Yellow Flag

Wladimir Palant, software developer and security researcher, browser extensions expert. / tfr

#infosec #cybersecurty #cryptography #privacy

Public Key

npub190z95jsfjmjuzvdrq2t27ucldpvvsvh46tcxl9elexhy9mp2qeps6f5wdd

NIP-05 Address

[email protected]

Profile Code

nprofile1qqszh3z6fgyedewpxx3s9940wv0kskxgxt6a9ur0juluntjzas4qvscpz3mhxue69uhhyetvv9ujuerpd46hxtnfduqs6amnwvaz7tmwdaejumr0dszgklys

Publishing to

relay.damus.io

nos.lol

Author Public Key

npub190z95jsfjmjuzvdrq2t27ucldpvvsvh46tcxl9elexhy9mp2qeps6f5wdd

Show more details

Last Notes

2024-06-06 13:09:48

- reply

@npub1x2v…ar98 It absolutely is possible, you merely have to remove some information. Typical approach is removing the last byte from it – you can still do geolocation without it, but you can no longer trace it back to an individual.

2024-06-06 10:32:22

I’m downloading logs from a Strato webspace. Their management interface produces the following note:
“For data protection reasons, the host name or IP address of the client accessing the website is anonymized in the log files.”
Ok, good to know. Looking into the downloaded logs:
anon-66-249-71-47.googlebot.com
Yes, the famous “prepend anon to IP address/host name” anonymization. Definitely GDPR compliant. /s
#privacy #gdpr #strato

2024-04-30 12:37:50

Old and busted: You rent a slice of a server somewhere and pay a fixed price each month.
New and enlightened: You use our cloud and save massively thanks to our variable pricing! Except when you are hit by an unexpected burst of traffic, then your bill could suddenly grow into four digits or more. No, of course we won’t warn you if that happens and we won’t restrict the traffic either, why would we? By the way, we expect to be paid on time.

2024-04-30 10:40:11

Interesting article, the Dangling DNS equivalent with Amazon S3 buckets and added financial benefits for Amazon. via @npub1lkk…5ldm
https://medium.com/@maciej.pocwierz/how-an-empty-s3-bucket-can-make-your-aws-bill-explode-934a383cb8b1

2024-04-26 07:51:02

This is a damning conclusion for passkeys here (by @npub1rg2…hzyu):
“We missed our golden chance to eliminate passwords through a desire to capture markets and promote hype.”
https://fy.blackhats.net.au/blog/2024-04-26-passkeys-a-shattered-dream/

2024-04-23 20:08:27

Nice writeup on Deno sandbox issues. Funny how most of it boils down to a very basic issue: they did security checks on the normalized file path, only to perform the actual operations with the original messy path (which was then interpreted differently). via @npub1axy…lves
https://secfault-security.com/blog/deno.html

2024-03-28 20:17:31

- reply

@npub1vu7…nmuv Supposedly, this isn’t about riding the hype but rather assessing the risks. Trouble is, very few people claiming expertise in AI are qualified to talk about risks.

2024-03-28 19:42:49

“Biden orders every US agency to appoint a chief AI officer”
Wonderful idea. Particularly the requirement for “significant expertise in AI.” Government agencies are great at judging expertise in fields that they have no idea about. This will definitely not push lots of dazzlers into government jobs and wreak havoc. /s
https://arstechnica.com/?p=2013196

2024-02-22 16:59:32

- reply

@npub1fpe…75rh Yes. But the really ridiculous part is that he didn’t leave it with individual files. Quite frankly, I’m not sure myself how one could credibly fake an entire disk image. Sure, one could use a computer with a clock really set in the past. One could install an outdated OS version and actually use that one. One could carefully choose software which actually existed back in the day. One might also be able to find hardware which actually existed in 2007, so there wouldn’t be traces of “impossible” hardware components in the Windows configuration or any of the less obvious places.
Yet running a computer disconnected from the outside world is unrealistic. There would be NTP errors in the logs because of the wrong computer clock. It’s impossible to produce a credible browsing history, with websites being not at all what they used to be in 2007. And even Windows updates would likely produce logs that are inconsistent with year 2007 because the whole Microsoft infrastructure changed massively.

2024-02-05 20:52:40

So many tech dudes commenting on https://infosec.exchange/@[email protected]/111880028533855800 with essentially “boys will be boys.” Each of them part of the problem that we have as a society and as an industry.
Being an old white man myself, let me tell you: no, men aren’t “inherently” likely to engage in behaviors that endanger others. We as a society encourage them to do it, by not holding them responsible. By inventing genetic or evolutionary “reasons” for their behavior. By expecting girls to care about others but excusing boys when they don’t. And so on, the list is long.
Just look at the dude with an ego so fragile, he spent $44 billion to build an echo chamber where nobody could contradict him. Now that everyone knows exactly what he stands for, did his millions of fans turn away from him? Did his enterprises go bankrupt because nobody wanted to do business with him any more? Did the media stop catching his every word like he is the next messiah? Nope, his whole life is one single upward failure.
Hold the assholes responsible. Don’t find excuses for their behavior.
Oh, and try not to be one of them yourself. It’s easy: surround yourself with people not afraid to tell you when you are wrong. And listen to them.

2024-02-02 20:08:24

- reply

@npub1jqc…3mpt
„Zudem ist die genaue Sicherheitslücke bisher noch geheim“
…für einige Definitionen von „geheim“.
Der Patch für die Sicherheitslücke ist öffentlich und eigentlich recht simpel. Wer das Problem nachvollziehen will, wird es tun können. Die Tatsache, dass bisher kein Exploit veröffentlicht wurde, ist also kein Grund zur Entwarnung.
Dass in dem Zeitfenster bis morgen etwas passiert, ist natürlich trotzdem unwahrscheinlich. Dennoch wäre es vielleicht besser, die Dringlichkeit dieses Updates nicht herunterzuspielen.

2024-01-26 23:47:42

My ThinkPad broke down after mere two years of service, so I’ve got to try out #FrameworkLaptop way earlier than expected. Transplanting the SSD from the defect laptop went without a hitch, so I didn’t have to set up Linux from scratch. Some first impressions:
· Assembling everything really took five minutes and was super easy. It’s a comforting thought that replacing any components other than the display will be just as easy.
· Both keyboard and touchpad are way more precise than ThinkPad’s. I didn’t realize how bad typing on the ThinkPad was until I tried this keyboard.
· Unfortunately, the big keyboard keys apparently left no space for a proper navigation block. Only arrow keys and way too small, no PgDn/Pos1 keys. And no physical middle mouse button either.
· I still need to get used to the display but it does have a lot more vertical space thanks to the 3:2 side ratio. Great to actually get work done.
· Shipping from Taiwan, ugh…

2024-01-22 19:35:52

This is wild. HP’s defense in the lawsuit demanding that HP doesn’t block third-party ink cartridges is: “Someone could hack a printer using a malicious cartridge.” And while this reads like complete bullshit invented for gullible judges, it appears that they in fact had at least one vulnerability in this area:
“A researcher found a vulnerability over the serial interface between the cartridge and the printer. Essentially, they found a buffer overflow.”
Mind you: the very reason this communication between the cartridge and the printer exists is HP’s attempts to block third-party cartridges. Also, as the Michael Miller quote in the article already says, the fact that this extremely limited interface can be exploited is a sign of terrible engine design.
The obvious course of action would have been fixing the vulnerability, restricting the interface to avoid any new vulnerabilities and forgetting about it. Instead, HP used this vulnerability as an excuse to once again cripple the competition.
https://arstechnica.com/gadgets/2024/01/hp-ceo-blocking-third-party-ink-from-printers-fights-viruses/

2024-01-18 13:25:12

German law is making security research a risky business.
Current news: A court found a developer guilty of “hacking.” His crime: he was tasked with looking into a software that produced way too many log messages. And he discovered that this software was making a MySQL connection to the vendor’s database server.
When he checked that MySQL connection, he realized that the database contained data belonging to not merely his client but all of the vendor’s customers. So he immediately informed the vendor – and while they fixed this vulnerability they also pressed charges.
There was apparently considerable discussion as to whether hardcoding database credentials in the application (visible as plain text, not even decompiling required) is sufficient protection to justify hacking charges. But the court ruling says: yes, there was a password, so there is a protection mechanism which was circumvented, and that’s hacking.
I very much hope that there will be a next instance ruling overturning this decision again. But it’s exactly as people feared: no matter how flawed the supposed “protection,” its mere existence turns security research into criminal hacking under the German law. This has a chilling effect on legitimate research, allowing companies to get away with inadequate security and in the end endangering users.
Source: https://www.heise.de/news/Warum-ein-Sicherheitsforscher-im-Fall-Modern-Solution-verurteilt-wurde-9601392.html

2024-01-17 22:59:32

I may be stating the obvious but I see Murphy’s law as the guiding principle for security and privacy design: “Anything that can go wrong will go wrong.”
Doing manual memory management? Someone will inevitably introduce a use-after-free vulnerability.
User input has to be escaped everywhere? Sorry but you will have XSS vulnerabilities because someone forgot escaping and the reviewer missed it.
Storing users’ location data? Too bad, some attackers will get their hands on it and abuse the hell out of it.
More checks and balances will only get us so far. Patching to stay ahead of the attackers will only get us so far. What really helps is eliminating the potential for mistakes.
Memory-safe languages don’t require every contributor to be an expert in order to avoid memory errors. There are frameworks which will perform any required escaping actions automatically, or even avoid the need for these completely. And you can always reconsider collecting data that you can do without, or you can at least choose not to keep it. You cannot leak data that you don’t have.
As developers, we are sometimes trapped in the mentality that us being experts we won’t make a mistake. But even if everyone on a project were an absolute expert, all people have their bad days. Systems should not be designed with the expectation of people who won’t mess up.

2024-01-03 22:56:46

- reply

@npub1a76…3kkt Please stop publishing these misleading graphs. This only applies to random passwords, yet very few of the real-world passwords are actually random. "Password1!" does not take 5 months to bruteforce, it will be guessed instantly. And a random password with the same characteristics can only be bruteforced in 5 months if the attackers can test hundreds of billions of guesses per second – meaning that passwords were hashed with MD5 or similar. And rather than educating users, this is better helped by educating developers to stop using fast hashing functions for passwords.

2023-11-25 10:47:46

- reply

@npub1h4u…cnpk Auch eine kaputte Uhr zeigt zweimal am Tag die richtige Uhrzeit an.
Die KI ist tatsächlich extrem auf die USA und allenfalls Westeuropa zentriert, mit allen möglichen daraus resultierenden Vorurteilen. Aber das sagen auch Leute, die man eher zitieren sollte als Putin.

2023-10-29 12:37:58

- reply

@npub1h4u…cnpk Nein, es hat Vorfälle gegeben, wo die Regierung eines Landes kurzerhand das Internet abgeschaltet hat. Wenn ich mich richtig erinnere, sieht auch Frankreichs Regierung ein solches Vorgehen für den "Notfall" vor.
Hier dagegen gehe ich eher nicht davon aus, dass Israel das Internet für Gaza kontrolliert. Dass in einem Krieg die Infrastruktur in Mitleidenschaft gezogen wird, braucht keine Verschwörung.

2023-10-17 20:16:56

- reply

@npub1vcl…k6t3 The person who resolved your report, was it a Xitter or a HackerOne employee? Typically it’s the latter. They have almost no idea about the product, and they will close any out of the box issues.
You might be able to argue against the closure, so that your report is escalated to Xitter. Assuming that they still have any security staff.

2023-10-12 21:06:18

- reply

@npub1h4u…cnpk Ich vermute, dass die Antwort einfacher ist. Wenn der Aufschrei groß genug ist, sagt Apple irgendwann vermutlich, das Feature sei sicherheitsrelevant: man müsse schließlich wissen, wie oft Signaturen von Schadsoftware real vorkommen, damit man gegensteuern kann.
Was man dann nicht erwähnt: eigentlich hat Apple ein großes Interesse daran zu wissen, welche Apps wie oft genutzt werden. Schließlich ist man ja berüchtigt dafür, besonders erfolgreiche Ideen in eigenen Anwendungen zu kopieren.

2023-09-26 11:05:00

- reply

@npub1h4u…cnpk „Unbequem geblieben“ ist aber eine interessante Umschreibung für „Creep“. 🤔

2023-09-18 19:05:12

- reply

@npub1h4u…cnpk Meinst Du wirklich, es wäre derart wichtig, ob die Daten im Hauptspeicher (nicht auf der Festplatte) unverschlüsselt sind? Hauptspeicher auslesen geht nur mit weitreichenden Privilegien auf dem Computer. Die Fälle, wo das nicht ohnehin bedeutet, dass alle Passwörter kompromittiert sind, scheinen recht überschaubar zu sein.
Dass man gerne nachschaut, ob Passwörter unverschlüsselt im Hauptspeicher sind, ist dagegen nachvollziehbar. Das ist ziemlich trivial, und fast alle Passwortmanager fallen bei diesem Test auf die eine oder andere Art durch.
Edit: Die Begründung, mit der man abgelehnt hat, dieses Problem zu beheben, ist für mich völlig nachvollziehbar.

2023-08-29 11:09:29

Many people seem still unaware of just how bad Chrome Sync is for your privacy. By default, Chrome will sync all your data – including e.g. your passwords, bookmarks, browsing history and open tabs. And by default, Chrome will not encrypt any of this data. All of it will be accessible by Google, by anyone who subpoenas Google to turn up your data and whoever else managed to get access to these servers.
If you want this data encrypted before it is first uploaded, you need to click “Settings” instead of confirming sync, then expand “Encryption options” and set up a sync passphrase. The default option “Encrypt synced passwords with your Google Account” is essentially a disguised “We can access all your data but we promise not to look. Don’t you trust us?”
The only positive aspect here: Chrome Sync used to be a lot worse. It used to enable automatically when you signed into Chrome. It used to encrypt only passwords and none of the other data even if you set up a passphrase. It used to warn you when setting a passphrase because Google’s web services would no longer be able to access your passwords. It used to upload data without encryption first, only allowing to enable encryption after the fact. And its encryption used to be horribly broken. I wrote about that five years ago: https://palant.info/2018/03/13/can-chrome-sync-or-firefox-sync-be-trusted-with-sensitive-data/#chrome-sync
But even now, Chrome Sync requires you to take action in order to get privacy. Because Google knows that you won’t. Compare that to Firefox Sync which has always been encrypting all data by default. I criticized the implementation here as well, but that was really a minor issue compared to the mess which is Chrome Sync.
#Google #GoogleChrome #privacy
Edit: Removed link to a post claiming that Google is censoring synced bookmarks. This claim appears to be incorrect, the message there referring to a different Google service.

2023-08-25 19:28:58

- reply

@npub1az9…swru But did the concept of “cross-origin” even exist in 1993? IFAIK the same-origin security boundary was introduced considerably later, only after frames were introduced and became capable of messing with each other.

2023-06-05 15:34:07

- reply

@npub1gh6…20cq It went live today: https://palant.info/2023/06/05/introducing-pcvark-and-their-malicious-ad-blockers/
And there will be another article – there is really no end to malicious extensions…

2023-06-03 21:24:08

- reply

@npub1gh6…20cq Yes, seen it. They even put my quote into the article title.
Btw, going to publish another article on some ad blockers published by a company that specializes in “potentially unwanted software.” Google recently removed at least two of their ad blockers. Yet two others remain despite being almost identical code-wise.