#CoSoSec Poll:

Compared to your ISP, do you trust darknet nodes... ?

Well, my confidence in Firefox has just dropped a bit. #CoSoSec

https://twitter.com/MichalPurzynski/status/1293220570885062657

This sounds pretty awesome. Or terrifying. #CoSoSec

//

Ciphey is an automated decryption tool. Input encrypted text, get the decrypted text back.

"What type of encryption?"

That's the point. You don't know, you just know it's possibly encrypted. Ciphey will figure it out for you.
Ciphey can solve most things in 3 seconds or less.

https://github.com/Ciphey/Ciphey

The U.S. National Security Agency (NSA) today has published guidance on how to expose as little location information as possible while using mobile and IoT devices, social media, and mobile apps.

https://www.bleepingcomputer.com/news/security/nsa-offers-advice-on-how-to-reduce-location-tracking-risks/

#cososec

This has been a problem with Tor for a while now, and it appears to be getting worse. It is the main reason I don't feel any safer using it.
#CoSoSec

//

How Malicious Tor Relays are Exploiting Users in 2020 (Part I)

>23% of the Tor network’s exit capacity has been attacking Tor users

https://medium.com/@nusenu/how-malicious-tor-relays-are-exploiting-users-in-2020-part-i-1097575c0cac

It's 11 PM. Do you know where your removable keyboard cables are?
#CoSoSec

https://twitter.com/_MG_/status/1291857948600221696

Here is a thorough analysis of what user data TikTok is sending back. It's less than you might think. #CoSoSec

//

TikTok: Logs, Logs, Logs. We are in 2020 and the US president is… | by Elliot Alderson | Aug, 2020 | Medium

https://medium.com/@fs0c131y/tiktok-logs-logs-logs-e93e8162647a

I use Bitwarden, and I am not very enthused by this news. Biometrics are not as secure as a strong password with 2FA, especially face ID. A password vault should have the strongest protection you have available.

I suppose it's better than someone using a weak password or PIN, but there's no way I'd use this feature.

//

Say Hello to Windows Hello and Touch ID in the Bitwarden Desktop App | Bitwarden Blog

https://bitwarden.com/blog/post/introducing-desktop-biometrics/

#CoSoSec

Firefox is launching their own email masking / forwarding service.

https://blog.mozilla.org/firefox/firefox-relay/

#CoSoSec

Summary of hypotheses on Twitter hack.

https://twitter.com/RachelTobac/status/1286103921350438914

#CoSoSec

🔥 #CoSoSec 🔥

Keep your eyes open for this one. No modified hardware required.

//

BadPower attack corrupts fast chargers to melt or set your device on fire

Attackers can alter the firmware of fast charger devices to deliver extra voltage and damage connected equipment.

https://www.zdnet.com/article/badpower-attack-corrupts-fast-chargers-to-melt-or-set-your-device-on-fire/

I won't link it here, but Brian Krebs is once again doxxing individuals who he believes are responsible for the recent Twitter compromise.

Way to make it harder for law enforcement to do their jobs, and to potentially ruin people's lives if you're wrong (or their families' lives even if you're right).

This is why I no longer respect Brian Krebs.

#CoSoSec

This is super cool - a network breach canary generator!

http://canarytokens.org/

#CoSoSec

It doesn't matter how good your password and MFA game is, if you are careless with what you post on social media.
#CoSoSec

https://twitter.com/donie/status/1283599658074464256

🚨 #CoSoSec 🚨
Hackers Are Breaking Directly Into Telecom Companies to Take Over Customer Phone Numbers

SIM swappers have escalated from bribing employees to using remote desktop software to get direct access to internal T-Mobile, AT&T, and Sprint tools.

https://www.vice.com/en_us/article/5dmbjx/how-hackers-are-breaking-into-att-tmobile-sprint-to-sim-swap-yeh

"Hackers used social engineering to target some of Twitter’s employees and then gained access to the high-profile accounts."

AP News: Experts say Twitter breach troubling, undermines trust

https://apnews.com/7f8907e7f9c46ecb044ad3758d01441b

#CoSoSec

Hmm. #CoSoSec

Twitter Is Removing Images of Internal Tool Sources Say Enables Account Takeover

Multiple screenshots obtained by Motherboard show an internal panel that are being shared in the underground after a wave of account takeovers.

https://www.vice.com/en_us/article/jgxd3d/twitter-insider-access-panel-account-hacks-biden-uber-bezos

#CoSoSec

Rachel Tobac with some thoughts on the Twitter incident. #CoSoSec

https://twitter.com/RachelTobac/status/1283509795316658176

What does #CoSoSec think about how big a deal this is or is not?

A few thoughts about Signal’s Secure Value Recovery

https://blog.cryptographyengineering.com/2020/07/10/a-few-thoughts-about-signals-secure-value-recovery/