Authentication and Passwords
The trouble with decommissioning a used FIDO security key
You can’t throw out your worn-out USB security keys when you can’t recall what locks they’re for. Physical security tokens come with their own problems.
Security
Authentication and Passwords
Norway’s BankID undermines anti-phishing best practices
An easily-spoofed iframe embedded onto every random online merchant’s websites is not a safe place to enter my bank password! Is it really BankID‽
Security
SELinux is unmanageable; just turn it off if it gets in your way
I’ve been an SELinux complexity apologist for years. Lately, I’ve concluded that every implementation with difficult-to-configure policies is just unmanageable.
MacOS
Should you trust a third-party bootloader to run newer MacOS versions?
OpenCore lets you run the latest MacOS on unsupported Apple legacy hardware (and PCs). But software that bypasses security restrictions requires a lot of trust.
Security
Closing the open redirect vulnerability in the Libravatar ecosystem
I found an open redirect vulnerability in the Libravatar specification. An open-source avatar hosting API could be abused to redirect to untrusted websites.
Security
Patch origin trust vs GitHub’s URL hierarchy
Opening a pull request is all it takes to get a GitHub patch URL that’s indistinguishable from patches/commits that are a part of an open-source GitHub project.
Authentication and Passwords
Your clipboard is only as secure as your device
A review/critique of the complexity, security, and unpredictable user experience of modern feature-laden copy–paste clipboards in today’s operating systems.
Security
Superfeedr sends logins in plain-text (a HSTS case study)
Superfeedr tried securing its website with HTTPS and HSTS, but failed to apply it correctly. User emails and credentials are sent in plain-text on the first login.
Security
The entirely predictable problems with the Vulnonym naming scheme
An automated naming scheme intended to rid the security research field of “sensational names” predictably creates sensational, ambiguous, and suggestive names.
Security
TeamViewer RPM repo left door open for malicious packages
A configuration error made the TeamViewer RPM repository vulnerable to an attacker-in-the-middle substituting TeamViewer with its own GPG keys and software.
Security
Google Authenticator enables device-transfers, but no export options
Two-factor authentication requires users to commit to storing a secret code indefinitely. Popular apps lack tools to back up and data transfer those secrets.
Authentication and Passwords
How to back up your password manager
Plan for the day your password manager stops working. Even if it’s a cloud service! Backing up your password manager is harder that it sounds.