VP of Security where your bank's data lives. GIAC alphabet soup. Play in a rock band. One of these definitely pays better. Opinions are my own.
Vero Beach, FL
Joined August 2009
- Tweets136
- Following437
- Followers88
- Likes749
I'll keep saying it until it stops being true.
The management interface of your firewall/VPN/load balancer does NOT belong on the internet. Put it on a management network. No, not even temporarily for the vendor either (we all know how temporary goes).
If you can hit the login page from your phone on LTE, so can everyone else and their AI Agents.
12
Every third-party script executing on a logged-in page is an unreviewed deploy that runs as your users.
On Oct 29, Polymarket's DebugBear monitoring script was swapped for a wallet drainer. It drained accounts via the site's own trading client.
We need zero-trust to apply to webdev too.
Self-host and pin it with SRI, or kill it.
finance.yahoo.com/markets/cr…
59
If your contact list leaks, someone else now has a ready-made phishing list and they didn't have to do any of the work to build it.
If you build products, please take a hard look at what data you're sending to analytics vendors. *Anything* identifiable can introduce risk.
Ultimately, the password conversation needs to shift. Length still matters, but the bigger question now is what your second factor is. SMS codes and push approvals can be phished. Passkeys not so much.
nitter.cf/cz_binance/status/2115…
4 data leaks reported today:
1. Coinbase's vendor Amplitude exposed some users’ contact data (funds unaffected).
2. Bithumb (Korea) had user data leaks.
In TradFi, two securities firms in Korea leaked data:
3. Mirae Asset
4. Daishin Securities
You can't prevent a leak, but you can protect yourself.
Leaked exchange data (names, emails, phone numbers, addresses, ID documents, transaction history) is mostly used for phishing, SIM swapping, and social engineering.
Reduce info you share
- Use a unique email alias for each exchange (SimpleLogin, Apple Hide My Email, etc). A leak then can't be linked to your other accounts, and you can spot which service leaked.
- Share only what's required. Don't add optional profile details.
- Use a dedicated phone number (a VoIP or secondary SIM) for exchange accounts if you can, since leaked numbers are the main route to SIM swaps.
Lock down the account
- Use a unique, long password from a password manager.
- Turn on hardware security keys (YubiKey) or passkeys, or at least an authenticator app.
- Avoid SMS 2FA.
- Enable withdrawal address whitelisting and a withdrawal time lock if the exchange offers them.
- Set up an anti-phishing code, which puts a code you choose in every legitimate email from the exchange.
- Review active sessions and API keys regularly. Delete any API keys you don't use.
- Restrict API keys to withdraw-disabled and IP-whitelisted.
Defend against
- SIM swapping: Ask your carrier to add a port-out PIN or number lock.
- Phishing and impersonation: Assume anyone who contacts you about your account, "security issues," or "refund recovery" is a scammer, even if they know your name, balance, or recent trades.
- Exchange support staff don't ask for your password, 2FA codes, or seed phrase.
- Never click links in emails or texts. Go to the site yourself.
- "Wrench attacks": Leaked addresses plus holdings data have led to real-world extortion and robberies. Don't publicize your holdings, and keep large balances out of anything tied to your home address if you can.
If a breach is announced
1. Change the exchange password and any other account that reused it.
2. Check haveibeenpwned.com for your email address.
3. Revoke API keys and active sessions.
4. Review recent withdrawals and security settings.
5. Watch for phishing emails and texts that reference the breach, because scammers move fast after one.
Stay SAFU! 🙏
6
Public-key crypto does not absolutely prove secrecy. It was built around a cost gap, ultimately. Decrypting without the private key should cost more time and resources than the data is worth. That is what the "trust" rests on. Meaning, if you get at my journal in 200 years, I probably don't care. I'm long gone.
RSA, ECC, and the discrete-log systems all live in that gap. With the applicable key, the door in is cheap. Without it, you are stuck on factoring or a related hard problem at today's algorithms and machine speeds. That is changing, though. "Hard" here is a work-factor estimate, not a proof the problem stays hard. Enter the frontier AI models that are math magicians.
Number theory keeps producing better attacks. Compute keeps getting cheaper. Quantum is a different (albeit additional) pressure on said gap. But classical improvements do not need a new machine class to matter.
Treat key size and algorithm choice like a lease. Size them to how long the data stays sensitive, rotate before the margin looks thin and assume anything you need to remain secret for decades will eventually meet a cheaper attack.
If better math shows up faster than expected, boy that lease gets short in a hurry. I'm not smart enough to predict the date that happens, but things are getting "weird" pretty quickly.
34
If a sign-up form rejects your password for having a space, an emoji, or more than 16 characters, that is not a security feature. It’s a confession.
A properly hashed password does not care what you type. Argon2 and bcrypt will happily chew through a paragraph, a string of punctuation, or the entire text of Beethoven’s 5th.
The only systems that panic at an apostrophe or a character past position 20 are the ones still treating your password like a column in a spreadsheet from 2004. Or worse, like something they might need to read back later.
Length limits and “no special characters” rules do not make brute-force attacks harder. They make the password easier to guess and tell you the site is doing at least one thing it should not be doing: truncating before hashing, stuffing the raw value into a field that breaks on certain bytes, or keeping it recoverable so support can “look it up.”
Your password manager is not the problem. The sites that fight it is (don’t even get me started on the disabling of paste).
1
41
Unfortunate that @BreezeAirways wouldn’t let me bring my guitar onboard in its soft shell case. Said I couldn’t bring it on, even though I’ve brought it many times before. I swore they had to allow me. Hopefully it doesn’t get damaged.
7
5
27,285
Should mention I’m a frequent flyer and a stones throw from their highest status. Not that I need special treatment, just saying this isn’t my first rodeo.
65
Doors closed. Empty seat right next to me, several right in back of me. Do better guys. Come on.
1
72
The answer when I asked about what happens if it gets damaged: “that’s why you sign a limited liability waiver”. Gee. Thanks.
96
People say they have nothing to hide.
They don't mean it. Or they haven't thought about what they're actually saying when they utter those words.
Nobody wants their driver's license number posted for everyone to see. Or their Social Security number. Or their bank account number. That's private information. Everyone gets that. So the "nothing to hide" line is almost never about that stuff. It's about something specific.
Enter Flock cameras.
For the "nothing to hide" populous, the assumption is that they trust the people running the cameras, so their data is fine.
That misses the point. It isn't just that one department, or that one HOA board. Other people have access on top of the originator. Other agencies can search it. Sharing into the bigger network is often ON unless somebody turns it off, and the entity that owns the camera can't always see who ran the search.
And that's just today. Tomorrow the company can sell the data, get bought, or sign a contract we never agreed to (not that we agreed to the first one). Repo companies have been scanning plates for years and selling the time and location logs to auto finance and insurance. This isn't a new idea.
So what if it's YOUR insurance company, and they decide if your driving should cost more? What if it's your leasing company, and they start asking where the car has been and how you're using it? What if it's a retailer suggesting you should stop in? Plenty of companies would pay for a record of where your car goes. You'd care about your privacy then?
That's before the security problem. These cameras WILL get hacked. The camera itself or the company, but likely both. We don't even know the full set of data they're pulling in (and saving indefinitely). A pulled Flock camera already gave up an encryption key. Logs off a single unit covered about 50,000 vehicles and 1.6 million images in three weeks, and the software wasn't just reading plates. It was picking out people.
Are we good with that dump going to the internet? To our employers? To our friends and family? To somebody who doesn't like us?
This isn't theoretical misuse either. A Milwaukee officer got charged for using Flock to track someone he was dating AND that person's ex. A Texas deputy ran a search across tens of thousands of cameras. Marin County's data got shared with out-of-state and federal agencies hundreds of thousands of times in a month, which California law doesn't allow. Boston thought sharing was off (and it wasn't). Ok? Flock already told Congress they don't oversee the searches. They leave that to the agencies who contracted Flock.
We don't have to be doing anything wrong to care about this. Medical care. Church. Lawyer's office. Job interview. Our kid's school pickup. A trip out of state. The house sitting empty while we're gone. An ex on an HOA board. A neighbor with a login. None of that is criminal. All of it is ours.
If you say you have nothing to hide, I want you to know that you do. And you should care.
115
#Security isn't about perfection. We have to be mindful and not let perfection be the enemy of good. There are only so many hours in a day. If we focus our time on the right areas, we win. #cybersecurity #informationsecurity #riskmanagement
I scroll through my feed of infosec pros, and I’m seeing precisely zero tweets about infosec. Is this the new norm? 😔
1
#FixTheFuture - Hey @PCISSC, can we increase the password length requirement to something more than 7 characters?
4