yan

security engineering @brave / helped build Let's Encrypt, Privacy Badger, and HTTPS Everywhere @eff / physics alum @mit / rabbit enthusiast

[yan @bcrypt]

could not for the life of me figure out how to buy a bus ticket in Milan. it was literally easier to get a shell 😆

[yan @bcrypt]

@komplexkonjugat @cremieuxrecueil @CogniCarbon i'm so glad he'll never live this down

[yan @bcrypt]

@sumlac i added the marin data, lmk if you see any issues!

[yan @bcrypt]

in light of the tragic news that a 2-year old died at a licensed SF daycare earlier this month, i made a site to show childcare license violations and complaints in the Bay Area: https://t.co/18BpLBpnJy

[yan @bcrypt]

@sumlac i'll add it with my next data refresh!

[yan @bcrypt]

* the data is public at https://t.co/qnyRc7A9zU but i found that site hard to use
* PRs welcome https://t.co/lQOeazjIXV
* i am aware this does not show small home daycares; working on that
* very grateful to Claude for making this a sunday project instead of a multi-week one

[yan @bcrypt]

why is Claude installing a Native Messaging host in Brave's profile directory if https://t.co/eIgTwbKUTe explicitly doesn't support Brave??

[That Privacy Guy @alexanderhanff]

https://t.co/5y99mcVMvP

@AnthropicAI secretly installs spyware when you install Claude Desktop Anthropic's Claude Desktop silently installs a Native Messaging bridge into seven...

#ai #privacy #eprivacy #compliance #infosec #gdpr #law #cyber #security #anthropic #claude

[Feross @feross]

🚨 CRITICAL: Active supply chain attack on axios -- one of npm's most depended-on packages.

The latest [email protected] now pulls in [email protected], a package that did not exist before today. This is a live compromise.

This is textbook supply chain installer malware. axios has 100M+ weekly downloads. Every npm install pulling the latest version is potentially compromised right now.

Socket AI analysis confirms this is malware. plain-crypto-js is an obfuscated dropper/loader that:

• Deobfuscates embedded payloads and operational strings at runtime
• Dynamically loads fs, os, and execSync to evade static analysis
• Executes decoded shell commands
• Stages and copies payload files into OS temp and Windows ProgramData directories
• Deletes and renames artifacts post-execution to destroy forensic evidence

If you use axios, pin your version immediately and audit your lockfiles. Do not upgrade.

[yan @bcrypt]

wow it turns out that some of those AI slop reports that every bug bounty program is now flooded with are from security companies trying to get free training input

@Bugcrowd please name them!

https://t.co/U0DWN6opUb

[Brave @brave]

AI agents that can browse the Web and perform tasks on your behalf have incredible potential but also introduce new security risks.

We recently found, and disclosed, a concerning flaw in Perplexity's Comet browser that put users' accounts and other sensitive info in danger.

[yan @bcrypt]

long thread about a phishing attack that has proper headers from google’s domain but for true DKIM stans, the interesting part starts here

[nick.eth @nicksdjohnson]

Here's how it works: First, they register a domain and create a Google account for 'me@domain'. The domain isn't that important but it helps if looks like some kind of infra. The choice of 'me' for the username is clever, as you'll see in a minute.

[Meredith Whittaker @mer__edith]

📣🚨 BAT SIGNAL: A law in France that would mandate a backdoor in end to end encrypted communications is set for a vote within the next day, after some start-stop skirmishes. 

The French Narcotraffic law would require encrypted communications providers—like Signal—create a backdoor by giving the government the ability to add themselves to any group or chat they like. In the name of (checks notes) fighting drug trafficking. 

While those hyping this bad law have rushed to assure French politicians that the proposal isn’t’ ‘breaking encryption’ their arguments are as tedious as they are stale as they are laughable. For those catching up, let’s review the basics: end to end encryption must only have two ‘ends’—sender and recipient(s). Otherwise, it is backdoored. Whatever method is devised to add a ‘third end’ —from a perverted PRNG in a cryptographic protocol, to vendor-provided government software grafted onto the side of secure communications that allow said government to add themselves to your chats—it rips a hole in the hull of private communications and is a backdoor. 

Indeed, the ghost participant proposal was roundly rebuked (humiliated, even) when it was first proposed in 2019 in the UK. The technical community was united, and it was never implemented in law or otherwise. 

We cannot accept any backdoor, however it’s dressed up. Communications don’t stay within jurisdictional boundaries. Which means a hole created in France becomes a vector for anyone wanting to undermine Signal’s robust privacy guarantees, anywhere. Instead of contending with unbreakable math, they only have to compromise a French government employee, or the vendor-provided software used to sideload government operatives into your private chats. 

This is why, as always, Signal would exit the French market before it would comply with this law as written. At this moment especially, there is simply too much riding on Signal, on our being able to forge a future in which private communication persists, to allow such pernicious undermining. 

We hope—WE HOPE—that this callow, dishonest attack will fail, and will be the last. We would love to get back to the work of maintaining and improving our core technologies, instead of fighting legislation which is distinguished in nothing as much as its refusal to listen to decades of expert consensus in its drive to imperil global cybersecurity and the human right of privacy.

[yan @bcrypt]

(this is the sort of tweet that would have absolutely slapped on infosec twitter circa 2015, RIP)

[yan @bcrypt]

ecdsa private key leak due to nonce reuse strikes again, this time in the elliptic npm library https://t.co/zs3FDpPWTL

[yan @bcrypt]

@AmandaAskell @bratwebb ALSO recall that i won the plank and wall sit competitions at Anya's birthday party!!

[yan @bcrypt]

@AmandaAskell @bratwebb my default protein intake is pretty low (like 1 g/kg at most) and i didn’t get much benefit from going higher! if you’re consistent you should still gain muscle. my main metric is climbing and i went from 11b’s to 12b’s in like a year of strength training with no diet changes

[yan @bcrypt]

@KumailNanji i heard this works even better: rm -rf /

[yan @bcrypt]

@thdxr october 2023

[yan @bcrypt]

@troyhunt haha i got this too

[yan @bcrypt]

https://t.co/hgm7xvhzd7 prices delivery items based on your local store setting, not your delivery address, so if you live in SF just set your local store to Missouri or something lol

[yan @bcrypt]

@TheCinesthetic wearing shoes while lying on a bed