passtheprt

Mainly interested in offensive security, especially cloud. Create shareholder value. Personal account. Does not reflect my employers opinion.

[passtheprt @passtheprt]

@notbrvnd0n For sure :D requires a bit of patience for eu shipping but quality is amazing

[passtheprt @passtheprt]

@merill Tokenmaxxing 🥰

[passtheprt @passtheprt]

@merill Looking really forward to Scout. It sounds amazing although I wouldn't want to let it loose without Purview or Agent ID properly configured first. Currently I'd also take the standpoint to let other orgs. pilot it first. :D

[passtheprt @passtheprt]

If I ever wanted a stealthy display name for my Enterprise Application, I’d call it „ADIbiziaUX“ - I bet you that almost no Entra ID Admin would want to disable that.

[passtheprt @passtheprt]

@pfransces @Cyb3rMonk Yes, indeed, this would solve most phishing scenarios, as the access token cannot be forged on the AiTM proxy, since the device does not meet the requirement due to according CAP.

Generally speaking, you should probably block alternative auth flows anyway.

[passtheprt @passtheprt]

@alitajran @Cyb3rMik3 shouldn't we create an additional CA Policy that blocks high-risk agents from accessing all agent resources?

[passtheprt @passtheprt]

@Cyb3rMonk @pfransces Definitely it has its valid use cases. I wasn’t precise enough in my previous reply. It should be limited to specific personas, such as developers, to limit blast radius.

In reality, it often remains available for all users, which is not necessary

[passtheprt @passtheprt]

@Cyb3rMonk @pfransces Even though DCF abuse is frequently in the news, the reality is that it’s still not blocked in a lot of orgs. I see it daily in SMB as well as huge organizations.

[passtheprt @passtheprt]

@Cyb3rMonk @pfransces Ideally, you would assign a DcF Access Package to developers who require it, which would temporarily exclude them from a blocking policy.

[passtheprt @passtheprt]

@alitajran hi,

I've seen your new post about blocking high-risk agents from accessing all resources.

Building on that, shouldn't we create an additional CA Policy that blocks high-risk agents from accessing all agent resources?

[passtheprt @passtheprt]

@fabian_bader @_dirkjan Cannot silently enumerate a tenant's CA policies anymore 😔👊 (if you have detections in place)

[passtheprt @passtheprt]

@merill I totally agree with you here. Every user with a passkey is a more secure user. I'm just generally trying to debunk the assumption that having passkeys = enforcing passkeys, which also means that you are still vulnerable to AiTM.

[passtheprt @passtheprt]

@RidgelineCyber Not sure if I'm still talking to a human at this point, but no, you need both controls. Require Compliant Device and also Limit Device Join Action.

[passtheprt @passtheprt]

@ClaudeDevs It’s concerning that Claude devs have not noticed this lack of quality in the product. It makes me wonder if there’s no quality assurance in place.

[passtheprt @passtheprt]

@mozzeph Reminds me of a course I took, something about actor tokens 🤔🤔

[passtheprt @passtheprt]

@fabian_bader Scawyyyy

[passtheprt @passtheprt]

@UK_Daniel_Card Claude code has been substantially nerfed.

Before, you were at least able to reason with it to continue building. Really not fun ATM; though I haven't tested in a minute..