Marcin

because tweeting and blogging is a full time job

[Kyle Vogt @kvogt]

Well folks, we did it. I have been waiting for this day for almost 10 years.

I am proud to announce @Cruise is now running 24/7 across all of San Francisco!

This is a pivotal moment for our business.

Let me tell you why 👇(1/6)

[Chris Wysopal @WeldPond]

You'd be hard pressed to find someone in the hacker community that you could have deep tech conversations with & also turn everything they touch into fun. @aloria is a legend that I am privileged to call a friend. We will remember! Photo from 15th anniversary of "Hackers" party.

[Ryan Hurst @rmhrisk]

“Code signing” as sold by CAs is a Microsoft only offering. It doesn’t really belong in CA/Browser Forum at all. Doing so just shunts Microsoft’s responsibility to evolve its own code signing practices to commercial CAs. This is problematic for several reasons.

[Marcin @marcinw]

@0xdabbad00 https://t.co/TiKKXt0p5Z port scanning internal Azure infrastructure since 2010.

[Dino A. Dai Zovi @dinodaizovi]

Where else in our lives do we actively create and promote the infrastructure that allows malicious actors scalable and frictionless destruction?

Why run AD, which enables scalable ransomware? So that we can automatically deploy EDR to maybe detect (but not stop) that ransomware?

[Marcin @marcinw]

@drraid Clear violation of the site ToS.

[Marcin @marcinw]

@mattifestation @j3ffr3y1974 How does behave when you have an expired (but not revoked) signing certificate with a valid RFC3161 timestamp?

[Dan Guido @dguido]

My scooter was stolen last week. Unknown to the thief, I hid two Airtags inside it. I was able to use the Apple Find My network and UWB direction finding to recover the scooter today. Here’s how it all went down:

[Marcin @marcinw]

@halvarflake @chrisrohlf @drraid All of the above would breed the most competition amongst everyone.

[Dino A. Dai Zovi @dinodaizovi]

There's a focus that comes with protecting cryptocurrency. Security theater doesn't play at all, there are real direct consequences for breaches, and you can't keep them a secret. There is real useful innovation happening and the rest of infosec ignores it to their own detriment.

[Tyler Winklevoss @tyler]

Big congratulations to @brian_armstrong, @FEhrsam and the entire @coinbase team on a monster debut today! Huge moment for crypto. To the moon! 👍🏻🚀🍾🥂🥳🎉🎈🎊

[Marcin @marcinw]

I wrote a smart card token driver for MacOS to interface with identities backed by Secure Enclave https://t.co/WGuuDXEBM7

[Cem Paya @randomoracle]

Windows crypto API makes it easy to use keys on hardware eg HSMs

Example: ADFS with SAML signing key on AWS CloudHSM v2 (Marvel Nitrox née Cavium)

Sometimes showing the key is on an HSM is the hard part 🤷‍♂️

Key container → CSP → certificate → ADFS settings

[Marcin @marcinw]

@dinodaizovi @mtrumpbour @collinrm @0xcharlie @nudehaberdasher There was a time, we all SummerCon’d together.

[Cem Paya @randomoracle]

Common pattern in infosec:

1. Fail at threat modeling (In this case: conflate risks of non-constant time comparison of HMACs vs password hashes)
2. Attempt at "fix" for said "problem"
3. Introduce a more serious & real vulnerability 🤦‍♂️

[Cem Paya @randomoracle]

Alternative view: given that enterprise IT is a market for lemons, it is the buyer responsibility to manage that risk by making sure untrusted vendor code (read: all except a handful such as MSFT/Google/AWS…) is properly sandboxed & contained assuming it *will* fail

[Dino A. Dai Zovi @dinodaizovi]

My take: if you have the team on-staff to invent ALTS, use that. Otherwise, use mTLS for your service-to-service communication. You should still use other authn/authz mechanisms that are closer to end-to-end, though.

[Thomas H. Ptacek @tqbf]

If you know me you already know what I think about this but on the off chance you don’t: NCC Cryptography is legit.

[Jesse D'Aguanno @0x30n]

I grew up on software exploitation, but always thought crypto was beyond me.
In the ~5 yrs since finding Cryptopals, I’ve found & exploited critical crypto bugs in products like secure messengers, and helped design secure protocols.
Thanks @tqbf @spdevlin @marcinw @iamalexalright

[Cem Paya @randomoracle]

This is why using credentials bound to hardware— smart-cards, USB tokens, TPMs— is crucial

You can not paste them into Slack or share with another colleague even if you wanted to 🤷‍♂️

1/2