Christina

IAM Ninja, Defender Against the Digital Dark Arts™, & Token Aficionado — 🚗 I live on sour gummy worms, ramen, & bad puns. Views are my own. She/Her

[Christina @TheIAMNinja]

In life, it’s not about 𝘄𝗵𝗮𝘁 happens to us — it’s 𝒽𝑜𝓌 we choose to 𝘷𝘪𝘦𝘸 what happens.
Perspective is a powerful thing.

[Christina @TheIAMNinja]

@andreaisawriter I didnt cheat — every exam was in-person, proctored, w cameras, & identity confirmation. My school has a zero tolerance policy for cheating & plagiarism.

I made countless quizlet decks, took my own notes, studied for hours each week, & wrote my own essays.

Not everyone cheats.

[Christina @TheIAMNinja]

@divinetechygirl Also sooo happy for you!! :D

[Christina @TheIAMNinja]

@divinetechygirl Any advice on how to prep for the course?! I saw many Reddit posts that were mentioning not only waiting to take it as the last course, but also recommended taking xtra programming courses and getting Pentest+ (or OSCP or equiv) before taking CS6035… :/

[Christina @TheIAMNinja]

@divinetechygirl Note to self: take ONLY this class for one semester… lol

[Christina @TheIAMNinja]

@divinetechygirl Im planning on getting my Masters of Cyber from GATECH… sounds like it will be intense. 😳

[Christina @TheIAMNinja]

Random person: “Can u confirm where u live?”

Me: “Sorry, no, I cant confirm that.”

Them: “…u cant confirm where u live??”

Me: “No…how did u get my info?”

Them: “um Idk. I have ur cell, zip, & district #… so Question 1. Can u confirm u live in _?”

*hangs up, blocks number*

[Christina @TheIAMNinja]

@NateB_Panic Fun fact: plenty of viruses can cause long term harm.

For ex, Post-polio syndrome (PPS), HIV/AIDS, etc.

Heck even chicken pox “persists” & leads to Shingles which can cause postherpetic neuralgia (PHN), a long term nerve pain. Even shingles can (in some instances) be fatal.

[Christina @TheIAMNinja]

@AlyssaM_InfoSec @WiCySorg I met Alyssa (for the first time IRL) this past weekend. I was overjoyed (I fangirled hard) & I truly believed WiCys would support *ALL* women.
I am beyond shocked and saddened at this. You cannot be a true ally to “ALL women” if there is an asterisk after the word. 😡😡😡😡

[Christina @TheIAMNinja]

@AlyssaM_InfoSec I was so honored to be at this session!! You were fabulous (as were your heels) and your advice was amazing and relevant for people at any level of cyber (from a newbie to a seasoned pro)!!

[Christina @TheIAMNinja]

@whitecyberduck I’m trying to get my CISSP.

I do my best with bootcamps…I need structure and set schedules with fixed and blocked off time to study.

Because of the market, most companies aren’t paying for training.

The best price I found for CISSP training? $2499 (Self-Paced, no bootcamp).

[Christina @TheIAMNinja]

@bertrandcarlier A host of issues with authentication, user session management, grant types, api security… will try to get around to sharing a draft write up soon. :)

[Christina @TheIAMNinja]

Ok… I tried mastodon and the security issues I have found for their login, account management, and session management… no bueno.

Until mastodon improves their security, I’ll have to stay here, sadly.

[Christina @TheIAMNinja]

Let me rephrase… I have found *potential* security issues that, if confirmed, would be no bueno. Will work on a write up sometime this (or more likely next) week, and will be reaching out to the developers to let them know.

Recommend to proceed with caution.

[Christina @TheIAMNinja]

@SahilBloom Failure is only a failure if you learned nothing from it.

The point of failure is lessons - to teach us how to become better or stronger people in some way. We’re here to learn lessons, truths, make memories, impact others lives, & hopefully become *better* than when we started.

[Christina @TheIAMNinja]

This is like a landlord telling a tenant “don’t worry, we installed deadbolts.”

Tenant: “Ok, but the thieves were inside the apartment.”

Landlord: “But… look at the shiny deadbolt!”

[Christina @TheIAMNinja]

“We also encrypt credit card information and personal health data, offering a further layer of protection.”

Encryption only stops hackers who don’t have internal access. Encryption does nothing if the compromised employee account has *read/write access* to the database.

[Christina @TheIAMNinja]

@sec_r0 Tl;dr — just because u see a base64 encoded JSON value, don’t assume it’s a JWS/access token.

For example, JWEs are a JWT, but don’t have signature. Will have same base64 (e.g. string w three dots) as a JWS, but u will spend hours trying to find out why alg= “none” doesn’t work.

[Christina @TheIAMNinja]

@sec_r0 The signing alg is not entirely correct. Please read on JWKS & update. JWKS is extremely important for JWS.

Also, this is missing important key differences in JWTs… JWS vs JWE.

Not all JWT are used for solely logging in.

Please refer to OWASP & GitHub on JWT attack methods.

[Christina @TheIAMNinja]

ok so what if a phishing email tricks you into thinking you failed a phishing test? 🤔 #phishinginception

[Christina @TheIAMNinja]

Not sure why my tweets are getting randomly deleted…? 🤔