kapsiR

Dad | Tech | Coding | Open Source | Never stop learning

[kapsiR @kapsi_r]

Just dropped a new version of my @haveibeenpwned @KeePass plugin

https://t.co/ELrmLQ07TN

[kapsiR @kapsi_r]

https://t.co/kWgXG2Z6sh

[Tavis Ormandy @taviso]

I just learned that OSC8 (hyperlinks) in Windows Terminal uses ShellExecute(). Excellent trolling potential for README files 😆

[kapsiR @kapsi_r]

@dotnet "This update contains non-security fixes." 😉

[kapsiR @kapsi_r]

@markrussinovich @Sysinternals Is there a way for Autoruns to display the UWP startup tasks created by packaged applications?

https://t.co/xg5Cu3avtj

#sysinternals #uwp #windows #security

[kapsiR @kapsi_r]

@stebets @Ubiquiti Do you have resources whether in-wall or on the ceiling has a better reach?

[kapsiR @kapsi_r]

@troyhunt But for 🍺😜

[kapsiR @kapsi_r]

@andrewchenke @troyhunt @haveibeenpwned Maybe provide an OpenApi endpoint with examples too?

[Leftward Bound 🇵🇸 🇺🇦 @LeftwardBound]

I’ve always thought that framing fascism as weakness is the way forward when it comes to messaging

Especially when trying to deradicalize or disinterest young men from it

[kapsiR @kapsi_r]

@CemTurk @Dave_DotNet Yes, from @stephentoub:
https://t.co/bjNbA8FIqf

[kapsiR @kapsi_r]

@troyhunt @404mediaco You are right of course.
I wanted to highlight the UX for the minority here explicitly. (multi browser, multi container, mail filters, ...)

[kapsiR @kapsi_r]

@troyhunt @404mediaco on the other side, a "normal user" would not do it that often because the login persisted anyway...

[kapsiR @kapsi_r]

@troyhunt @404mediaco Yeah, true but what I mean is we always train people to not click on any link in an email if not fully trusted - this behavior is a bit against that because if a user has to do it very often the chance any other link gets clicked is a bit higher...

[kapsiR @kapsi_r]

@troyhunt @404mediaco And regarding of security:
- It opens a door for more phishing attempts (blindly clicking a link in an email)
- It would still be possible to opt-in to a password or more secure option (FIDO2) while keeping email logins the default

3/3

[kapsiR @kapsi_r]

@troyhunt @404mediaco The UX can be bad in many situations (as they also mention):
- I want to login where I was (correct browser, correct container)
- I don't want to wait for an email (greylisting, filters, ...), no context switching

2/3

[kapsiR @kapsi_r]

I'm sure @Scott_Helme and @troyhunt find this interesting too 😎

[kapsiR @kapsi_r]

Interesting attack concept to be aware of: DoubleClickjacking

https://t.co/SICXGQUoH2

Thanks @PaulosYibelo for highlighting it! 🚀

[kapsiR @kapsi_r]

@msftsecresponse Secure defaults FTW!