|
If you are the kind of dipshit that runs a virus on a prod machine, there is no excuse to not set up this https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-sandbox/windows-sandbox-overview
|
![]() |
|
![]()
|
# ¿ Sep 1, 2024 00:58 |
|
Achmed Jones posted:do you actually think the person was thinking ahead? He was an admin on a mspaint discord so no.
|
![]() |
|
ZeusCannon posted:Im gonna out myself as an idiot for a moment here and ask a probably dumb question. Depending on the keepass database importance, i set up a yubikey to execute a challenge as MFA on critical ones. KeepassXC does it natively (guide at https://keepassxc.org/docs/#faq-yubikey-2fa) on win/mac/linux, keepassium does it on ios/ipados.
|
![]() |
|
Powerful Two-Hander posted:hooooly poo poo did I just find a fuckup Isn't that standard keycloak behaviour? I don't think you can do much to mitigate it.
|
![]() |
|
Achmed Jones posted:el mero mero is right. there's a ton of people who won't use totp but will uses sms mfa. they are much better off with sms mfa than no mfa. that there's another better (but less user friendly) choice is irrelevant and misses the point If they are on that level of non-technical, iOS has native TOTP and security key in the os at the tip of their finger(or face).
|
![]() |
|
post hole digger posted:random question but what is considered the standard for enterprise wifi these days? is it still certificate-based 802.1x managed by radius with adfs issuing the certs? do any companies have any interesting alternatives to that model? in particular, the adfs component of it? how is azure ad as an adfs replacement for x.509 certs? The very high end cloud-managed wifi from aruba will let you do client enroll with an app that checks the client security stance and use saml for credentials so you can use mfa for extra security.
|
![]() |
|
Subjunctive posted:Question from a friend: Is there a security key that exists that supports U2F and FIDO2, has a fingerprint scanner and NFC or BT? If you can skip u2f, feitian makes one https://www.ftsafe.com/Products/FIDO/Bio
|
![]() |
|
mystes posted:Is it really possible for a device to support fido2 without supporting u2f? IIRC fido2 is just u2f with an additional mode that allows keys to be stored on the device so I don't think it should be possible, and I would guess that this is just some sort of mistake in the feature comparison table. The underlying logic is the same but the user side api are different(ctap1+uaf vs ctap2+webauthn2), so it's possible that they only expose the current ones. A lot of sites calls fido2 as second factor u2f when it's not a fido1 api call.
|
![]() |
|
Midjack posted:80 bucks a month is enough to get a subsidized decent phone and good enough data plan for work only, isn't it? I can get a 5g unlimited plan for 20€/month and an iphone 14 for 30€/month (33 installments) easy so yeah.
|
![]() |
|
infernal machines posted:i am sincerely regretting having implemented azure information protection for a client If this was a greenfield deploy why did you use AIP instead of MIP? AIP isn't natively integrated in sharepoint/onedrive/office but relies on several moving parts to work compared to the mostly transparent MIP.
|
![]() |
|
I do am curious to see how the google equivalent of MIP works, every big google tenant i interacted with had a security stance of "YOLO".
|
![]() |
|
dpkg chopra posted:ok someone correct me if I’m wrong On iPhone you can have a managed device or a supervised device. Supervised is far more powerful in the remote management options but require the device to be set up using ABM at purchase or with configurator(and then wiped). Managed will still provide lot of data so I strongly advise to contact your company to have them send you a cheap burner phone.
|
![]() |
|
Beeftweeter posted:afaik configurator doesn't work anymore? i'm not sure you can do that with modern ios versions I've used it two days ago on an iPadOS 16.4 device to enroll it onto ABM so no, it still works fine.
|
![]() |
|
Beeftweeter posted:oh huh. maybe i was thinking of configuration utility? i haven't done MDM stuff in a real long time The apple original MDM solution that talked to an Apple MacOS Server (Profile Manager and Managed Preferences) is no longer functional, maybe you were remembering that? Every active MDM solution will ask you to tinker with Configurator 2 (forcing you to get at least one MacBook and one iPhone since there is no windows build) Intune has this flow to enable supervised on devices purchased outside of ABM https://techcommunity.microsoft.com/t5/intune-customer-success/how-to-manually-add-devices-in-apple-business-manager-abm-or/ba-p/2328462
|
![]() |
|
zero knowledge posted:fortunately the EU is bringing back the glory days of EV with eIDAS and QWACs so you'll get to have those asinine arguments forever. The only change is rather than reselling geotrust certs, your cert provider will resell one from a EIDAS enabled CA.
|
![]() |
|
Isn't ZIP files password protection trivially easy to unlock? I remember 7zip clamoring their password protection being the sole decent implementation when it was new ![]()
|
![]() |
|
Soricidus posted:the classic algorithm, which I don’t think anything still uses, was cryptographically broken. modern zip files have to be brute forced, iirc they aren’t gpu resistant or anything but a strong enough password can be secure I think windows explorer still uses the old ZipCrypto method, not AES-256 like winzip or others.
|
![]() |
|
nudgenudgetilt posted:how does keepassxc's mfa support actually secure the data though? is the yubikey being used for a cryptographic operations, or is it keepassxc just "lol, yeah, you got the static yubikey and master password, take what you need" It uses the OTP generator part of the yubikeys, keepassxc docs are kinda lame but keepassium uses the same logic to work and explain how to set them up https://keepassium.com/articles/how-to-use-yubikey/ You set up a seed on one of the two HMAC-SHA1 slots on one(better if multiple) yubikey and it will provide the codes if the correct button is pressed.
|
![]() |
|
PIZZA.BAT posted:i've spent like 30 seconds looking but it doesn't look like this has ios integration :\ Keepassium works on ios, the same keepass file can be opened on keepassxc on windows, mac and linux with chrome and firefox browser plugins.
|
![]() |
|
MrMoo posted:New business model on cloud now, charge $21 per user per month to log logins, You get access log at every tier, it's just retention over 30 days is paid for. At about 1€/$ every 500k logins for a year retention. Whoever did that article never used 365 beside opening outlook.
|
![]() |
|
well-read undead posted:so to turn this discussion another way: what’s a SIEM people do like? or, rephrased, what’s least bad? We are happy with Sentinel. It might not be the best for huge environments but fits us fine.
|
![]() |
|
The Fool posted:There were also professionally made ones like ERD and the Best Buy Geek Squad one. Microsoft still expects to be paid for DART, which is the only reliable way to unlock passwords on nvme drives(the usual offline windows password & registry editor seems to croak on newer bitlocked nvme drives). You get it if you have e/a 3 or 5 licenses in your tenant.
|
![]() |
|
Jenny Agutter posted:apparently Naomi Wu got silenced for talking about a vuln in a popular Chinese third party keyboard, in addition to all the other stuff that makes her unpopular with the CCP. https://www.hackingbutlegal.com/naomi-wu-and-the-silence-that-speaks-volumes/ Being a public figure with an uyghur boyfriend is a sure fire way to get the rozzers attention, double so raising awareness of hidden backdoors in commonly used software for the domestic market. It was a matter of time sadly.
|
![]() |
|
Sywert of Thieves posted:It's 99% background info & fluff. I gave up reading it after 10 pages when it still wasn't getting to the point. I was so badly written they omitted the LGBT angle(which i learned from the replies here) that was relevant in the grand scheme of things while having pages worth of white noise.
|
![]() |
|
Zamujasa posted:i think isp-enforced equipment should be banned out of existence It is in Europe! But ISP give zero fucks, hiding behind a "if you really want, we'll let use your kit but at higher prices and less services for the trouble". To be really honest, most of the ISP here used technicolor(which are decent) for their vdsl to gpon routers but their new xgspon services are using sagem(which are poo poo) so that pretty much killed my interest in upgrading. SlowBloke fucked around with this message at 11:20 on Aug 21, 2023 |
![]() |
|
Cybernetic Vermin posted:and to be clear i don't mean "just add nonsense to software", i mean that 7zip is up there with gnome in the category of "lets just do the barest possible minimum copy of a thing that already existed" which is the worst kind "community" effort If you want 7zip with a slightly more windows aligned ux there is nanazip, it also uses modern api for extensions(windows will auto populate unused extensions) and menus(it works with windows 11 contextual menu).
|
![]() |
|
Volmarias posted:Same but I also recognize that we are all turbo nerds who like nice, neat Italy has also second level domains for cities or counties with sometimes either shortened or full length if not both. Thankfully very few people uses them since it generated incredibly long domains and made seo hell.
|
![]() |
|
Potato Salad posted:is a yubikey still safe or did they gently caress a duck too NXP just notified the world that they got hacked and the attacker kept accessing data, searching for chip schematics and microcode for several years. https://arstechnica.com/security/2023/11/hackers-spent-2-years-looting-secrets-of-chipmaker-nxp-before-being-detected/ Several FIDO2 key makers, yubico included, uses NXP chips.
|
![]() |
|
mystes posted:Is it possible to gently caress up the fido2 authentication flow in such a way that the browser will ask for a pin even when no pin is set? Asking because bank of america now seems to have figured out a way to to do this, which I guess would be a problem if you couldn't just say "nah I don't feel like using fido2 right now" Webauthn/fido2 can require a pin during credential enrollment and logon. It's up to the website to require it or not, Microsoft 365 account will mandate it for instance. https://www.w3.org/TR/webauthn-2/#enum-userVerificationRequirement SlowBloke fucked around with this message at 21:13 on Dec 11, 2023 |
![]() |
|
Subjunctive posted:so if not Ubiquiti/Unifi, what’s the hotness for in-wall APs and PoE switches and stuff? Once i grown tired of unifi bullshit, i moved to zyxel nebulaflex. If you feel that the government is watching you you can run them standalone, otherwise you can run them on cloud-based management.
|
![]() |
|
Pile Of Garbage posted:someone has setup a fake notepad++ download website, notepad[.]plus, and the og author is mad: https://www.bleepingcomputer.com/news/security/notepad-plus-plus-needs-your-help-in-parasite-website-shutdown/ If the dev wasn't such a pissbaby about code signing, this wouldn't be an issue. https://www.bleepingcomputer.com/news/software/notepad-no-longer-code-signed-dev-wont-support-overpriced-cert-industry/
|
![]() |
|
rjmccall posted:i’m not sure what that mechanical process would even be except essentially making governments act as cas Welcome to eidas hell, we have such sights to show you.
|
![]() |
|
![]()
|
# ¿ Sep 1, 2024 00:58 |
|
Captain Foo posted:caught up on The Wayne Thesis, and lol Secfuck 18.52: Cruel Wayne Thesis.
|
![]() |