Defensive Computing - Michael Horowitz

Longtime computer nerd. Blog on Defensive Computing and Router Security. Tweet less than once/day. Also go by @defensivecomputing at

[Robert Graham @robertgraham]

Yup, "people who matter".

It's the chronic problem since the beginning of cybersecurity is that government cybersecurity boards or who the NYTimes quotes on a cybersecurity story are "people who matter", like CEOs of big companies.

Meanwhile, low level techies who actually know stuff aren't people who matter.

[Defensive Computing - Michael Horowitz @defensivecomput]

@mysk_co Thanks for the app. What is a URL scheme?

[Mysk 🇨🇦🇩🇪 @mysk_co]

VPN is still broken in iPadOS 27 and iOS 27 (beta 1). The device's real IP leaks during updating a VPN app while it is active. A website that periodically prints the IP was used to illustrate the leakage, Mullvad VPN used as an example👇

[Proton VPN @ProtonVPN]

Pro tip: if a company says "we won't provide you with the keys" and "we are end-to-end encrypted" in the same breath, well... then they are not end-to-end encrypted.

[Kaivan Shroff @KaivanShroff]

Gonna leave this right here.

[Proton VPN @ProtonVPN]

A quick guide for Proton VPN supporters and for those impacted by the recent #VPN blocking in 🇵🇰 Pakistan.

[The Hacker News @TheHackersNews]

🛑 Two Chrome extensions were caught intercepting browser traffic and stealing credentials from 170+ sites.

They pose as VPN tools, charge subscriptions, then silently proxy traffic and exfiltrate credentials in plaintext.

One has been active since 2017, the other since 2023.

🔗 Details → https://t.co/tGk4Jpo76K

[Defensive Computing - Michael Horowitz @defensivecomput]

Now we can tell if they lie about the physical location of their servers
https://t.co/wMXmc1a8HF
more about picking a #VPN here
https://t.co/oglhhsicsv
(2/2)

[Defensive Computing - Michael Horowitz @defensivecomput]

The hardest part of picking a #VPN provider is knowing who to trust. Two criteria: who owns them and how many trackers are in their mobile apps and website. Now, thanks to https://t.co/8Bt9AAIxFX, we have another criteria ... (1/2)

[Windscribe @Windscribe]

Yeaa buddy #1 let's go! That's how it's done!!
@windscribe 🤝 @mullvadnet 🤝 @ivpnnet
The only 3 major VPNs that actually connect you to a physical server in the place you selected.

You would think that's standard - you choose a location, you get connected to a server in that location - but no. Some VPNs have up to 60% of their servers in countries different from the label. These are called virtual servers and most VPNs have at least some of these.

Instead of paying a bit of extra money to actually host physical servers in those places, they get servers in cheaper places and simply slap a sticker on their IPs with whatever country they want. And then make the claim that they have servers in SOOO many countries!!

Using this method, we could rent out 195 servers in a single US datacenter, label them each with a different country's IPs and claim we have servers in every country on the planet.

Sounds dumb, doesn't it? And yet that's how many VPNs operate some portion of their servers. It's just a way to boost numbers on their website for more sales.

So keep this in mind - you might see other VPNs with a bigger number of locations, but currently Windscribe has physical servers in the most countries. You connect to a location, and your connection actually goes to that country.

Thank you to @ipinfo for the objective write up with no affiliate links. https://t.co/O82d1CYAiS

[Defensive Computing - Michael Horowitz @defensivecomput]

November was a great month for Defensive Computing
https://t.co/O0Vvf9fGe6
starting to see referrers from assorted AIs

[Defensive Computing - Michael Horowitz @defensivecomput]

I got my hands on a TP-Link Omada access point, the EAP670. First impressions were not the best.
https://t.co/C2hCSS6yf8

[Windscribe @Windscribe]

It appears Google is going full evil. We cannot update our browser extension.... because it has too many privacy features. @googledevs @ChromiumDev wtf?

This was a response to an appeal of an earlier rejection.

[Naomi Brockwell priv/acc @naomibrockwell]

Regulation is not coming to save you.
Governments love that corporations spy on you.
Because then they can get the data without a warrant.
It’s the backdoor to the Fourth Amendment.

[Fred Langa @flanga]

https://t.co/kkKfsPIHxW

[Fred Langa @flanga]

https://t.co/wRCnVJMxjo

[Defensive Computing - Michael Horowitz @defensivecomput]

@pcWRT More details please…

[Defensive Computing - Michael Horowitz @defensivecomput]

For the first 5 years of his new contract, Juan Soto is making $60,000,000/year. If he plays 150 games/year and bats 4 times/game -> $100,000 per at bat.
Feels like a jump-the-shark moment.
#baseball #mets #yankees #soto

[Defensive Computing - Michael Horowitz @defensivecomput]

@KimZetter Agreed. VPN usage is a prime suspect.

[Defensive Computing - Michael Horowitz @defensivecomput]

Batman fans: If you pay attention to the US federal government, you will no doubt think: The Penguin is now the Police Chief.