Peter T. LaComb Jr.

My tweets are my own. He/Him

[Peter T. LaComb Jr. @PeterLaCombJr]

@davidfowl The other big difference should be that STS versions are more likely to include experimental-tagged features so that they can back before going LTS, but that’s just my opinion.

[Peter T. LaComb Jr. @PeterLaCombJr]

Can I change my vote? Maya Rudolph for president.

[Peter T. LaComb Jr. @PeterLaCombJr]

@davidfowl What are the chances someone has an exploit and is phishing with a “please, announce your platform so that we can target you.”?

[Peter T. LaComb Jr. @PeterLaCombJr]

@davidfowl I use a script that adds every project in the directory and below to a new sln. That’s how much I hate the current format.

[BlackRoomSec @blackroomsec]

Please share this far and wide. As far and wide as you can. NIST Password Guidelines for 2024 are in the process of being updated.

This is a HUGE pet-peeve of mine (when vendors in particular are still operating like its 2017 and keep changing passwords every 60 days, STOP DOING THIS, it's outdated and has been shown to put you MORE at risk than less -- NIST explains why it does in this document, meticulously outlining user behavior**) so I'm sharing this in the hopes all of you will pass it along to your bosses.

The Special Publication series governing passwords is SP 800-63 "Digital Identity Guidelines".

The 2024 version is 800-63-4.

Here: https://t.co/oX8YEJHxXg

The companion docs are also on that link. They are 800-63A, 800-63B and 800-63C. These are different documents for different scenarios in play at your org.

The previous update was in2020.

The changes in the 2020 version from the 2017 version were numerous but one of them was that the password verification method should NO LONGER require passwords be changed at specific intervals (i.e. every 60 days) but in the following circumstances instead:

1. After a breach/compromise
2. User request

2024 repeats this and adds a bunch more guidlines but here is a screenshot of page 13 of the new 800-63-4 (note the # 4 after it) which outlines how your systems should now and moving forward, be handling passwords.

This goes for Active Directory, too. All your systems which have passwords should align with these guidelines provided there isn't another standard or framework you must adhere to which overrules this.

Most frameworks, however, have moved away from arbitrary password resets and complexity rules.

**We cybersec researchers and hackers use wordlists from breaches in a variety of different ways. Hackers use them in tooling to crack passwords whereas researchers use breach dumps to see the kinds of passwords users are creating and the psychology behind them.

Using complexity rules gets you the user psychology of:

Password1
Password2
and so on

Use phrasing instead and allow for spaces, which is important. Humans type phrases with spaces. They also mention phish-resistant methods and most vendors are on-board with MS going to be turning off all Legacy Auth next month, across all free accounts and tenancies.

I'm so excited for the new changes!

Ok I'm off my soapbox.

Share the love! Thank you!

[Peter T. LaComb Jr. @PeterLaCombJr]

@elonmusk STFU Elon. You don’t even want your own kids.

[Peter T. LaComb Jr. @PeterLaCombJr]

@wjxt4 That's because so many assholes throw trash out of their cars. Just ask any cyclist in town as they are often targets.

[Peter T. LaComb Jr. @PeterLaCombJr]

@migueldeicaza Nissan Ariya

[Peter T. LaComb Jr. @PeterLaCombJr]

@rossipedia So, a memory leak?

[Peter T. LaComb Jr. @PeterLaCombJr]

@PapaJohns Only if you eat it cold.

[Peter T. LaComb Jr. @PeterLaCombJr]

@staugrecord Never put off today what you can put off tomorrow. What did we elect these people for?

[Peter T. LaComb Jr. @PeterLaCombJr]

@satanic_temple_ I stand ready to assist if chaplain positions open up in St. John’s county.

[The Satanic Temple @satanic_temple_]

In anticipation of the Osceola County School Board's vote on a school chaplain policy this evening, The Satanic Temple has sent a letter outlining what this could mean for the community. Stay tuned for more!

[Peter T. LaComb Jr. @PeterLaCombJr]

@terrajobst This is a needed change. Just wish some of the code I’ve been using lately would get with it and get away from BinaryFormatter. Having to write my own workaround was not fun.

[Peter T. LaComb Jr. @PeterLaCombJr]

@IanColdwater We just need to get the AI to invent some new crypto and generate ads for it.

[Peter T. LaComb Jr. @PeterLaCombJr]

@rossipedia That’s my life in Florida.

[Peter T. LaComb Jr. @PeterLaCombJr]

@JSOPIO Too bad so many of your officers fail to use theirs.

[Peter T. LaComb Jr. @PeterLaCombJr]

@SJCSD Please fire the vendor who created that app. Web pages shouldn’t be restricted to 1024x768. Also, I bet if I checked, it’s not accessible to screen-readers or other assistive tech, meaning it’s a WCAG fail.

[Barack Obama @BarackObama]

There is absolutely no place for political violence in our democracy. Although we don’t yet know exactly what happened, we should all be relieved that former President Trump wasn’t seriously hurt, and use this moment to recommit ourselves to civility and respect in our politics. Michelle and I are wishing him a quick recovery.

[Peter T. LaComb Jr. @PeterLaCombJr]

@rossipedia