John Elliott

Specialist in security directives. Very PCI, always GRC, sometimes GDPR. Authors courses for @pluralsight. Security Advisor at @Jscrambler.

[John Elliott @withoutfire]

@VirginAtlantic Really? I've tried two browsers and it doesn't do anything when you click it.

[John Elliott @withoutfire]

Hey @VirginAtlantic is the "Need help, Chat to us" button on your site always broken?

[John Elliott @withoutfire]

Given the %ge of neurodiverse people in our community, why do keynote sessions have so much unnecessary loud music and flashing lights? #BlackHat2023

[John Elliott @withoutfire]

Great to meet new friends and many old colleagues this week at the PCI SSC BoA meeting.

[PCI SSC @PCISSC]

We're excited to welcome our new expanded Board of Advisors at our first in person meeting in Washington DC this week! ICYMI: check out our recent release which includes all of the representatives ➡️https://t.co/a0HspsTeXy

[John Elliott @withoutfire]

@matthew_d_green It is often the other way around, that the liability shift is the only way of moving a market to adopt new safer technologies. Entities can stay on old, insecure tech as long as they are happy to hold the liability. See especially the roll out of EMV chip in the US.

[John Elliott @withoutfire]

@MarianSo99 @pluralsight That might be OK when they are all 1st party, but my research is that most sites have 50% of their JavaScript coming from 3rd parties. I wrote more on the Pluralsight blog. 2/2. https://t.co/Tpaw8ZAGdN

[John Elliott @withoutfire]

@MarianSo99 @pluralsight I’m sorry if I wasn’t clear. Each microservice typically wants a JavaScript library in the browser to communicate with it. Every single JavaScript file loaded by the browser increases the attack surface. 1/2.

[John Elliott @withoutfire]

@PrivacyMatters @ICOnews Surely they are a processor not a controller?

[John Elliott @withoutfire]

@AlecMuffett Well, I have seen lots of things that were half-encrypted. I mean they were not really encrypted but the people who developed the encryption thought they were. One was a revolutionary new technique I described as “fairly unique key per transaction”. You can work out the acronym.

[Aaron Rosenmund @ARosenmund]

For any of you attending
@RSAConference
#RSAC2023 I really excited to put on a hands on lab, working on easy emulation for blue teams. Should be a lot of fun! Becoming the Threat: Blue Team Friendly Attack Simulations | RSA Conference

https://t.co/f8epoEBZgk

[John Elliott @withoutfire]

@joftius @1Br0wn And airline safety is *highly regulated* - and before that happened, there were lots of crashes.

[John Elliott @withoutfire]

@EleanorDallaway @happygeek @Mike_at_LPDE A small UPS perhaps? Hard to tell from just a side view.

[John Elliott @withoutfire]

@Suw Probably ORG members. In some circles you are famous.

[John Elliott @withoutfire]

@theDPOdaily OMB A-130 circular which is often used as the definition in NIST publications https://t.co/pOlUfCoKXn (p33) and/or CCPA https://t.co/uI1apUfP4F 1798.140 (o)

[John Elliott @withoutfire]

@riskybusiness Really looking forward to hearing your interview with her on the show. Please.

[John Elliott @withoutfire]

@ruskin147 Reboot ...

[John Elliott @withoutfire]

@oliviasolon It's also ignoring your opt-out with a marketing message disguised as a service message, once for @ICOnews because they do have strong views about this type of thing.

[John Elliott @withoutfire]

@javierruiz They are all pretty close to each other now, more so last week!

[John Elliott @withoutfire]

@AlecMuffett @futureidentity @mwfulk @profgalloway I love that someone called you a “crypto bro” without probably knowing how cryptography you actually are!

[John Elliott @withoutfire]

@1Br0wn This is it, I've not used it so not a recommendation https://t.co/EhQlGExxID

[John Elliott @withoutfire]

@1Br0wn There’s a service that will relay sms from your uk number … I’ll see if I can remember it.