Fosstodon

0 posts0 participants0 posts today

t42 IoT SolutionsAfter a year of POC, a leading <a href="https://mas.to/tags/pharmaceutical" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#pharmaceutical</a> company has selected Lokies smart <a href="https://mas.to/tags/padlock" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#padlock</a> as their go-to solution for multiple applications. The first units have been delivered - and the feedback is outstanding!<a href="https://mas.to/tags/smartlock" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#smartlock</a> <a href="https://mas.to/tags/iot" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#iot</a> <a href="https://mas.to/tags/pharma" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#pharma</a> <a href="https://mas.to/tags/innovation" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#innovation</a>

Brent SleeperOpen pipe (padlocks). <a href="https://pixelfed.social/discover/tags/Industrial?src=hash" class="u-url hashtag" rel="nofollow noopener noreferrer" target="_blank">#Industrial</a> <a href="https://pixelfed.social/discover/tags/Utilities?src=hash" class="u-url hashtag" rel="nofollow noopener noreferrer" target="_blank">#Utilities</a> <a href="https://pixelfed.social/discover/tags/Padlock?src=hash" class="u-url hashtag" rel="nofollow noopener noreferrer" target="_blank">#Padlock</a> <a href="https://pixelfed.social/discover/tags/Color?src=hash" class="u-url hashtag" rel="nofollow noopener noreferrer" target="_blank">#Color</a> <a href="https://pixelfed.social/discover/tags/Red?src=hash" class="u-url hashtag" rel="nofollow noopener noreferrer" target="_blank">#Red</a> <a href="https://pixelfed.social/discover/tags/Green?src=hash" class="u-url hashtag" rel="nofollow noopener noreferrer" target="_blank">#Green</a> <a href="https://pixelfed.social/discover/tags/Gray?src=hash" class="u-url hashtag" rel="nofollow noopener noreferrer" target="_blank">#Gray</a> <a href="https://pixelfed.social/discover/tags/SFSU?src=hash" class="u-url hashtag" rel="nofollow noopener noreferrer" target="_blank">#SFSU</a> <a href="https://pixelfed.social/discover/tags/SanFrancisco?src=hash" class="u-url hashtag" rel="nofollow noopener noreferrer" target="_blank">#SanFrancisco</a>

A Fool And His FujiLocking NothingDon't think this will ever open againLens: Viltrox 13mm f/1.4 XF Wide Angle on the Fuji X-T30<a href="https://c.im/tags/cumbria" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#cumbria</a> <a href="https://c.im/tags/fujifilm" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#fujifilm</a> <a href="https://c.im/tags/photography" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#photography</a> <a href="https://c.im/tags/photographer" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#photographer</a> <a href="https://c.im/tags/maryport" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#maryport</a> <a href="https://c.im/tags/landscapephotography" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#landscapephotography</a> <a href="https://c.im/tags/lakedistrict" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#lakedistrict</a> <a href="https://c.im/tags/coast" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#coast</a> <a href="https://c.im/tags/seashore" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#seashore</a> <a href="https://c.im/tags/promenade" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#promenade</a> <a href="https://c.im/tags/viltrox" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#viltrox</a> <a href="https://c.im/tags/naturephotography" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#naturephotography</a> <a href="https://c.im/tags/nature" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#nature</a> <a href="https://c.im/tags/monochrome" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#monochrome</a> <a href="https://c.im/tags/blackandwhitephotography" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#blackandwhitephotography</a> <a href="https://c.im/tags/padlock" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#padlock</a>

CTD60mm<a href="https://mastodon.social/tags/padlock" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#padlock</a>

foncuNo sé si lo sabéis, pero hoy es <a href="https://pixelfed.social/discover/tags/martesDeBarbas?src=hash" class="u-url hashtag" rel="nofollow noopener noreferrer" target="_blank">#martesDeBarbas</a> en <a href="https://pixelfed.social/discover/tags/Mastodon?src=hash" class="u-url hashtag" rel="nofollow noopener noreferrer" target="_blank">#Mastodon</a>. Y como <a href="https://pixelfed.social/discover/tags/Pixelfed?src=hash" class="u-url hashtag" rel="nofollow noopener noreferrer" target="_blank">#Pixelfed</a> federa con el resto del <a href="https://pixelfed.social/discover/tags/fediverso?src=hash" class="u-url hashtag" rel="nofollow noopener noreferrer" target="_blank">#fediverso</a>, hoy tenéis dos fotos para ver. <a href="https://pixelfed.social/discover/tags/gaybeard?src=hash" class="u-url hashtag" rel="nofollow noopener noreferrer" target="_blank">#gaybeard</a> <a href="https://pixelfed.social/discover/tags/padlock?src=hash" class="u-url hashtag" rel="nofollow noopener noreferrer" target="_blank">#padlock</a> <a href="https://pixelfed.social/discover/tags/collar?src=hash" class="u-url hashtag" rel="nofollow noopener noreferrer" target="_blank">#collar</a> <a href="https://pixelfed.social/discover/tags/attitude?src=hash" class="u-url hashtag" rel="nofollow noopener noreferrer" target="_blank">#attitude</a> <a href="https://pixelfed.social/discover/tags/whysoserious?src=hash" class="u-url hashtag" rel="nofollow noopener noreferrer" target="_blank">#whysoserious</a> <a href="https://pixelfed.social/discover/tags/iykyk?src=hash" class="u-url hashtag" rel="nofollow noopener noreferrer" target="_blank">#iykyk</a>

Adam Trickett :debian: :kde:Mono cylinders<a href="https://www.blipfoto.com/entry/3328833076288556418" target="_blank" rel="nofollow noopener noreferrer" translate="no">https://www.blipfoto.com/entry/3328833076288556418</a><a href="https://fosstodon.org/tags/blip" class="mention hashtag" rel="tag">#blip</a> <a href="https://fosstodon.org/tags/blipfoto" class="mention hashtag" rel="tag">#blipfoto</a> <a href="https://fosstodon.org/tags/gimp" class="mention hashtag" rel="tag">#gimp</a> <a href="https://fosstodon.org/tags/rawtherapee" class="mention hashtag" rel="tag">#rawtherapee</a> <a href="https://fosstodon.org/tags/photography" class="mention hashtag" rel="tag">#photography</a> <a href="https://fosstodon.org/tags/ilforddelta100" class="mention hashtag" rel="tag">#ilforddelta100</a> <a href="https://fosstodon.org/tags/monochrome" class="mention hashtag" rel="tag">#monochrome</a> <a href="https://fosstodon.org/tags/padlock" class="mention hashtag" rel="tag">#padlock</a> <a href="https://fosstodon.org/tags/combination" class="mention hashtag" rel="tag">#combination</a>

TechHelpKB.com 📚The security padlock icon’s meaning has been synonymous with website security for 30+ years. See which browsers still use the padlock symbol in front of the URL and which ones have traded it in.<a href="https://mastodon.social/tags/browser" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#browser</a> <a href="https://mastodon.social/tags/website" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#website</a> <a href="https://mastodon.social/tags/security" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#security</a> <a href="https://mastodon.social/tags/safety" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#safety</a> <a href="https://mastodon.social/tags/padlock" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#padlock</a> <a href="https://www.thesslstore.com/blog/which-browsers-still-use-the-security-padlock-icon/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://www.thesslstore.com/blog/which-browsers-still-use-the-security-padlock-icon/</a>

Dave JBack from the dead: Scientists rebuild the <a href="https://dice.camp/tags/face" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#face</a> of 400-year-old <a href="https://dice.camp/tags/Polish" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Polish</a> '<a href="https://dice.camp/tags/vampire" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#vampire</a>'. A team of scientists has reconstructed <a href="https://dice.camp/tags/Zosia" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Zosia</a>’s face, revealing the human story buried by supernatural beliefs in an unmarked <a href="https://dice.camp/tags/cemetery" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#cemetery</a> in <a href="https://dice.camp/tags/Pien" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Pien</a>, northern <a href="https://dice.camp/tags/Poland" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Poland</a>. <a href="https://www.nbcnews.com/news/world/scientists-rebuild-face-400-year-old-polish-vampire-zosia-rcna178176" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://www.nbcnews.com/news/world/scientists-rebuild-face-400-year-old-polish-vampire-zosia-rcna178176</a> <a href="https://dice.camp/tags/science" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#science</a> <a href="https://dice.camp/tags/archaeology" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#archaeology</a> <a href="https://dice.camp/tags/archeology" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#archeology</a> <a href="https://dice.camp/tags/reconstruction" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#reconstruction</a> <a href="https://dice.camp/tags/anthropology" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#anthropology</a> <a href="https://dice.camp/tags/burial" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#burial</a> <a href="https://dice.camp/tags/superstition" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#superstition</a> <a href="https://dice.camp/tags/sickle" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#sickle</a> <a href="https://dice.camp/tags/padlock" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#padlock</a>

zimpenfishNew <a class="hashtag" href="https://social.rjp.is/tag/padlock" rel="nofollow noopener noreferrer" target="_blank">#padlock</a> /via <a href="https://instagr.am/p/DBs8GSdojSt/" rel="nofollow noopener noreferrer" target="_blank">https://instagr.am/p/DBs8GSdojSt/</a> <a class="hashtag" href="https://social.rjp.is/tag/ifttt" rel="nofollow noopener noreferrer" target="_blank">#ifttt</a> <a class="hashtag" href="https://social.rjp.is/tag/automated" rel="nofollow noopener noreferrer" target="_blank">#automated</a>

HusdurMy first-ish try into pixelart for kinktober/inktober chalenge. So far I like it OwO <a href="https://thicc.horse/tags/anthro" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#anthro</a> <a href="https://thicc.horse/tags/pony" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#pony</a> <a href="https://thicc.horse/tags/unicorn" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#unicorn</a> <a href="https://thicc.horse/tags/pixelart" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#pixelart</a> <a href="https://thicc.horse/tags/monochrome" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#monochrome</a> <a href="https://thicc.horse/tags/kinktober" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#kinktober</a> <a href="https://thicc.horse/tags/chastitycage" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#chastitycage</a> <a href="https://thicc.horse/tags/backpack" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#backpack</a> <a href="https://thicc.horse/tags/sextoy" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#sextoy</a> <a href="https://thicc.horse/tags/buttplug" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#buttplug</a> <a href="https://thicc.horse/tags/leashedcollar" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#leashedcollar</a> <a href="https://thicc.horse/tags/leash" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#leash</a> <a href="https://thicc.horse/tags/tiedleash" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#tiedleash</a> <a href="https://thicc.horse/tags/selfbondage" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#selfbondage</a> <a href="https://thicc.horse/tags/padlock" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#padlock</a> <a href="https://thicc.horse/tags/lookingatviewer" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#lookingatviewer</a> <a href="https://thicc.horse/tags/lookingback" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#lookingback</a> <a href="https://thicc.horse/tags/male" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#male</a> <a href="https://thicc.horse/tags/girly" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#girly</a>

Erik van StratenMeanwhile people at Mozilla started working to fix this vulnerability; that's good.What I dislike is that the vulnerability was ignored until I started making public noise.And that, instead of saying "sorry we kept internet users at risk, we were busy fixing other things we thought were more inportant", in a long reaction the vulnerabilty is downplayed because *they* see no way how this could be abused (Jen Easterly is right: <a href="https://www.theregister.com/2024/09/20/cisa_sloppy_vendors_cybercrime_villains/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://www.theregister.com/2024/09/20/cisa_sloppy_vendors_cybercrime_villains/</a>).How about that I no longer trust Firefox's padlock?I'll wait a bit with publishing a full, detailed, PoC.<a href="https://mozilla.social/@mozilla" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@mozilla</a> <a href="https://infosec.exchange/tags/padlock" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#padlock</a> <a href="https://infosec.exchange/tags/FirefoxIOS" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#FirefoxIOS</a> <a href="https://infosec.exchange/tags/https" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#https</a> <a href="https://infosec.exchange/tags/trust" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#trust</a>

Erik van StratenAfter Gavin (<a href="https://fosstodon.org/@_calmdowndear" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@_calmdowndear</a> ) asked about password managers checking and warning for http connections, I did some tests; see <a href="https://infosec.exchange/@ErikvanStraten/113183533717083748" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://infosec.exchange/@ErikvanStraten/113183533717083748</a>.In addition to those and my original test, in the email to myself I replaced "example.com" by both:http:⧸⧸192.168.178.1 (*) and https:⧸⧸192.168.178.1 (*)(*) I'm using the Unicode '⧸' here instead of ASCII '/' to prevent Mastodon from hiding the protocol prefix (and turning it into a clickable link).If I follow the instructions in the email (fully close Firefox) and tap http:⧸⧸192.168.178.1 , then I (erroneously) get to see the padlock without strike through.I can then use the iOS autofill function to fill in the password without being warned that an http connection is being used. Even after autofilling the password, Firefox has not changed the padlock as can be seen in the left screenshot below.OTOH, if I follow the instructions in the mail but tap https:⧸⧸192.168.178.1 instead (and then tap "Advanced"), I *do* get warned because a self signed certificate is being used (see the screenshot at the right).<a href="https://chaos.social/@brahms" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@brahms</a> <a href="https://mozilla.social/@mozilla" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@mozilla</a> <a href="https://infosec.exchange/tags/FirefoxIOS" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#FirefoxIOS</a> <a href="https://infosec.exchange/tags/Vulnerability" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Vulnerability</a> <a href="https://infosec.exchange/tags/Mozilla" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Mozilla</a> <a href="https://infosec.exchange/tags/Bugzilla" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Bugzilla</a> <a href="https://infosec.exchange/tags/FullDisclosure" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#FullDisclosure</a> <a href="https://infosec.exchange/tags/Padlock" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Padlock</a> <a href="https://infosec.exchange/tags/httpvshttps" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#httpvshttps</a> <a href="https://infosec.exchange/tags/RFC1918" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#RFC1918</a> <a href="https://infosec.exchange/tags/AVM" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#AVM</a> <a href="https://infosec.exchange/tags/FritzBox" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#FritzBox</a> <a href="https://infosec.exchange/tags/HomeRouter" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#HomeRouter</a> <a href="https://infosec.exchange/tags/IOT" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#IOT</a>

Erik van StratenFirefox iOS vulnerabilityNearly three months ago I reported a vulnerability in Firefox for iOS to Mozilla (<a href="https://bugzilla.mozilla.org/show_bug.cgi?id=1904885" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://bugzilla.mozilla.org/show_bug.cgi?id=1904885</a>) - it remains unfixed while my "bumps" do not seem to wake anyone up (yes that's frustrating - and I encounter that everywhere).🔹 VULNERABILITY The vulnerability appears to be that if Firefox is opened with an http link "on the command line", while the last page open was using https, it gets confused and erroneously shows a https padlock for an http website.🔹CONDITIONS TO REPRODUCE It's easy to reproduce, provided that:• Firefox is configured as your default browser (on iOS or iPadOS)• You use an app to read emails that is not webbased (Apple's mail app works fine).🔹 REPRODUCE VIA MAIL One way to te reproduce is to send yourself a ("phishing") email with the following instructions:« 1) Tap bleepingcomputer.com to open it;2) For security reasons (XSS attacks etc.), now close Firefox (make sure to swipe its window off screen);3) Tap example.com to open it. »(Instead of example.com you can use any website that does not automatically forward your browser to an https connection to the website, such as <a href="http://http.badssl.com" rel="nofollow noopener noreferrer" translate="no" target="_blank">http://http.badssl.com</a>).🔹 SYMPTOMS Firefox for iOS now reopens, shows "example.com/" in the address bar *and* a padlock icon indicating an https connection.However, it is NOT using an https connection, but http. The padlock is not trustworthy.🔹 PICS OR IT AINT SO See the screenshots below: the second one is after tapping the padlock icon (or tap in the address bar to see the -selected- URL start with http://).🔹 FULL POC Since it's not yet 90 days ago (but rather 88) I'll wait a bit with publishing a full phishing PoC.<a href="https://mozilla.social/@mozilla" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@mozilla</a> <a href="https://infosec.exchange/tags/FirefoxIOS" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#FirefoxIOS</a> <a href="https://infosec.exchange/tags/Vulnerability" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Vulnerability</a> <a href="https://infosec.exchange/tags/Mozilla" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Mozilla</a> <a href="https://infosec.exchange/tags/Bugzilla" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Bugzilla</a> <a href="https://infosec.exchange/tags/FullDisclosure" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#FullDisclosure</a> <a href="https://infosec.exchange/tags/Padlock" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Padlock</a> <a href="https://infosec.exchange/tags/httpvshttps" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#httpvshttps</a> <a href="https://infosec.exchange/tags/Phishing" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Phishing</a> <a href="https://infosec.exchange/tags/PhishingRisk" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#PhishingRisk</a>

SusiBreak your chains. <a href="https://pixelfed.de/discover/tags/rust?src=hash" class="u-url hashtag" rel="nofollow noopener noreferrer" target="_blank">#rust</a> <a href="https://pixelfed.de/discover/tags/rusty?src=hash" class="u-url hashtag" rel="nofollow noopener noreferrer" target="_blank">#rusty</a> <a href="https://pixelfed.de/discover/tags/chains?src=hash" class="u-url hashtag" rel="nofollow noopener noreferrer" target="_blank">#chains</a> <a href="https://pixelfed.de/discover/tags/padlock?src=hash" class="u-url hashtag" rel="nofollow noopener noreferrer" target="_blank">#padlock</a> <a href="https://pixelfed.de/discover/tags/withered?src=hash" class="u-url hashtag" rel="nofollow noopener noreferrer" target="_blank">#withered</a> <a href="https://pixelfed.de/discover/tags/decay?src=hash" class="u-url hashtag" rel="nofollow noopener noreferrer" target="_blank">#decay</a> <a href="https://pixelfed.de/discover/tags/thebeautyofdecay?src=hash" class="u-url hashtag" rel="nofollow noopener noreferrer" target="_blank">#thebeautyofdecay</a>

Erik van StratenWhy https instead of http?Two reasons, most important first:(1) The server is authenticated;(2) The connection between the browser and the server is encrypted and checked for changes to the data exchanged.Why is (1) most important? Because, with https, you can be reasonably sure that your browser has an impenetrable and unreadable (exchanged bytes are readable, but they make no sense because the data is encrypted) E2EE {1} connection with a server of which the DN (domain name {2}) is shown in the address bar of your browser {3}.And *that* is most important, because if you don't want to exchange data with cybercriminals, the *first* thing to do is to make sure that the server your browser is connected to, is not *owned* by cybercriminals or anyone who wants to misinform you. Therefore, server-authentication comes first.Why is (2) important? Once you're sure that (1) is okay, you don't want anyone to be able to sniff (read unencrypted data) from the connection, remove part of or change the exchanged data (on the fly), or redirect/hijack the connection to another server; https prevents all of this. Note that this protection is limited to the connection between the two E2EE endpoints only!{1} E2EE: End to End Encrypted - in such a way that AitM {4} attacks are virtually impossible.{2} DN = Domain name, simplified: a human readable, worldwide unique, alias of the IP-address of a server. Examples: "infosec.exchange", "www.google.com". Although *valid* DN's may consist only of a combination of: • characters 'a' .. 'z' (lowercase only) • character '-' (minus) • subdomain separator char '.' (dot) a lot of confusion is caused by, among other things, IDN's (International Domain Names) and apparent DN's that include a user-ID (and optionally a password), such as in "user:pw@DN" or "user@DN" which can be misleading, like in "https:⁄⁄microsoft.com@phishme.co". See <a href="https://en.wikipedia.org/wiki/Domain_name" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://en.wikipedia.org/wiki/Domain_name</a> for more info.{3} Most important preconditions: you did not see any certificate warnings or errors, no Certificate Services Provider (trusted by your browser) has submitted an illegal certificate to the server, the server's private key is not compromised, you've not installed an untrustworthy root certificate on your device and none of your device's OS, browser and plug-ins are compromised.{4} AitM or MitM: Attacker/Man in the Middle. Unless a server's private key is compromised, it is virtually impossible for an external attacker to intercept, redirect, or break open a server-authenticated https (E2EE {1}) connection.———————— | WARNINGS | ————————*YOUR* problems UNSOLVED by https:(a) You'll have to make sure that YOUR endpoint of the https connection is trustworthy (e.g. you've not accidentally installed AitM {4} malware or software such as AnyDesk), and you don't let an untrustworthy person use your device. Also see the end of {3}.(b) Even if some Certificate Authorities advertise "secure site" nonsense, https has exacly *NOTHING* to do with the trustwortyness of websites, their owners or anyone who has (or illegally obtains) access to a (https) server endpoint - or whatever lays behind that.(c) You'll have to somehow figure out who *right now* owns the DN shown in the address bar of your browser. That may be impossible if a DN ends in, for example, "pages.dev", ".dns-dynamic.net" or "my.id" (.id is for Indonesia).(d) Next, somehow you'll have to figure out how *trustworthy* that owner is (BTW, in offline life this is exactly the same). Usually that is an assumption based on reputation. How reliable is that person or organization? How well do they protect their server(s)? Will they sell and/or share your data to other parties? Do they help you if you lose access to your account? How trustworthy are any hosters or CDN's that ar being used, such as Amazon, Cloudflare and Fastly {5}?{5} W.r.t. Fastly, for example, check the 100 DN's below "X509v3 Subject Alternative Name:" in <a href="https://crt.sh/?id=13044029379" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://crt.sh/?id=13044029379</a>)? Note that Fastly reuses a few public keys in *many* certificates like that one. The server endpoint of your https connection may be one of *many* Fastly servers, *NOT* the the actual server that you've been made to believe that your browser is connected to. You have no idea how secure anything is between Fastly's proxy server(s) and the *actual* server.<a href="https://infosec.exchange/tags/Padlock" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Padlock</a> <a href="https://infosec.exchange/tags/http" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#http</a> <a href="https://infosec.exchange/tags/https" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#https</a> <a href="https://infosec.exchange/tags/httpvshttps" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#httpvshttps</a> <a href="https://infosec.exchange/tags/httpsvshttp" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#httpsvshttp</a> <a href="https://infosec.exchange/tags/TLS" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#TLS</a> <a href="https://infosec.exchange/tags/ServerAuthentication" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ServerAuthentication</a> <a href="https://infosec.exchange/tags/AitM" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#AitM</a> <a href="https://infosec.exchange/tags/MitM" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#MitM</a> <a href="https://infosec.exchange/tags/Authentication" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Authentication</a> <a href="https://infosec.exchange/tags/Impersonation" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Impersonation</a> <a href="https://infosec.exchange/tags/Phishing" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Phishing</a> <a href="https://infosec.exchange/tags/Trust" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Trust</a> <a href="https://infosec.exchange/tags/Trustworthy" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Trustworthy</a> <a href="https://infosec.exchange/tags/Trustworthyness" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Trustworthyness</a> <a href="https://infosec.exchange/tags/CDN" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#CDN</a> <a href="https://infosec.exchange/tags/Amazon" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Amazon</a> <a href="https://infosec.exchange/tags/Cloud" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Cloud</a> <a href="https://infosec.exchange/tags/Cloudservices" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Cloudservices</a> <a href="https://infosec.exchange/tags/Hosting" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Hosting</a> <a href="https://infosec.exchange/tags/Hosters" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Hosters</a> <a href="https://infosec.exchange/tags/CloudFlare" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#CloudFlare</a> <a href="https://infosec.exchange/tags/Fastly" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Fastly</a>

Erik van StratenFirefox iOS: https padlock unreliablePlease confirm if you can reproduce this!Full report: <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=1904885" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://bugzilla.mozilla.org/show_bug.cgi?id=1904885</a>To reproduce: in Firefox (iOS/iPadOS), have at least one tab open showing a site with an https connection (such as <a href="https://infosec.exchange" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://infosec.exchange</a>); then close Firefox.Next, *share* an http link to Firefox (causing it to start and open the link).For example, with Firefox still closed, open <a href="http://http.badssl.com" rel="nofollow noopener noreferrer" translate="no" target="_blank">http://http.badssl.com</a> in Safari, and share the link to Firefox (see the screenshot below). Tap the padlock (or tap in the address bar) to see that the padlock should have been striked through.Alternatively (+): configure Firefox to be the default browser. Send yourself an email with one or more http links (to sites that do not automatically redirect the browser to https), such as <a href="http://www.example.com" rel="nofollow noopener noreferrer" translate="no" target="_blank">http://www.example.com</a>.Don't forget to restore the vulnerable situation: in Firefox, open only <a href="https://mozilla.org" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://mozilla.org</a>; then close Firefox.Now open the email and tap one of the http links. Firefox starts, opens the http link and shows the padlock without strike trough, as if it were an https link.(+) Most risky scenario. Why? See my first reply to this toot.Tested vulnerable: • iOS (v17.5.1): Firefox v126, v127.0, v127.1 • iPadOS (16.7.8): Firefox v127.0<a href="https://infosec.exchange/tags/Firefox" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Firefox</a> <a href="https://infosec.exchange/tags/FirefoxiOS" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#FirefoxiOS</a> <a href="https://infosec.exchange/tags/Padlock" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Padlock</a> <a href="https://infosec.exchange/tags/http" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#http</a> <a href="https://infosec.exchange/tags/https" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#https</a> <a href="https://infosec.exchange/tags/httpvshttps" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#httpvshttps</a> <a href="https://infosec.exchange/tags/httpsvshttp" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#httpsvshttp</a> <a href="https://infosec.exchange/tags/TLS" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#TLS</a> <a href="https://infosec.exchange/tags/ServerAuthentication" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ServerAuthentication</a> <a href="https://infosec.exchange/tags/AitM" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#AitM</a> <a href="https://infosec.exchange/tags/MitM" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#MitM</a> <a href="https://infosec.exchange/tags/MozillaFirefoxiOS" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#MozillaFirefoxiOS</a>

CTDLock of the morning. <a href="https://mastodon.social/tags/padlock" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#padlock</a>

zimpenfishFederal 601HE <a class="hashtag" href="https://social.rjp.is/tag/padlock" rel="nofollow noopener noreferrer" target="_blank">#padlock</a> /via <a href="https://instagr.am/p/C8U-SjJIM2q/" rel="nofollow noopener noreferrer" target="_blank">https://instagr.am/p/C8U-SjJIM2q/</a> <a class="hashtag" href="https://social.rjp.is/tag/ifttt" rel="nofollow noopener noreferrer" target="_blank">#ifttt</a> <a class="hashtag" href="https://social.rjp.is/tag/automated" rel="nofollow noopener noreferrer" target="_blank">#automated</a>

CTDNo. 14<a href="https://mastodon.social/tags/padlock" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#padlock</a> <a href="https://mastodon.social/tags/padlocks" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#padlocks</a>

CTDMade in England. FB<a href="https://mastodon.social/tags/padlock" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#padlock</a>

Recent searches

Search options

Administered by:

Server stats:

#padlock