to fight the class war. Every time, the GOS team has countered these attacks and proved the resiliency of the project.
You can block every ad, anonymize every trace of your browsing, but addressing #privacy at the expense of #security is like leaving your front door unlocked because nobody knows you live there. All an intruder has to do is try the door and they'll soon know a whole lot about you. Conversely, if there's a fence and a gate and motion detectors and cameras and everything is locked with well maintained, modern locks, you could have your name and social security number in neon lights on the roof and they're still going to have a hard time getting in. Obviously you don't want SPARE KEY UNDER THE DOORMAT in neon, I'm just making the point that while you of course want both privacy and security, I think most of us have a threat model that needs to emphasize security. The enemy knows that and they don't want you to know that.
Even if you don't have a use for GOS, you can learn so much from the developers in the documentation. I don't add this as an afterthought or consolation. The docs are what convinced me to get a refurbished Pixel 6 Pro and install the OS the same way the Arch Linux wiki did for me: I referenced it constantly for answers before I installed Arch and I learned to see a much bigger, more accurate picture that stayed valuable even after I moved on to another system, and it empowered me to better evaluate that system. #PrivSec is a moving target, just because you read something you trusted a year ago doesn't mean it's still accurate or even that the source is still trustworthy. -
An insightful new article going over how you leverage virtualization to setup a local Linux server, update its time using NTS, and synchronize your macOS host with it using NTP, all without needing a privileged application.
https://privsec.dev/posts/macos/secure-time-synchronization-on-macos/
PrivSec's Matrix community:
Main: #PrivSec.dev:arcticfoxes.net
Off‑topic: #PrivSec.dev-offtopic:arcticfoxes.net
Space: #PrivSec.dev-space:arcticfoxes.net -
FYI: The #GrapheneOS project has more than one dev and any one of them knows more about #privsec than a dude who sits in a recliner ranting to a statistically insignificant number of followers about a schizoid soup of quasi-libertarian topics exclusively on a platform owned by one of the worst offenders on the planet. I'm gonna go with the experienced team who consistently point out easily verifiable vulnerabilities in other projects whose devs refuse to discuss in good faith, never mind fix.
I also vote based on policy over personality and believe due process is a cornerstone of a free society, I'm old-fashioned that way. Oh, and I use Pleroma which is I guess is a project led by Hitler if you listen to people who care more about Japanese animation than ActivityPub and the free flow of information. -
🪲 Subscription Privilege Escalation and RCE by Abusing Azure Storage Account Keys
https://orca.security/resources/blog/azure-shared-key-authorization-exploitation/
-
Privacy Update: PrivSec - Part 4 - 'Badness Enumeration!' https://dt.gl/privacy-update-privsec-part-4-badness-enumeration/ #privacy #security #privsec
-
#Privacy Update: PrivSec - Part 3 - #Android! Privacy Advocate https://dt.gl/privacy-update-privsec-part-3-android/ #security #privsec
-
#PrivSec - an examination - 1 - The Hated One threat levels https://dt.gl/privsec-an-examination-part-1/
-
8x8 support is claiming that jitsi won't allow changing a username and login account have to have the email address as the username
Does anyone run a jitsi install and have it setup to allow for human readable names rather that the #PrivSec problem of advertising email addresses?
