Avatar
jared
b726e71bce585201181ace89326ae428406cee071395f9bf12b62b62d0449b23
Cybersecurity. Identity. Powershell. Class of 2013. Degree in Bending from Bending State.

New world record set

At x games snowboarding big air final

Hiroto Ogiwara (Japan) with a 2340 mute grab!

https://www.redbull.com/us-en/japanese-snowboarder-hiroto-ogiwara-makes-history-x-games

New world record set

At x games snowboarding big air final

Hiroto Ogiwara (Japan) with a 2340 mute grab!

Replying to Avatar rare

šŸ˜“

Falling Down is an underrated movie

Gm nostriches

Yeah, how did it go for Wesley Snipes?!?

The IRS put Blade in jail for so long that even he, an ageless vampire, got too old to do shit in the MCU.

Triple the productivity baby!

Green policies = orange outcomes

"Millions of Accounts Vulnerable due to Google’s OAuth Flaw"

https://trufflesecurity.com/blog/millions-at-risk-due-to-google-s-oauth-flaw

I wonder if any other OAuth providers have similar issues and how they solve it.

#security #cybersecurity #infosec #oauth #googe

Most apps will be fixed only after google fixes this, so it’s not going away quickly.

"Millions of Accounts Vulnerable due to Google’s OAuth Flaw"

https://trufflesecurity.com/blog/millions-at-risk-due-to-google-s-oauth-flaw

I wonder if any other OAuth providers have similar issues and how they solve it.

#security #cybersecurity #infosec #oauth #googe

In any authentication scenarios that are claims based (SAML, OIDC/OAuth), it’s the responsibility of the app developers to select an immutable identifier claim but many developers will select email address (or a similar claim like upn) which relies on domain names that can be reused (thus not immutable).

So, this type of vulnerability likely exists in many apps regardless of the identity provider.

However, the problem here is that the identity provider doesn’t provide any consistent immutable identifiers for the app developers to have chosen.

Isn’t that how we got Chucky from Child’s Play?!? This little girl needs to stop playing with dolls and living on native burial grounds!

Where is she now? She must be stopped!

Once I trusted myself, I learned to understand protocols by reading the source RFCs, specs, whitepapers, etc. Prior to that it seemed like a dark art that was beyond me.

The first one is the most difficult. I recommend starting with RFC2119

https://www.rfc-editor.org/rfc/rfc2119

Now I can figure out for myself how much to trust a protocol.

Yes, Trust yourself.

Exactly. Been there done that. SMTP email is dead. A total cesspool of anonymous people vying for attention.

We need to be paid sats for viewing any ā€œmailā€ not in our first (maybe second) degree connections of our web of trust.

Spammers should get a lightning invoice from me for at least 100 sats just for me to accept the message!

Everyone’s saying mail but I want umbrel data and backup manager and or storage device mgmt