michaelwareman - Network

Well, #RSAC2025 is in the bag. Happy to be home, but many good conversations were had.

Well, #RSAC2025 is in the bag. Happy to be home, but many good conversations were had.

Best picture I got on my phone of the #eclipse from Indianapolis...

Best picture I got on my phone of the #eclipse from Indianapolis...

Not watching @pancakescon? - you are missing out...https://www.pancakescon.com

Not watching @pancakescon? - you are missing out...

https://www.pancakescon.com

Well, first pass thru the cURL details. Should be easy enough to threathunt. Perhaps not quite "sky is falling" like Log4J was,...

Well, first pass thru the cURL details. Should be easy enough to threathunt. Perhaps not quite "sky is falling" like Log4J was, but still bad depending on your environment. Another cause of if you have a complete SBOM inventory you'll have a much easier time responding to this...

https://curl.se/docs/CVE-2023-38545.html

Oh look, an admission that Alexa listens all the time. No wake word needed.

Oh look, an admission that Alexa listens all the time. No wake word needed.

Nothing against them - but I'm looking forward to not spending time with lawyers tomorrow.

Nothing against them - but I'm looking forward to not spending time with lawyers tomorrow.

@merill I was able to setup Passkey under Chrome (by enrolling as a 'USB Hardware Key") as well as Mac TouchID (by enrolling as...

@merill I was able to setup Passkey under Chrome (by enrolling as a 'USB Hardware Key") as well as Mac TouchID (by enrolling as 'Windows Hello').

Although FIDO2 does not yet work in all scenarios (please make this better!) It's orders of magnitude better than the authenticator app.

Can you see about getting the security enrolling pages updated for the latest nomenclature so everyone knows they can in fact use phishing resistant #mfa with a Live accounts?

State sponsored actors compromised "unknown" CA.... How is this 'unknown' but a known...

State sponsored actors compromised "unknown" CA.... How is this 'unknown' but a known story....

https://arstechnica.com/information-technology/2022/11/state-sponsored-hackers-in-china-compromise-certificate-authority/

Of course, it would be really nice if #passkey worked from the mobile app as well. Seems we have to keep the Microsoft Authenticator around...

Of course, it would be really nice if #passkey worked from the mobile app as well. Seems we have to keep the Microsoft Authenticator around for a while longer yet. :(

Just discovered that personal Microsoft accounts now support Passkey! You can enroll a Mac TouchID as 'Windows Hello' (and of course...

Just discovered that personal Microsoft accounts now support Passkey! You can enroll a Mac TouchID as 'Windows Hello' (and of course use Hello natively) - and Android and IOS phones as passkey by selecting the USB token option while using chrome.
#passkey #fido2 #mfa

Hint for #mfa on Mastodon.'Security Keys' can be Windows Hello (on your Widows device), TouchID (Mac) and Passkey (IOS or Android)...

Hint for #mfa on Mastodon.

'Security Keys' can be Windows Hello (on your Widows device), TouchID (Mac) and Passkey (IOS or Android) as well as a Yubikey (or similar).

I really hate how vendors are pricing tools out of home enthusiasts reach. Latest - want to use HAProxy on pfSense with a SAML Idp (an...

I really hate how vendors are pricing tools out of home enthusiasts reach.

Latest - want to use HAProxy on pfSense with a SAML Idp (an enterprise feature) - minimum cost over $8k. A great deal for an enterprise - just plain insane for a home network. After all - why wouldn't I want to use #fido2 to protect my home network?

Looking for a Cybersecurity Architect to join my team in London, UK. For more information, please see the post:...

Looking for a Cybersecurity Architect to join my team in London, UK. For more information, please see the post: https://uk-stonex.icims.com/jobs/7825/cyber-security-architect/job

#jobs #cybersecurity #uk

I don't think I'll ever get over 'tooting' about passkeys... #usemfa

I don't think I'll ever get over 'tooting' about passkeys... #usemfa

Well now, @CISAjen is here. infosec.exchange must be the official destination for infosec Twitter refugees....

Well now, @CISAjen is here. infosec.exchange must be the official destination for infosec Twitter refugees....