@cy@chaos.social
@cy@chaos.social avatar

cy

@cy@chaos.social

software, security, devoops, DevOps Meetup Karlsruhe, CCC, milliways

This profile is from a federated server and may be incomplete. Browse more on the original instance.

thisismissem, to random
@thisismissem@hachyderm.io avatar

What's the best solution for “disk encryption” on debian, which doesn't require physical access to the device?

Like, I went with LVM, but this seems to require physical access to the device when it boots to enter in the disk encryption password

cy,
@cy@chaos.social avatar

@thisismissem my last remote Linux server dates couple years back, but I'm pretty sure I used dropbear ssh on a hetzner dedicated machine for LVM with LUKS. I can check old config later

LoungeControl, to random German
@LoungeControl@chaos.social avatar

🎈Erinnerung: Dir bleiben nur noch 7 Tage(bis zum 17.03), um sich als musikmachender Mensch für die GPN22 Lounge zu bewerben!

Wir geben gerne auch Menschen mit wenig/keiner Bühnenerfahrung eine Chance!

Hier bewerben: ➡️ https://forms.gle/B2F3SVLcVjhFdLy19

Alternativ kannst du auch die Fragen im PDF in einer E-Mail beantworten und an loungecontrol@gulas.ch senden.

Fragen (PDF):
https://cloud.entropia.de/s/BSf8NKK9ADcn5mj

Wir freuen uns auf deine Bewerbung mit Hörprobe!

cy,
@cy@chaos.social avatar

@LoungeControl @MoritzGiessmann ☝️

cy,
@cy@chaos.social avatar

@MoritzGiessmann @LoungeControl email ist keinmal

cy, to random
@cy@chaos.social avatar

so hab ich mir ein Datenschutzblog vorgestellt.

GossiTheDog, to random
@GossiTheDog@cyberplace.social avatar

deleted_by_author

    •
    cy,
    @cy@chaos.social avatar

    @GossiTheDog how is that a devops problem

    cy, to random
    @cy@chaos.social avatar

    Oha im Büro gibt's einen Waffelstand neben dem barista :)

    cy, to random
    @cy@chaos.social avatar

    gibts in eigentlich noch ein aktives Frontend/UX Meetup?
    Versuche jemand zu einem Talk zu motivieren :D
    @jugka habt ihr nen pointer? (java und javascript ist doch fast das gleiche höhö)

    blinry, to random
    @blinry@chaos.social avatar

    Hey :) @bleeptrack and I are building a learning game for the browser, and we could use your help!

    We built three prototypes, and are not sure which one is best. Today, you can try all of them! There will be a poll at the end of this thread.

    Note that these prototypes are still incomplete and a bit rough. But we think you'll figure it out!

    All three let you use a real Git, which we run in a Linux VM in your browser! 🤯

    cy,
    @cy@chaos.social avatar

    @blinry @bleeptrack @b0rk maybe you can help spraying the love (for git) 🙂

    ErikUden, to random
    @ErikUden@mastodon.de avatar

    Satire is officially dead. It has to be noted that both senators and members of congress are allowed to trade stocks — many of them criticize foreign social media and push for antitrust legislation against them simply to better their portfolio made up of American big tech companies.

    A video of Senator Tom Cotton in front of the U.S. Senate questioning the CEO of TikTok

    cy,
    @cy@chaos.social avatar

    @ErikUden slightly related: https://www.threads.net/@quiverquantitative/post/CzcB-Gsgqow

    cy, to random
    @cy@chaos.social avatar

    Warum heißt es eigentlich Förster und nicht Kiefernorthopäde?

    jwildeboer, (edited ) to random
    @jwildeboer@social.wildeboer.net avatar

    For many years, DSL/Cable routers by German company AVM, sold under the Fritz!Box brand, did some internal dns tweaking so that when you typed in http://fritz.box it would lead you to the config page of the router in your network. Now, years later, there actually is a .box TLD (Top Level Domain) and AVM forgot to register the fritz.box domain. Someone else did. And activated Certificate Pinning (HSTS).

    UPDATE 2024-01-27: Their dns entries are flaky ATM, sometimes there, mostly not.

    cy,
    @cy@chaos.social avatar

    @mvsde @jwildeboer wait till the owner sets the domain on the hsts preload list, then everyone can experience this :-)

    MoritzGiessmann, to random
    @MoritzGiessmann@mastodon.social avatar

    How cool is https://open-meteo.com/?
    Not only do they offer a free and open weather data API, they also have 80 years of historical weather data to use. Wow.

    cy,
    @cy@chaos.social avatar

    @MoritzGiessmann alter sysadmin trick:
    versuch mal auf commandline
    finger karlsruhe@graph.no
    oder
    curl wttr.in/karlsruhe

    cy, to random
    @cy@chaos.social avatar

    EMF Camp ticket sale coming up:
    https://blog.emfcamp.org/2024/01/21/emf-2024-ticket-sales/

    isotopp, to random German
    @isotopp@chaos.social avatar

    Nach einigen Wirren ist nun auch der 2. Teil des Weihnachtsgeschenks der Frau da.

    Das sind 2x 19x15W SHE HDS Moving Heads.

    Sie hat sich vor Weihnachten eine Grand MA 3 Command Wing in einer Transportbox geschossen. Die GrandMA Software tut nun endlich auf dem Mac!

    Braucht jemand eine Grand MA 2 Command Wing + Fader Wing + Lenovo Yoga mit Windows 8 und Grand MA OnPC dazu?

    cy,
    @cy@chaos.social avatar

    @isotopp

    shortridge, to Cybersecurity
    @shortridge@hachyderm.io avatar

    zealots often shame humans for writing down their passwords, but as someone who just had to excavate the digital remains of a loved one who died suddenly:

    please write down your credentials somewhere a trusted human can find them, especially your phone passcode and any primary passwords (like for email accounts, password manager, etc.)

    the humans who care about you will need that access for many reasons; a "badass" threat model will only add helplessness to their grief

    cy,
    @cy@chaos.social avatar

    @shortridge I would prefer webauthn/passkey with yubikey. You'll need a backup token anyway, so just tell your person how to use it. (actually get them yubikeys for their own accounts, too)

    cy,
    @cy@chaos.social avatar

    @shortridge it is "plug into USB, press button when prompted", how is this more complicated than typing a code from an SMS? And you don't need fingerprint for it

    cy,
    @cy@chaos.social avatar

    @cakeisnotalie @shortridge
    i understand your concern. haven't thought from that angle, thanks for sharing.. however i do think your points get worse for other MFA types, no? maybe backup keys would be sufficient next to the password. or backup webauthn private key in the backup password manage..

    still unusable for non-techies. MAYBE one should include a techie-friend into the last-resort recovery plan for your non-techie person

    MoritzGiessmann, to random
    @MoritzGiessmann@mastodon.social avatar

    How often would you want a sensor to send data if you wanted to check if the temperature inside a wall gets close to 0°C? Is once an hour enough?

    cy,
    @cy@chaos.social avatar

    @MoritzGiessmann as in any monitoring situation my question would be: do you want to react within an hour of the change? Will something be damaged at a certain temperature and if yes, how long can the exposure last before damage?

    cy,
    @cy@chaos.social avatar

    @MoritzGiessmann I guess once per hour would be sufficient then.
    Overall it's probably also depending on the sensor and how much a single point of measurement "costs".
    Like power, setup, storage etc.
    Also you asked yesterday about graphing iirc. Maybe if this is just "few data points per hour", you can get away with a free saas tier offering like grafana cloud, save you the setup for the backend, IF you sensor can push data to cloud.

    kubikpixel, (edited ) to github German
    @kubikpixel@chaos.social avatar

    deleted_by_author

    •
    cy,
    @cy@chaos.social avatar

    @kubikpixel @Codeberg und in codeberg und co sind kritische Sicherheitslücken ausgeschlossen?
    github hatte grade letzte Woche nen massiven Fuckup über GH-Actions, der nichtmal pauschal gefixt werden kann sondern wo es evtl viele weitere defekte repos gibt, vgl:
    https://johnstawinski.com/2024/01/05/worse-than-solarwinds-three-steps-to-hack-blockchains-github-and-ml-through-github-actions/

    ich will hier nicht gitlab verteidigen, aber es gibt halt einfach Fehler in Software. einen einzelnen Vendor dafür zu verteufeln ist halt irgendwie total banane.. :D

    und gitlabs hat top security

    cy, to random
    @cy@chaos.social avatar

    @SaatChris @seecurity Nachfrage zum 37c3 talk:
    woher habt ihr diese 600k KIM-Emails? habt ihr da Zugriff von der gematik bekommen oder ist das rein als Teilnehmer-Praxis ersichtlich? (und damit implizit mindestens 600k Teilnehmern (plus deren Technikern) möglich, die z.b. auch ausprobieren könnten wer da so log4shell-anfällig ist ?)

    b9AcE, to random
    @b9AcE@todon.eu avatar

    Authy is killed.

    Well... at least the desktop version of the multi-factor authentication software (a.k.a. "MFA" or over-specific "2FA").
    https://www.bleepingcomputer.com/news/security/twilio-will-ditch-its-authy-desktop-2fa-app-in-august-goes-mobile-only/

    I am reminded of the most excellent and widely respected security advocate @techlore's comments regarding Authy.
    See excerpt attached to this toot.
    Check out the source video "How to use TOTP for MAXIMUM Security" (https://www.youtube.com/watch?v=iXSyxm9jmmo) which starts at basic, beginner level on this very important concept.

    video/mp4

    cy,
    @cy@chaos.social avatar

    @b9AcE @techlore it's 2024 and services should prioritize webauthn adoption over totp for being phishing proof.

    cy,
    @cy@chaos.social avatar

    @b9AcE @techlore i would actually like to understand how, but i'm ok to wait for tomorrow :D

    cy,
    @cy@chaos.social avatar

    @b9AcE i'll just start (my opinion, and yes im actually interested in new views, not trying to troll here).
    someone who can phish a password-string can also phish the 6+ digit TOTP string. Attacker can either automate the request, easily using the stolen password +TOTP token within the timeslice to make a real request to the target site OR proxying the target site for the victim, grabbing their session cookies. webauthn prevents both, because it depends on the "real" URL used in the request.

    cy,
    @cy@chaos.social avatar

    @b9AcE i do get the "2 extra seconds of thinking while you type the code" part. (i would prefer to never get to that part though).
    i know of one paper on a downgrade attack, however their downgrade of webauthn is basically "social engineer the victim into using totp, which we can phish, or app-based 2fa, which we dont even have to phish because we get it for free"

  • All
  • Subscribed
  • Moderated
  • Favorites
  • •
  • JUstTest
  • kavyap
  • DreamBathrooms
  • thenastyranch
  • magazineikmin
  • tacticalgear
  • khanakhh
  • Youngstown
  • mdbf
  • slotface
  • rosin
  • everett
  • ngwrru68w68
  • Durango
  • megavids
  • InstantRegret
  • cubers
  • GTA5RPClips
  • cisconetworking
  • ethstaker
  • osvaldo12
  • modclub
  • normalnudes
  • provamag3
  • tester
  • anitta
  • Leos
  • lostlight
  • All magazines
    •