Mindly.Social

1 post1 participant0 posts today

Matthew TurlandIf you had to explain <a href="https://phpc.social/tags/OAuth2" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#OAuth2</a> to a relatively new SWE who only had a bit of experience interacting with public APIs from a frontend UI, are there any specific beginner-friendly online resources you'd recommend to them?<a href="https://phpc.social/tags/OAuth" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#OAuth</a> <a href="https://phpc.social/tags/Authentication" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Authentication</a> <a href="https://phpc.social/tags/SoftwareEngineering" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#SoftwareEngineering</a> <a href="https://phpc.social/tags/SoftwareDevelopment" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#SoftwareDevelopment</a> <a href="https://phpc.social/tags/Education" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Education</a>

Erik van Straten<a href="https://blahaj.zone/@Fiona" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@Fiona</a> : if you send anyone a bitmap (*) that "proves" you are you, they'll have a bitmap to prove they are you.(*) Digital imageSuch bitmaps USUALLY are saved longer than strictly necessary and OFTEN fall into the wrong hands.Using the Rabobank app may help A BIT because people will be phished to visit fake websites anyway (example: <a href="https://www.virustotal.com/gui/domain/1.rabobank.onlineomgeving.web11376.web09.bero-webspace.de" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://www.virustotal.com/gui/domain/1.rabobank.onlineomgeving.web11376.web09.bero-webspace.de</a>).In Dutch: <a href="https://www.security.nl/posting/827137/Kopie-ID%3A+kap+ermee%21" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://www.security.nl/posting/827137/Kopie-ID%3A+kap+ermee%21</a><a href="https://infosec.exchange/tags/GLWT" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#GLWT</a> <a href="https://infosec.exchange/tags/TechSolutionism" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#TechSolutionism</a> <a href="https://infosec.exchange/tags/TechSolutionisme" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#TechSolutionisme</a> <a href="https://infosec.exchange/tags/Authentication" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Authentication</a> <a href="https://infosec.exchange/tags/Impersonation" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Impersonation</a> <a href="https://infosec.exchange/tags/Authenticatie" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Authenticatie</a> <a href="https://infosec.exchange/tags/Impersonatie" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Impersonatie</a>

Joche OjedaVisual Studio Sign-In Issues: A Simple Fix (Fixing visual studio sign in error Code: 3399680404 )<a href="https://www.jocheojeda.com/2025/03/06/visual-studio-sign-in-issues-a-simple-fix-fixing-visual-studio-sign-in-error-code-3399680404/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://www.jocheojeda.com/2025/03/06/visual-studio-sign-in-issues-a-simple-fix-fixing-visual-studio-sign-in-error-code-3399680404/</a><a href="https://mastodon.social/tags/VisualStudio" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#VisualStudio</a> <a href="https://mastodon.social/tags/Authentication" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Authentication</a> <a href="https://mastodon.social/tags/SignInIssues" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#SignInIssues</a> <a href="https://mastodon.social/tags/Microsoft" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Microsoft</a> <a href="https://mastodon.social/tags/DeveloperTools" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#DeveloperTools</a> <a href="https://mastodon.social/tags/Programming" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Programming</a> <a href="https://mastodon.social/tags/Troubleshooting" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Troubleshooting</a> <a href="https://mastodon.social/tags/WindowsAuthenticationBroker" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#WindowsAuthenticationBroker</a> <a href="https://mastodon.social/tags/TechFix" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#TechFix</a> <a href="https://mastodon.social/tags/IDE" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#IDE</a> <a href="https://mastodon.social/tags/AccountProblems" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#AccountProblems</a> <a href="https://mastodon.social/tags/SoftwareDevelopment" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#SoftwareDevelopment</a>

Felix Palmen :freebsd: :c64:Ok HOW HARD CAN IT BE? 🤬 Currently trying to allow the <a href="https://mastodon.bsd.cafe/tags/Windows" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Windows</a> machine I got from work (domain member, very much locked up, no local admin for me) in my private <a href="https://mastodon.bsd.cafe/tags/wifi" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#wifi</a> network (using 802.11x <a href="https://mastodon.bsd.cafe/tags/authentication" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#authentication</a> for <a href="https://mastodon.bsd.cafe/tags/WPA" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#WPA</a> with <a href="https://mastodon.bsd.cafe/tags/freeradius" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#freeradius</a> and <a href="https://mastodon.bsd.cafe/tags/PEAP" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#PEAP</a> using my own <a href="https://mastodon.bsd.cafe/tags/samba" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#samba</a> based AD).I don't strictly *need* it, the machine connects to my open guest wifi (mapped to a VLAN with access *only* to the internet), but it would be really nice being able to also access my local services while working at home.What I tried:- Just login (PEAP/MSCHAPv2), obviously. After lots of fiddling and reading logs (freeradius as well as windows events), I found some docs suggesting Windows doesn't support that any more unless you fiddle with something in HKLM, so, no dice, need something else... - Allow EAP-TLS as well and issue a client certificate for my user, install that on windows. Doesn't work, the machine insists on using the machine cert from the machine store. - Create a client cert with the UPN of my user in my home network in SAN ... same issue - Create a client cert with the UPN of my *work* user in SAN ... - Ok screw that, get freeradius to accept that stupid machine certificate: Allow the internal CA of my workplace and *only* the CN of exactly the machine certificate.Now, it still won't work and I really don't get it, seeing stuff like:(13) eap_tls: (TLS) TLS - recv TLS 1.3 Handshake, ClientHello (13) eap_tls: (TLS) TLS - send TLS 1.1 Alert, fatal protocol_version (13) eap_tls: ERROR: (TLS) TLS - Alert write:fatal:protocol version (13) eap_tls: ERROR: (TLS) TLS - Server : Error in SSLv3 read client hello BIt makes little sense and all fiddling with TLS options so far didn't make it work. For other clients using PEAP, it just works with both TLS1.2 and TLS1.3. WTF is going on here?

damienbodBlogged: Implement Phone verification, 2FA using ASP.NET Core Identity<a href="https://damienbod.com/2025/03/03/implement-phone-verification-2fa-using-asp-net-core-identity/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://damienbod.com/2025/03/03/implement-phone-verification-2fa-using-asp-net-core-identity/</a><a href="https://mastodon.social/tags/aspnetcore" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#aspnetcore</a> <a href="https://mastodon.social/tags/dotnet" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#dotnet</a> <a href="https://mastodon.social/tags/identity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#identity</a> <a href="https://mastodon.social/tags/2fa" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#2fa</a> <a href="https://mastodon.social/tags/mfa" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#mfa</a> <a href="https://mastodon.social/tags/sms" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#sms</a> <a href="https://mastodon.social/tags/phone" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#phone</a> <a href="https://mastodon.social/tags/iam" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#iam</a> <a href="https://mastodon.social/tags/authentication" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#authentication</a>

Hacker NewsTorii – a framework agnostic authentication library for Rust — <a href="https://github.com/cmackenzie1/torii-rs" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://github.com/cmackenzie1/torii-rs</a> <a href="https://mastodon.social/tags/HackerNews" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#HackerNews</a> <a href="https://mastodon.social/tags/Torii" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Torii</a> <a href="https://mastodon.social/tags/Rust" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Rust</a> <a href="https://mastodon.social/tags/Authentication" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Authentication</a> <a href="https://mastodon.social/tags/Library" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Library</a> <a href="https://mastodon.social/tags/Framework" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Framework</a> <a href="https://mastodon.social/tags/Agnostic" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Agnostic</a> <a href="https://mastodon.social/tags/OpenSource" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#OpenSource</a>

julian2FA codes sent over ActivityPub when?

Inautilo<a href="https://mastodon.social/tags/Development" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Development</a> <a href="https://mastodon.social/tags/Findings" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Findings</a> How bad is a bad password really? · Let’s test it by setting up a ‘honeypot’ website <a href="https://ilo.im/162ire" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://ilo.im/162ire</a>_____ <a href="https://mastodon.social/tags/Attacks" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Attacks</a> <a href="https://mastodon.social/tags/Passwords" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Passwords</a> <a href="https://mastodon.social/tags/Authentication" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Authentication</a> <a href="https://mastodon.social/tags/Security" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Security</a> <a href="https://mastodon.social/tags/Honeypot" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Honeypot</a> <a href="https://mastodon.social/tags/Website" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Website</a> <a href="https://mastodon.social/tags/WordPress" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#WordPress</a> <a href="https://mastodon.social/tags/WebDev" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#WebDev</a> <a href="https://mastodon.social/tags/Backend" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Backend</a>

Honeybadger.ioNew on the HB dev blog:Learn how to implement passwordless authentication in your Django projects using email-based login, OAuth, or magic links with django-sesame.<a href="https://www.honeybadger.io/blog/options-for-passwordless-authentication-in-django/?utm_source=mastodon&utm_medium=social" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://www.honeybadger.io/blog/options-for-passwordless-authentication-in-django/?utm_source=mastodon&utm_medium=social</a> <a href="https://honeybadger.social/tags/Python" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Python</a> <a href="https://honeybadger.social/tags/Django" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Django</a> <a href="https://honeybadger.social/tags/Programming" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Programming</a> <a href="https://honeybadger.social/tags/WebDev" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#WebDev</a> <a href="https://honeybadger.social/tags/Authentication" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Authentication</a>

Abstract Technology GmbH🚀eduGAIN - The Global Academic Interfederation Service Services providing resources to the research and education sector can leverage eduGAIN, a global infrastructure that connects over 78 Federations in more then 50 countries, enabling federated access to shared services.👩‍💻As Europe's leading Open edX service partner, we integrate eduGAIN seamlessly into your LMS.  ✉️ info@abstract-technology.de<a href="https://mastodon.social/tags/OpenEdX" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#OpenEdX</a> <a href="https://mastodon.social/tags/eduGAIN" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#eduGAIN</a> <a href="https://mastodon.social/tags/SSO" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#SSO</a> <a href="https://mastodon.social/tags/eLearning" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#eLearning</a> <a href="https://mastodon.social/tags/FederatedIdentity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#FederatedIdentity</a> <a href="https://mastodon.social/tags/Authentication" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Authentication</a> <a href="https://mastodon.social/tags/community" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#community</a> <a href="https://mastodon.social/tags/opensource" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#opensource</a> <a href="https://mastodon.social/tags/edTech" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#edTech</a>

Moved to https://mk.absturztau.be/@LinuxNow, I need to find an alternative service to Ente Auth that does not require self-hosting and can be used over multiple devices simultaneously while remaining in sync (so not hardware specific). <a href="https://misskey.de/tags/Auth" rel="nofollow noopener noreferrer" target="_blank">#Auth</a> <a href="https://misskey.de/tags/Authentication" rel="nofollow noopener noreferrer" target="_blank">#Authentication</a> <a href="https://misskey.de/tags/2Step" rel="nofollow noopener noreferrer" target="_blank">#2Step</a> <a href="https://misskey.de/tags/Verification" rel="nofollow noopener noreferrer" target="_blank">#Verification</a> <a href="https://misskey.de/tags/Security" rel="nofollow noopener noreferrer" target="_blank">#Security</a> <a href="https://misskey.de/tags/InfoSec" rel="nofollow noopener noreferrer" target="_blank">#InfoSec</a> <a href="https://misskey.de/tags/InformationSecurity" rel="nofollow noopener noreferrer" target="_blank">#InformationSecurity</a>

Georgiana BrummellFirst, they shut down the Basic HTML site, forcing many of us to switch to clients such as Thunderbird. Now, they're using qr codes which are not only inaccessible to the blind but also to those who don't use smartphones! This is ridiculous! Yes, they do still have the option to click whether it's you trying to sign in or not (which still requires a smartphone and a carrier, which they claim to be concerned about), but how long before they remove that, too?<a href="https://www.pcmag.com/news/google-is-replacing-sms-codes-with-qr-codes-for-gmail-authentication" rel="nofollow noopener noreferrer" target="_blank">pcmag.com/news/google-is-repla…</a><a href="https://friendica.world/search?tag=accessibility" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#accessibility</a> <a href="https://friendica.world/search?tag=Android" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Android</a> <a href="https://friendica.world/search?tag=authentication" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#authentication</a> <a href="https://friendica.world/search?tag=blind" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#blind</a> <a href="https://friendica.world/search?tag=Google" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Google</a> <a href="https://friendica.world/search?tag=GMail" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#GMail</a> <a href="https://friendica.world/search?tag=IOS" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#IOS</a> <a href="https://friendica.world/search?tag=Narrator" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Narrator</a> <a href="https://friendica.world/search?tag=NVDA" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#NVDA</a> <a href="https://friendica.world/search?tag=sms" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#sms</a> <a href="https://friendica.world/search?tag=Talkback" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Talkback</a> <a href="https://friendica.world/search?tag=technology" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#technology</a> <a href="https://friendica.world/search?tag=Voiceover" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Voiceover</a> <a href="https://friendica.world/search?tag=Windows" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Windows</a>

Erik van StratenBiggest phishing-test in historySo some weirdo, possibly Elon Musk, instructs you to reply by mail informing him what you did last week.😱 You will be fired if you do - for failing the phishing test. You should have known that it's a hoax because Elon Musk just fired all the people who could read all of those mails.And you should have known that you should not share confidential information via email because you don't know for sure who the recipient is. Neither do you know who reads the mail "on its way" and neither does the recipient know that you are who you say that you are.Finaly, some mail ends up in spam boxes or gets dropped for frivolous reasons (Postel@RFC5321.whatever.tld) (edited 17:23 UTC - corrected the RFC nr. 825 is not SMTP - sorry!)😱 You will be fired if you don't.It's a witch hunt. The Trump govt throws you in the water. You are not a witch if you drown.<a href="https://blogs.loc.gov/law/2022/02/swimming-a-witch-evidence-in-17th-century-english-witchcraft-trials/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://blogs.loc.gov/law/2022/02/swimming-a-witch-evidence-in-17th-century-english-witchcraft-trials/</a><a href="https://infosec.exchange/tags/Authenticity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Authenticity</a> <a href="https://infosec.exchange/tags/Authentication" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Authentication</a> <a href="https://infosec.exchange/tags/Impersonation" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Impersonation</a> <a href="https://infosec.exchange/tags/Phishing" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Phishing</a> <a href="https://infosec.exchange/tags/PhishingTest" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#PhishingTest</a> <a href="https://infosec.exchange/tags/InternetSucks" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#InternetSucks</a> <a href="https://infosec.exchange/tags/InfoSec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#InfoSec</a>

Aral BalkanNew Kitten release• Fixes redirection from sign-in page when person is already authenticated.<a href="https://kitten.small-web.org" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://kitten.small-web.org</a>To learn more about how Kitten automatically implements authentication for your Small Web sites and apps using public-key cryptography (so even your own server doesn’t know your secret)¹, please see the Authentication tutorial:<a href="https://kitten.small-web.org/tutorials/authentication/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://kitten.small-web.org/tutorials/authentication/</a>Enjoy!:kitten:💕¹ The security (and privacy) of Domain/Kitten are based on a 32-byte cryptographically random secret string that only the person who owns/controls a domain knows.This is basically a Base256-encoded ed25519 secret key where the Base256 alphabet is a set of curated emoji surrogate pairs without any special modifiers chosen mainly from the animals, plants, and food groups with some exceptions (to avoid common phobias or triggers, etc.) that we call KittenMoji.…When setting up a Small Web app via Domain, this key is generated in the person’s browser, on their own computer, and is never communicated to either the Domain instance or the Kitten app being installed. Instead the ed25519 public key is sent to both and signed token authentication is used when the server needs to verify the owner’s identity (e.g., before allowing access to the administration area).The expected/encouraged behaviour is for the person to store this secret in their password manager of choice.More: <a href="https://kitten.small-web.org/reference/#cryptographic-properties" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://kitten.small-web.org/reference/#cryptographic-properties</a><a href="https://mastodon.ar.al/tags/Kitten" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Kitten</a> <a href="https://mastodon.ar.al/tags/SmallWeb" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#SmallWeb</a> <a href="https://mastodon.ar.al/tags/SmallTech" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#SmallTech</a> <a href="https://mastodon.ar.al/tags/authentication" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#authentication</a> <a href="https://mastodon.ar.al/tags/publicKeyCryptography" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#publicKeyCryptography</a> <a href="https://mastodon.ar.al/tags/web" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#web</a> <a href="https://mastodon.ar.al/tags/dev" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#dev</a> <a href="https://mastodon.ar.al/tags/NodeJS" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#NodeJS</a> <a href="https://mastodon.ar.al/tags/JavaScript" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#JavaScript</a> <a href="https://mastodon.ar.al/tags/HTML" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#HTML</a> <a href="https://mastodon.ar.al/tags/CSS" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#CSS</a>

Schneier on Security RSSDevice Code PhishingThis isn’t new, but it’s increasingly popular: The technique is known as devic... <a href="https://www.schneier.com/blog/archives/2025/02/device-code-phishing.html" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://www.schneier.com/blog/archives/2025/02/device-code-phishing.html</a> <a href="https://burn.capital/tags/authentication" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#authentication</a> <a href="https://burn.capital/tags/Uncategorized" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Uncategorized</a> <a href="https://burn.capital/tags/authorization" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#authorization</a> <a href="https://burn.capital/tags/phishing" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#phishing</a> <a href="https://burn.capital/tags/Russia" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Russia</a>

Erik van StratenFsck de overheid: "Het automatiseren van certificaatbeheer door de overheid op basis van ACME zorgt voor het efficiënter en betrouwbaarder verkrijgen, vernieuwen en intrekken van TLS-certificaten. Dit maakt de digitale overheid betrouwbaarder, wendbaarder en minder leveranciersafhankelijk", aldus de experts. "Daarnaast vermindert het gebruik van ACME de beheerlast voor het beheer van TLS-certificaten." <a href="https://www.security.nl/posting/876900/ACME+voor+uitgifte+tls-certificaten+wordt+mogelijk+verplicht+voor+overheid" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://www.security.nl/posting/876900/ACME+voor+uitgifte+tls-certificaten+wordt+mogelijk+verplicht+voor+overheid</a>.In een tijd waarin burgers, online, met steeds hogere betrouwbaarheid moeten authenticeren (o.a. voor online leeftijdsverificatie en binnenkort met eID's zoals EDIW/EUDIW), en de anonieme nepwebsites als paddenstoelen uit de grond schieten (*), is dit een *KRANKZINNIG* plan.(*) Daarbij geen strobreed in de weggelegd door BigTech - integendeel: medeplichtigheid aan cybercrime is hun verdienmodel geworden.Het grote risico hier zijn AitM- (Attacker in the Middle) aanvallen: nietsvermoedende mensen worden via een bericht of een Google zoekresultaat naar een nepwebsite gestuurd, die hen vraagt om bijv. een scan van hun paspoort te uploaden en een selfie-filmpje te maken.Beide stuurt de nepwebsite echter dóór naar een echte website, zoals van een bank, bijv. om een lening af te sluiten. De AitM neemt dat geld op, waarna het slachtoffer opdraait voor de schuld.Een ESSENTIËLE voorwaarde voor betrouwbare authenticatie is dat je de VERIFIEERDER kunt vertrouwen.Of dat zo is, weet je nooit zeker (ook offline niet). Het beste alternatief is dat je weet *WIE* de verifieerder is, en hoe betrouwbaar diens identiteit is vaatgesteld. Dat is, zonder meer, vervelend en prijzig voor eigenaren van websites waar klanten, burgers of patiënten risicovolle transacties doen en/of er vertrouwelijke gegevens mee uitwisselen - maar enorm in het belang van bezoekers van dergelijke websites.Betrouwbare authenticatie van (de juridisch aansprakelijke) eigenaar van een website m.b.v. een website-certificaat vormt *technisch* geen enkel probleem (dit *hadden* we al, maar is met een smoes gesloopt door Google).In gratis certificaten, bijvoorbeeld van Let's Encrypt (zoals gebruikt door de nepwebsites in onderstaand plaatje) staat uitsluitend een volstrekt anonieme domeinnaam; je hebt dus geen idee wie verantwoordelijk is voor de website.Juist bij overheidswebsites is het essentieel dat je weet dat het écht om een overheidswebsite gaat - iets dat bij de in het plaatje getoonde domeinnamen (ik heb de punt door + vervangen), zoals:• afhandelen-belasting+com • aflossen-belastingdienst+combeslist *niet* het geval is.En in de echte <a href="https://www.ggn.nl/contact/phishing/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://www.ggn.nl/contact/phishing/</a> kunt u voorbeelden zien van domeinnamen van nepwebsites, zoals ook te zien in onderstaand plaatje.Kennelijk lukt het niemand om dergelijke criminele websites uit de lucht te halen, terwijl de misdadigers er probleemloos Let's Encrypt certificaten voor *blijven* verkrijgen - naast dat de naar phishing stinkende domeinnamen zonder blikken of blozen worden verhuurd en nooit worden ingetrokken. Dit is simpelweg de SNELSTE en GOEDKOOPSTE oplossing voor eigenaren van websites; de *BEZOEKERS* van die websites draaien op voor alle risico's.Het onderstaande plaatje is van een Russische server, maar dit soort phishing websites vind je ook bij de vleet op door criminelen gehuurde servers van Google, Amazon, Microsoft, Digital Ocean, Cloudflare en kleinere westerse hostingbedrijven.Ben ik nou ÉCHT DE ÉNIGE die vindt dat deze gecriminaliseerde puinhoop keihard moet worden aangepakt?Zie mijn uitgebreide reactie in <a href="https://security.nl/posting/876914" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://security.nl/posting/876914</a> (beginnend met eenvoudige uitleg wat een website-certificaat is).Nb. naast certificaatuitgevers moeten ook browsers en het CA/B-forum op de schop. Doen we dit allemaal niet, dan wordt verder digitaliseren een gigantische puinhoop met steeds meer slachtoffers van identiteitsfraude.<a href="https://infosec.exchange/tags/DVcerts" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#DVcerts</a> <a href="https://infosec.exchange/tags/ACME" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ACME</a> <a href="https://infosec.exchange/tags/LetsEncrypt" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#LetsEncrypt</a> <a href="https://infosec.exchange/tags/NepSites" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#NepSites</a> <a href="https://infosec.exchange/tags/NepWebSites" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#NepWebSites</a> <a href="https://infosec.exchange/tags/Phishing" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Phishing</a> <a href="https://infosec.exchange/tags/Spoofing" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Spoofing</a> <a href="https://infosec.exchange/tags/Scams" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Scams</a> <a href="https://infosec.exchange/tags/IdentiteitsFraude" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#IdentiteitsFraude</a> <a href="https://infosec.exchange/tags/Authenticatie" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Authenticatie</a> <a href="https://infosec.exchange/tags/Impersonatie" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Impersonatie</a> <a href="https://infosec.exchange/tags/GoogleIsEvil" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#GoogleIsEvil</a> <a href="https://infosec.exchange/tags/BigTechIsEvil" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#BigTechIsEvil</a> <a href="https://infosec.exchange/tags/FakeWebSites" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#FakeWebSites</a> <a href="https://infosec.exchange/tags/AnoniemeWebsites" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#AnoniemeWebsites</a> <a href="https://infosec.exchange/tags/AnonymousWebsites" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#AnonymousWebsites</a> <a href="https://infosec.exchange/tags/OnlineAuthenticatie" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#OnlineAuthenticatie</a> <a href="https://infosec.exchange/tags/LeeftijdVerificatie" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#LeeftijdVerificatie</a> <a href="https://infosec.exchange/tags/OnlineLeeftijdVerificatie" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#OnlineLeeftijdVerificatie</a> <a href="https://infosec.exchange/tags/Authentication" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Authentication</a> <a href="https://infosec.exchange/tags/Impersonation" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Impersonation</a> <a href="https://infosec.exchange/tags/OnlineAuthentication" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#OnlineAuthentication</a> <a href="https://infosec.exchange/tags/AgeVerification" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#AgeVerification</a> <a href="https://infosec.exchange/tags/OnlineAgeVerification" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#OnlineAgeVerification</a> <a href="https://infosec.exchange/tags/AitM" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#AitM</a> <a href="https://infosec.exchange/tags/MitM" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#MitM</a> <a href="https://infosec.exchange/tags/Evilginx2" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Evilginx2</a>

Hush Line🪳 We just fixed a bug in self-verifying URLs! Tip line owners, add a link with `rel="me"` and your Hush Line address on your website, then add that website URL to the extra fields on your Hush Line bio's extra fields. You'll receive a checkmark indicating you own or have control over the address listed, adding social proof to your profile, making it more trustworthy to people in your community!<a href="https://tips.hushline.app/register" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://tips.hushline.app/register</a><a href="https://mastodon.social/tags/whistleblower" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#whistleblower</a> <a href="https://mastodon.social/tags/opensource" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#opensource</a> <a href="https://mastodon.social/tags/nonprofit" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#nonprofit</a> <a href="https://mastodon.social/tags/authentication" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#authentication</a>

The UberduckI'm looking at setting up a bunch of self hosted services to replace our (self, family, friends) dependence on corporate cloud stuff. Email (custom, since none of the Just Add Server offerings do everything I need for free), shared drive (likely nextcloud, ugh), docs (likely collabora), jitsi for video, discourse for group forums, and so on. I'd like to make all of this SSO, to the extent that it reasonably can be. I'm probably going to use FreeIPA as the identity source of truth, but I'm finding that there are enough new things I need to learn about centralized authentication that I'm having a hard time finding a starting point that doesn't require a bunch of other context. So I'm asking for help. Does anyone know of a good guide to these sorts of concepts, preferably available online? I'm familiar with most of the other Linux sysadmin concepts and have plenty of hardware and bandwidth at my disposal.If you don't have an answer but have followers who might, boosts would be appreciated.<a href="https://hachyderm.io/tags/selfhosted" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#selfhosted</a> <a href="https://hachyderm.io/tags/selfhosting" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#selfhosting</a> <a href="https://hachyderm.io/tags/SelfHostedApps" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#SelfHostedApps</a> <a href="https://hachyderm.io/tags/freeipa" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#freeipa</a> <a href="https://hachyderm.io/tags/ldap" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ldap</a> <a href="https://hachyderm.io/tags/authentication" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#authentication</a> <a href="https://hachyderm.io/tags/keycloak" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#keycloak</a> <a href="https://hachyderm.io/tags/authentik" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#authentik</a> <a href="https://hachyderm.io/tags/authelia" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#authelia</a> <a href="https://hachyderm.io/tags/kerberos" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#kerberos</a> <a href="https://hachyderm.io/tags/sysadmin" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#sysadmin</a> <a href="https://hachyderm.io/tags/linux" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#linux</a>

ax6761<a href="https://freeradical.zone/tags/PyPI" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#PyPI</a> Security: Past, Present & Future, 20250216, by Salvo "LtWorf" T, <a href="https://peertube.debian.social/w/bc988f30-b520-442b-ad3c-77a6f29fb904" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://peertube.debian.social/w/bc988f30-b520-442b-ad3c-77a6f29fb904</a> -- "py py" here, Salvo!<a href="https://freeradical.zone/tags/Python" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Python</a> <a href="https://freeradical.zone/tags/Microsoft_corp" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Microsoft_corp</a> <a href="https://freeradical.zone/tags/GitHub" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#GitHub</a> <a href="https://freeradical.zone/tags/authentication" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#authentication</a> <a href="https://freeradical.zone/tags/computerSecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#computerSecurity</a>

Inautilo<a href="https://mastodon.social/tags/Development" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Development</a> <a href="https://mastodon.social/tags/Guides" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Guides</a> Hype or future of security? · Passwords suck a lot; can passkeys fix that? <a href="https://ilo.im/1627vc" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://ilo.im/1627vc</a>_____ <a href="https://mastodon.social/tags/Device" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Device</a> <a href="https://mastodon.social/tags/Credentials" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Credentials</a> <a href="https://mastodon.social/tags/Passwords" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Passwords</a> <a href="https://mastodon.social/tags/Passkeys" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Passkeys</a> <a href="https://mastodon.social/tags/Authentication" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Authentication</a> <a href="https://mastodon.social/tags/Cryptography" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Cryptography</a> <a href="https://mastodon.social/tags/Security" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Security</a> <a href="https://mastodon.social/tags/WebDev" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#WebDev</a> <a href="https://mastodon.social/tags/Frontend" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Frontend</a> <a href="https://mastodon.social/tags/Backend" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Backend</a>

Recent searches

Search options

Administered by:

Server stats:

#authentication