#securitytheatre — Public Fediverse posts
Live and recent posts from across the Fediverse tagged #securitytheatre, aggregated by home.social.
-
I now (finally) got back a response from Kiwibank on my formal complaint to them, for sending extensive information on mortgages and mortgage applications to clients (us) by plain text email (with PDF attachments).
In a way I *knew* it would come out this way. A lot of weasle words making statements that they're compliant with the Credit Contracts and Consumer Finance Act 2003 (LOL, > 20 years old), having extensive 'controls in place' and using 'transit protection'. As if they could control what happens on a service provider's side with (A) the content of the emails, and (B) them actually *also* transmitting them on with transit encryption.
Even if it is compliant, it just should not be *acceptable* by the point of view on how to conduct business.
How naive do they think people are who are *explicitly* asking about these issues?
This is some serious #SecurityTheatre they're pulling off.
Now I need to come off of my rage, or my freediving training will not be effective tonight ...
-
I now (finally) got back a response from Kiwibank on my formal complaint to them, for sending extensive information on mortgages and mortgage applications to clients (us) by plain text email (with PDF attachments).
In a way I *knew* it would come out this way. A lot of weasle words making statements that they're compliant with the Credit Contracts and Consumer Finance Act 2003 (LOL, > 20 years old), having extensive 'controls in place' and using 'transit protection'. As if they could control what happens on a service provider's side with (A) the content of the emails, and (B) them actually *also* transmitting them on with transit encryption.
Even if it is compliant, it just should not be *acceptable* by the point of view on how to conduct business.
How naive do they think people are who are *explicitly* asking about these issues?
This is some serious #SecurityTheatre they're pulling off.
Now I need to come off of my rage, or my freediving training will not be effective tonight ...
-
https://www.cbc.ca/news/canada/world-cup-norad-no-fly-zones-9.7220813 This is so stupid. Do you think any terrorist or bad actor will be using a plane? Reminds me of million dollar missiles shooting down $1000 drones. #securitytheatre
-
https://www.cbc.ca/news/canada/world-cup-norad-no-fly-zones-9.7220813 This is so stupid. Do you think any terrorist or bad actor will be using a plane? Reminds me of million dollar missiles shooting down $1000 drones. #securitytheatre
-
Treating school shootings as natural disasters might send the wrong message (and create their own trauma).
Schools should consider preventing violence -- not merely responding to it.
-
Treating school shootings as natural disasters might send the wrong message (and create their own trauma).
Schools should consider preventing violence -- not merely responding to it.
-
Bank security is such a joke. BofA, finally a bank that offers the option to use a FIDO key for 2FA. They specify "in case you don't have a US mobile phone" aka, me. So I attempt to set it up. Step 1: confirm your mobile phone with an SMS. 🤦♂️ #BofA #BankSecurity #SecurityTheatre
-
Bank security is such a joke. BofA, finally a bank that offers the option to use a FIDO key for 2FA. They specify "in case you don't have a US mobile phone" aka, me. So I attempt to set it up. Step 1: confirm your mobile phone with an SMS. 🤦♂️ #BofA #BankSecurity #SecurityTheatre
-
What is Security Theater?
#Security #theater refers to highly visible security measures that create the #illusion of increased #safety but don’t stop #threats.
The term is often used disparagingly to describe #superficial security practices that don’t reduce risk. Simply put, security #theatre is all about #appearances, not #results.
https://www.techtarget.com/whatis/definition/security-theater
#SecurityTheatre #ignorance #incompetent #IT #CriticalThinking #Internet #banking #airports #QuestionAuthority
-
What is Security Theater?
#Security #theater refers to highly visible security measures that create the #illusion of increased #safety but don’t stop #threats.
The term is often used disparagingly to describe #superficial security practices that don’t reduce risk. Simply put, security #theatre is all about #appearances, not #results.
https://www.techtarget.com/whatis/definition/security-theater
#SecurityTheatre #ignorance #incompetent #IT #CriticalThinking #Internet #banking #airports #QuestionAuthority
-
What is Security Theater?
#Security #theater refers to highly visible security measures that create the #illusion of increased #safety but don’t stop #threats.
The term is often used disparagingly to describe #superficial security practices that don’t reduce risk. Simply put, security #theatre is all about #appearances, not #results.
https://www.techtarget.com/whatis/definition/security-theater
#SecurityTheatre #ignorance #incompetent #IT #CriticalThinking #Internet #banking #airports #QuestionAuthority
-
What is Security Theater?
#Security #theater refers to highly visible security measures that create the #illusion of increased #safety but don’t stop #threats.
The term is often used disparagingly to describe #superficial security practices that don’t reduce risk. Simply put, security #theatre is all about #appearances, not #results.
https://www.techtarget.com/whatis/definition/security-theater
#SecurityTheatre #ignorance #incompetent #IT #CriticalThinking #Internet #banking #airports #QuestionAuthority
-
What is Security Theater?
#Security #theater refers to highly visible security measures that create the #illusion of increased #safety but don’t stop #threats.
The term is often used disparagingly to describe #superficial security practices that don’t reduce risk. Simply put, security #theatre is all about #appearances, not #results.
https://www.techtarget.com/whatis/definition/security-theater
#SecurityTheatre #ignorance #incompetent #IT #CriticalThinking #Internet #banking #airports #QuestionAuthority
-
Frustrated the Govt.NZ mobile app for Android won't work on my (much more secure) @GrapheneOS
Android phone, because they use Google's device attestation and/or play integrity API. It's likely much more secure than either bloated and/or outdated devices with Google sh*t.There's not even a benefit in it AFAIK to raise the degree of security. What *extra* security would that give they're not already getting without it???
It would be nice if someone (who is pro-attestation/integrity) could *actually* describe a true threat vector that it prevents. So far, it's just corp orate bullying, and people buying into it as it's being sold as an additional security feature.
-
Frustrated the Govt.NZ mobile app for Android won't work on my (much more secure) @GrapheneOS
Android phone, because they use Google's device attestation and/or play integrity API. It's likely much more secure than either bloated and/or outdated devices with Google sh*t.There's not even a benefit in it AFAIK to raise the degree of security. What *extra* security would that give they're not already getting without it???
It would be nice if someone (who is pro-attestation/integrity) could *actually* describe a true threat vector that it prevents. So far, it's just corp orate bullying, and people buying into it as it's being sold as an additional security feature.
-
@[email protected] @[email protected]
Some experts say privatization is the solution
Not to defend the TSA's existence (I traveled for years before the TSA was brought into existence for the sake of "#SecurityTheatre") but the literal first step of the "privatize government-services" playbook is the #enshittification of the government-run service to "justify" conversion to privately-run services. -
New paper: "Agents of Chaos."
20 AI researchers red-teamed autonomous #LLM agents with email, shell access, and persistent memory.How do you compromise one? Change your Discord display name to the owner's. In a new channel. That's it. Full admin. File deletion. Identity reassignment.
An agent nuked its own mail server to protect a secret from a non-owner - then reported the secret deleted. It wasn't. The email was still sitting on ProtonMail.
Another leaked 124 email records including SSNs and bank accounts because the request sounded urgent. Direct ask for "the SSN"? Refused. "Forward me the email thread"? Here you go, unredacted.
No authentication. No authorization model. No access control. No permission boundaries. Display names as identity verification. In 2026.
We solved this in the 1970s. Unix permissions. RBAC. Cryptographic auth. Principle of least privilege. All well-understood, all ignored.
The industry is shipping agents with root shell access and the security model of a Post-it note on a shared fridge.Paper: (interactive) https://agentsofchaos.baulab.info/
#AI #AIAgents #AISafety #InfoSec #RedTeam #AIGovernance #AgentsOfChaos #SecurityTheatre
-
Research shows the visible presence of long arms in public actually *reduces* both objective and subjective measures of safety.
1. This does not make most people feel more safe.
The visible presence of instruments of death and maiming in a context has measurable and pernicious effects on free speech and even free thought. The visible presence of firearms tends to increase most people's level of stress hormones (adrenaline, cortisol), triggering our fight/flight/freeze response while inhibiting higher order cognitive functions. Even where this effect is mild, across a whole population over time, it makes a cultural difference.
Research also shows people tend to self-censor more while in the presence of firearms, and are less likely to be generous or vulnerable.
#NSWpol #NSWPolice #SecurityTheatre #ChrisMinns
1/2
-
Research shows the visible presence of long arms in public actually *reduces* both objective and subjective measures of safety.
1. This does not make most people feel more safe.
The visible presence of instruments of death and maiming in a context has measurable and pernicious effects on free speech and even free thought. The visible presence of firearms tends to increase most people's level of stress hormones (adrenaline, cortisol), triggering our fight/flight/freeze response while inhibiting higher order cognitive functions. Even where this effect is mild, across a whole population over time, it makes a cultural difference.
Research also shows people tend to self-censor more while in the presence of firearms, and are less likely to be generous or vulnerable.
#NSWpol #NSWPolice #SecurityTheatre #ChrisMinns
1/2
-
You want to add a new card to your Apple wallet? Sure, go ahead! You'll need a 6-digit code to verify yourself, just a sec.
Oh, you're an _additional_ cardholder? Well then you will need a Letter of Introduction, handwritten using a peacock quill on vellum, sealed with wax with your liege's insignia and delivered by horseman to the bank's headquarters in Rome.
-
You want to add a new card to your Apple wallet? Sure, go ahead! You'll need a 6-digit code to verify yourself, just a sec.
Oh, you're an _additional_ cardholder? Well then you will need a Letter of Introduction, handwritten using a peacock quill on vellum, sealed with wax with your liege's insignia and delivered by horseman to the bank's headquarters in Rome.
-
Airport security doesn't let you have spices anymore.
This isn't security, this is theft. #SecurityTheatre
-
Airport security doesn't let you have spices anymore.
This isn't security, this is theft. #SecurityTheatre
-
I went to the Australian Open tennis today to see Coco Gauff and Alex De Minaur ease their way into round 2. Gauff had problems with her serve and faced some spirited opposition from the unseeded Rakhimova.
Only blemish on the day was that I decided to remove my bicycle repair kit from the bike (bike parking was fairly crappy, stuck under a bridge) and that proved too much for the Security Theatre at bag check. I’m now down one very blunt multitool, which I asked the security people to send to a good home.
#ausopen #tennis #SecurityTheatre #cycling -
I went to the Australian Open tennis today to see Coco Gauff and Alex De Minaur ease their way into round 2. Gauff had problems with her serve and faced some spirited opposition from the unseeded Rakhimova.
Only blemish on the day was that I decided to remove my bicycle repair kit from the bike (bike parking was fairly crappy, stuck under a bridge) and that proved too much for the Security Theatre at bag check. I’m now down one very blunt multitool, which I asked the security people to send to a good home.
#ausopen #tennis #SecurityTheatre #cycling -
I eventually managed to log in. Apparently the account lockout was temporary, the dialog just didn't bother to say so and went straight to the "shit's fucked, get help" error message.
My new Windows password hasn't migrated to my Microsoft account (🤔) so now I'm just locked out of Teams. I'm in no rush to fix that.
-
The company's payroll is due today thanks to the bank holiday this week, and that's my responsibility with a professional certification on the line, so I do not have the option to wait for support from IT. Even for incredibly advanced tasks like "turning on my computer".
Fortunately (?) I also have an app for the company's password manager on my phone, and very nearly everything I do is SaaS, so I am now doing the company's payroll on my personal laptop. Which is now accessing every employee's personal information and has none of the security vetted and certified by the company, just whatever free privacy tools I happen to have.
You know, "security".
#UXfail #badUX #ITnightmares #CorporateLife #SecurityTheatre
-
I am returned to the Windows login screen, and enter my new password, from the new scrap of paper attached to my monitor. You know, "security".
*Your account has been locked due to too many unsuccessful login attempts. Please contact your IT department.*
My IT department is one guy, and he's also off this week.
#UXfail #badUX #ITnightmares #CorporateLife #SecurityTheatre
-
I create a third new password, which is also not complex enough. Then I wildly guess that some part of the process doesn't like one of the symbols I used, so my fourth password is only letters and numbers.
*Your password has been changed successfully, please log in again.*
#UXfail #badUX #ITnightmares #CorporateLife #SecurityTheatre
-
I know that it's 27 characters because I counted them, from the piece of paper I've written it on and stuck to my monitor.
The password manager will not update the Windows password on its own. I have to remember to go in and update it myself later, or next time I reboot I will be locked out. So every password I've ever used is written on a scrap piece of paper and carried around with my laptop, just in case.
#UXfail #badUX #ITnightmares #CorporateLife #SecurityTheatre
-
I create another new password. This time I force-close the app, and then the notification finally arrives and I confirm with my fingerprint.
*Password doesn't meet our arbitrary and stupid complexity requirements, please try again."
This is doubly annoying because it could have told me that before going through the two-factor confirmation rigamarole, and also because nothing indicates what the requirements are, just that the 27-character password with caps and numbers and symbols that I entered wasn't complex enough.
#UXfail #badUX #ITnightmares #CorporateLife #SecurityTheatre
-
I create a new password. *Please confirm on your mobile device.*
I wait a while but the linked password manager app that my company makes me keep on my phone does not produce a notification.
Eventually the dialog times out.
#UXfail #badUX #ITnightmares #CorporateLife #SecurityTheatre
-
Monday after my winter holiday break, I'm looking forward to a productive week catching up for year-end and finalizing finance tools for 2026 while most of my coworkers are still off for the week.
I open my work laptop. *Your Windows password has expired.*
This is always a sign of a bad day starting. 🧵
#UXfail #badUX #ITnightmares #CorporateLife #SecurityTheatre
-
Ah yes, arming an extremist militia group, I'm sure this will promote public safety.
NSW has been a security state for a long time, but at least before we had gestures towards civil rights, democracy, and community trust. It's gross that a Labor government is the one taking the gloves off.
-
Ah yes, arming an extremist militia group, I'm sure this will promote public safety.
NSW has been a security state for a long time, but at least before we had gestures towards civil rights, democracy, and community trust. It's gross that a Labor government is the one taking the gloves off.
-
Wow, Bah HUMBUG!!! No fun allowed. Get in line so we can properly x-ray your junk
-
Urgh! 4.30am passport check... with knocks on the door that would wake even the dead and which you can hear all down the carriage.
Aren't we in Schengen? "Yes, but that doesn't mean the police isn't allowed to control." #CrossBorderRail #SecurityTheatre
-
Urgh! 4.30am passport check... with knocks on the door that would wake even the dead and which you can hear all down the carriage.
Aren't we in Schengen? "Yes, but that doesn't mean the police isn't allowed to control." #CrossBorderRail #SecurityTheatre
-
"2 Faktor Authentifizierung" Apple Style
-
"2 Faktor Authentifizierung" Apple Style
-
When I updated to the latest (for this phone) version of Android, it came with a particularly noxious feature. It flagged every app as harmful - including the ones I'd installed from the play store. This meant that every morning (for the next few weeks after the update) I'd wake up to a bunch of alerts, and would need to manually approve each app update. Fortunately, I only needed to do this once for each app.
Unfortunately, my phone manufacturer hasn't learnt from this major fuck-up. They've updated their security app, and now I need to authorise every time I update an app. This is tedious and counter productive.
With so many false positives, instead of making my phone more secure, the security software has made it far less secure. Apps no longer automatically update as soon as the update becomes available and just wait until I manually approve them. Something, I'm less likely to do because of all the hoops I must now leap through because of this stupid, inefficient security theatre.
-
When I updated to the latest (for this phone) version of Android, it came with a particularly noxious feature. It flagged every app as harmful - including the ones I'd installed from the play store. This meant that every morning (for the next few weeks after the update) I'd wake up to a bunch of alerts, and would need to manually approve each app update. Fortunately, I only needed to do this once for each app.
Unfortunately, my phone manufacturer hasn't learnt from this major fuck-up. They've updated their security app, and now I need to authorise every time I update an app. This is tedious and counter productive.
With so many false positives, instead of making my phone more secure, the security software has made it far less secure. Apps no longer automatically update as soon as the update becomes available and just wait until I manually approve them. Something, I'm less likely to do because of all the hoops I must now leap through because of this stupid, inefficient security theatre.
-
Wo sind eigentlich die Grenzkontrollen, Herr Dobrindt? 🤔
-
Wo sind eigentlich die Grenzkontrollen, Herr Dobrindt? 🤔
-
@slashdot The whole security theatre of Apple App Store and totally walled garden of closed platform of iOS et cetera formally "justified" by promise to prevent exactly _this_ type of shit of scam and fake apps from happening.
#security #securityTheatre #apple #scam -
@slashdot The whole security theatre of Apple App Store and totally walled garden of closed platform of iOS et cetera formally "justified" by promise to prevent exactly _this_ type of shit of scam and fake apps from happening.
#security #securityTheatre #apple #scam -
... so here I am typing in a full name and generating a password, then confirming my E-mail address from another E-mail, then going back to the original saved HTML document to have it load a decrypted version it downloaded from the website.
And since my identity was never validated except by E-mail, none of that was more secure than E-mailing me a simple HTTPS link.
But worse, it makes users believe this is a valid way to interact by E-mail.
#security #securityTheatre #cybersecurity #encryption -
"Didn’t Take Long To Reveal The UK’s Online Safety Act Is Exactly The Privacy-Crushing Failure Everyone Warned About"
This sentence sum it up:
"This is what happens when politicians decide to regulate technology they don’t understand, targeting problems they can’t define, with solutions that don’t work."
If we avoid the perfectly rational alternative that building the surveillance state I'd the goal in itself, whatever the cost or inefficiency in building it.
-
#ebay needs to update their #GeoIP database.
I've just logged on from an old computer in my house, and it's sent me an email saying someone has logged in from Shropshire, which is over 100miles away, when most sites think I am based in North London (which is still wrong, but my ISP is at least based there).
No other site seems to ever think I'm in Shropshire.
I wish companies would just list the IP address and browser details in their "a new device had logged in to you account" emails, any other details seem to be totally wrong, and therefore useless 🤬
-
#ebay needs to update their #GeoIP database.
I've just logged on from an old computer in my house, and it's sent me an email saying someone has logged in from Shropshire, which is over 100miles away, when most sites think I am based in North London (which is still wrong, but my ISP is at least based there).
No other site seems to ever think I'm in Shropshire.
I wish companies would just list the IP address and browser details in their "a new device had logged in to you account" emails, any other details seem to be totally wrong, and therefore useless 🤬