PC Ekspert Forum - Privatnost i sigurnost podataka i korisnika

Stranica 25 od 28

« Prva

Show 40 post(s) from this thread on one page

PC Ekspert Forum (https://forum.pcekspert.com/index.php)

- Razno (https://forum.pcekspert.com/forumdisplay.php?f=13)

- - Privatnost i sigurnost podataka i korisnika (https://forum.pcekspert.com/showthread.php?t=322402)

Neo-ST

14.10.2025. 15:37

Citiraj:

Autor Ivo_Strojnica (Post 3825653)

ajd kupi si stari mobitel. :D

Pa sad imam stari mobitel, S23 Ultra. To je po današnjim standardima staro. Nego šta sam s time onda dobio, opet sam podložan hackiranju 😅

Ivo_Strojnica

14.10.2025. 16:07

nisi.
Uzmeš stari mobitel, neki tanki, tipa pixel 6a, instaliraš na njega authentificator i to je to.
Taj mobitel nije nikad na netu niti može biti (osim ako nisi dovoljno inteligentan pa ga spojiš malo na wifi da vidiš jel na njemu još uvik dobro radi browser).

Eto ga, riješen problem.

Neo-ST

14.10.2025. 16:18

Citiraj:

Autor Ivo_Strojnica (Post 3825663)

tanki

Najbitniji detalj...
:roller:

Nego malo mi se čini overkill uzimat mobitel samo za 2fa? I onda ga stalno palit-gasit samo kad mi treba pristup nekom siteu...
Da nema neki hardware key koji može skenirat QR codove?

xlr	14.10.2025. 16:50

Citiraj:

Autor Neo-ST (Post 3825666)

Da nema neki hardware key koji može skenirat QR codove?

Mogu i hw kljucevi imati TOTP, ali ti onda treba companion app. Primjer:
https://www.token2.com/shop/product/...pin-complexity

Companion app:
https://www.token2.com/site/page/tok...app-user-guide

Ne znam imaju li Yubico i ostali bolje/lakse rjesen ovaj korak citanja TOTP-a iz kljuca. Ali vjerojatno je i ovaj scenario podlozan prijeopisanom napadu

Ivo_Strojnica

14.10.2025. 16:57

Citiraj:

Autor Neo-ST (Post 3825666)

Istina, katastrofa. Radije kupi neki specificirani uređaj koji radi na način koji ti nije intuitivan i vrlo vjerojatno je skuplji.

Čisto da se osjećaš kul. :D

Čemu jednostavno, jel tako? :D

tomek@vz

14.10.2025. 17:02

Citiraj:

Autor Neo-ST (Post 3825666)

Ideja iza zasebnog moba samo za TOTP je dedicirani uredaj koji koristis samo za to. Dakle ne mora biti biti onlajn, striktno instaliras TOTP aplikaciju i izbacis sve ostalo, kompletni lockdown tako da su gore opisani vektori napada - nemoguci. Night-ovo rijesenje je bolje jer je dovoljno jeftino iskreno i dovoljno glupo (bez ikakavih smart/phone home funkcija).

xlr	14.10.2025. 17:17

E sad, koliko je jeftino, ne znam... Kazu da baterija traje 4-5 godina ako svaki dan 10 puta citas TOTP i jednom mjesecno upisujes seed preko NFC-a. Bummer je sto kad ode baterija, moras uzeti novi uredjaj i prebaciti seedove

"Will I lose access to the TOTP profiles when the battery is dead?
A. Yes, but you will have enough time to prepare. Molto-1 will have a battery indicator on the display. You should replace your token (and migrate the TOTP tokens by resetting the second factor on each respective service) when the indicator shows the battery level as "empty" - you will still have a couple of months to do this."

Ako zbilja traje po 5 godina, ajde de.

Ali ako stalno pored sebe imas neki stari fon koji samo sjedi u ladici i realno ti ne predstavlja trosak jer si ga vec amortizirao lol, alternativa s Aegisom i prebacivanjem seedova je skroz na mjestu.

Ivo_Strojnica

14.10.2025. 17:18

ili još bolje, napraviš da ti se ne može otvoriti authentifikator bez da upišeš password/biometriju.
Aegis authentificator, naprimjer.
Čim ga minimiziraš, nema pomoći.

Neo-ST

14.10.2025. 17:39

Našao sam idealan uređaj: https://www.reiner-sct.com/en/produkt/tanjack-deluxe/

Night

15.10.2025. 08:31

Citiraj:

Autor Neo-ST (Post 3825652)

Ovo mi izgleda iznimno nepraktično.
Npr. u trenutnom 2fa appu u mobitelu imam 30+ 2fa pinova za razne siteove.
Kad mi treba 2fa za neki site, moram u search početi upisivati ime tog sitea da mi izbaci 2fa za njega.
Ovaj uređaj može spremiti samo 10 accountova? To je prvi problem.

Imaš drugi model na koji ide 100 accounta, baterija od sata ima 8g trajanje, a ova glavna se puni preko USBa i ima par mjeseci trajanja :

https://www.token2.eu/shop/product/m...hardware-token

Ako treba i QR onda što ekipa tu već napisa, stariji mobitel, instalirati sve što treba i pogasiti mu mrežu.

Citiraj:

Autor Neo-ST (Post 3825682)

Našao sam idealan uređaj: https://www.reiner-sct.com/en/produkt/tanjack-deluxe/

Ovo izgleda cool. Samo što kad umjesto cijene piše "Business customer request" čini mi se da bi moglo biti iznenađenja :)

Bono	15.10.2025. 09:10

Microsoft is adding AI powered facial recognition to OneDrive.

And it can be disabled, but get this:

“You can only turn off this setting 3 times a year.”

https://fxtwitter.com/LundukeJournal...29065421750316

Sent from my SM-S931B using Tapatalk

Libertus

15.10.2025. 09:24

Majko mila...

kopija

15.10.2025. 11:14

Pa zamisli kolko resursa je potrebno da bi se obradilo npr 15GB slika.
I onda ti to iz fore uključiš pa isključiš, sve ode u vjetar.
Normalno da hoće ljude demotivirat da drkaju po tom switchu.

This guy gets it:

Citiraj:

It probably has to run a pretty heavy workload each time it goes through your gallery so they probably mean you can't just turn it off and on and off and on forever. But that doesn't get as many clicks

https://www.brax.io/hs-fs/hubfs/clic...everywhere.jpg

Neo-ST

15.10.2025. 11:33

Citiraj:

Autor Night (Post 3825761)

Ovo izgleda cool. Samo što kad umjesto cijene piše "Business customer request" čini mi se da bi moglo biti iznenađenja :)

Moraš otvoriti stranicu na desktopu pa ti se otvori opcija da dodaš u cart i možeš naručiti kao fizička osoba. Ovaj "Business customer request" je samo ako želiš naručiti kao biznis.
Ne znam zašto na mobilnoj stranici nema "add to cart" botuna.

Također imaju i jeftiniji model sa kamerom, koji doduše nema search opciju (ako ti je potrebna kad npr. imaš puno 2fa accountova).

tomek@vz

15.10.2025. 12:01

Citiraj:

Roughly 200,000 Linux-based Framework laptops shipped with a signed UEFI shell command (mm) that can be abused to bypass Secure Boot protections -- allowing attackers to load persistent bootkits like BlackLotus or HybridPetya. Framework has begun patching affected models, though some fixes and DBX updates are still pending. BleepingComputer reports: According to firmware security company Eclypsium, the problem stems from including a 'memory modify' (mm) command in legitimately signed UEFI shells that Framework shipped with its systems. The command provides direct read/write access to system memory and is intended for low-level diagnostics and firmware debugging. However, it can also be leveraged to break the Secure Boot trust chain by targeting the gSecurity2 variable, a critical component in the process of verifying the signatures of UEFI modules.

The mm command can be abused to overwrite gSecurity2 with NULL, effectively disabling signature verification. "This command writes zeros to the memory location containing the security handler pointer, effectively disabling signature verification for all subsequent module loads." The researchers also note that the attack can be automated via startup scripts to persist across reboots.

---

Citiraj:

Bruce Schneier and Barath Raghavan say agentic AI is already broken at the core. In their IEEE Security & Privacy essay, they argue that AI agents run on untrusted data, use unverified tools, and make decisions in hostile environments. Every part of the OODA loop (observe, orient, decide, act) is open to attack. Prompt injection, data poisoning, and tool misuse corrupt the system from the inside. The model's strength, treating all input as equal, also makes it exploitable. They call this the AI security trilemma: fast, smart, or secure. Pick two. Integrity isn't a feature you bolt on later. It has to be built in from the start. "Computer security has evolved over the decades," the authors wrote. "We addressed availability despite failures through replication and decentralization. We addressed confidentiality despite breaches using authenticated encryption. Now we need to address integrity despite corruption."

"Trustworthy AI agents require integrity because we can't build reliable systems on unreliable foundations. The question isn't whether we can add integrity to AI but whether the architecture permits integrity at all."

Bono	15.10.2025. 12:56

Citiraj:

Autor kopija (Post 3825786)

Jadni ne mogu limitirati resurse, imas pravo 3 puta ugasiti, a oni ce ti 4x godisnje resetirati postavke. Tipicna indijska posla...

Sent from my SM-S931B using Tapatalk

Neo-ST

15.10.2025. 13:55

Mislim da bi ovo moglo spadati pod ovu temu ali nisam 100%, pa premjestite ako nije:

GrapheneOS is finally ready to break free from Pixels, and it may never look back

kopija

15.10.2025. 14:53

Citiraj:

Roughly 200,000 Linux-based Framework laptops shipped with a signed UEFI shell command (mm) that can be abused to bypass Secure Boot protections -- allowing attackers to load persistent bootkits like BlackLotus or HybridPetya.

Vidi vraga, ja mislio da je SecureBoot nekakva urota zlog Microsofta protivu linuxaša, kad ono ispada da je u biti security feature.
Ko što je Tin rekao "krhko je znanje, možda je pao trag istine u me, a možda su sanje".

tomek@vz

15.10.2025. 14:58

Citiraj:

Autor kopija (Post 3825838)

Moze li malo vise cinjenica bez sarkazma? Grazie :goood:

I da - that sucks:

Citiraj:

Dakle - vise je Framework problem nego Linux problem. Mozes imati najsigurniji sigurnosni koncept na svijetu ali ako je lose implementiran imas doslovce ovakvo sranje.

OuttaControl

15.10.2025. 16:48

Citiraj:

Autor Bono (Post 3825812)

Jadni ne mogu limitirati resurse, imas pravo 3 puta ugasiti, a oni ce ti 4x godisnje resetirati postavke. Tipicna indijska posla...

ja bi reka i ne godisneje nego nakon svakog updatea :D

jbt prije nekih 15 godina, it firme/korporacije su bile good guys, apple je bio najgori od svih, sad mi se cini da je apple najbolji po korisnike :lol2:

Bono	15.10.2025. 18:37

Citiraj:

Autor OuttaControl (Post 3825848)

Ko da se natjecu tko ce vise zeznuti korisnike, Do no evil sad zvuci kao neslana sala ili kasnije do the right thing.

mkey	15.10.2025. 22:40

Citiraj:

Autor Neo-ST (Post 3825825)

Mislim da bi ovo moglo spadati pod ovu temu ali nisam 100%, pa premjestite ako nije:

GrapheneOS is finally ready to break free from Pixels, and it may never look back

Bude to po meni dodatni premium za GrapheneOS.

Bono	15.10.2025. 23:18

Moguce da se radi o Nothing phonu.

Sent from my SM-S931B using Tapatalk

Sinac

16.10.2025. 10:46

Vidim da je rasprava tu još uvijek aktualna. No, da skratim svoju priču, ponovit ću ono što mi se desilo prije kojih dvadesetak godina dok sam imao svoj obrt i održavao računala.
Epizoda 1 - pošalje mene kolega u računovodstvo jednog poduzeća jer u računovodstvu jedno računalo izgleda ima virus. I ulazim ja u sobu računovodstva, nisam ni zatvorio vrata za sobom kad kaže meni voditeljica računovodstva da joj ne praznim "mapu Recycle Bin na desktopu" jer si je tamo pospremila važne dokumente. OK, pokušavam ja spojiti sliku i zvuk te rečenice, sjednem za računalo i u Recycle Binu hrpa Excel datoteka. Meni pada mrak na oči, napravim novu mapu, prebacim sve datoteke i objasnim teti Biserki da je mogla ostati bez tih dokumenata kao od šale, pogotovo kod uklanjanja virusa. Ona to poprati osmjehom i kaže: "Nisam znala kako napraviti drugu mapu na desktopu pa sam tu pospremala."
Zemljo, otvori se.
Epizoda 2 istog poduzeća nakon nekih 2-3 mjeseca - isto računalo opet s problemima, dođem, pregledavam računalo i skužim da HDD klikće i da je na putu u vječna lovišta. Kažem ja teti Biserki da disk odlazi i da ima još najviše mjesec dana do tri mjeseca da sve prebace na novi disk. Još ja javim kolegi koji me prvi puta poslao tamo o čemu se radi, kažem disk će crknuti za mjesec dana i kaže on da će javiti šefu jer se zna s njim. Još kolega šalje ponudu za novi disk i prebacivanje podataka, cifra nije bila veća od 1.000 kn s PDV-om, ali nije dobio nikakav odgovor.
Epizoda 3 istog poduzeća nakon 30 dana od zadnje intervencije - šalje opet mene kolega jer isto računalo "nešto ne radi". Naravno da je krepao disk za koji sam rekao da crkava i koji sam tada izvadio, predao kolegi da odnese na spašavanje podataka koje je koštalo cca 3.500 kn, a poduzeće je moralo kupiti i novi disk.

Sve u svemu, ušteda koju je poduzeće htjelo na silu provesti pokazala se kao najveći trošak, pogubili su par Excel datoteka, ali je teti Biserki bilo drago da "ima samo 3 dana posla" da opet složi tablice jer bi se inače godinu dana zabavljala slažući tablice iz daleke prošlosti i sadašnjosti, ne računajući da joj dolaze i nove tablice.

Eto, toliko o sigurnosti podataka i korisnicima... :lol2:

tomek@vz

16.10.2025. 10:58

Citiraj:

Autor Sinac (Post 3825950)

Uf...izronile stare misli koje sam pokopao duboko...imao sam nazalost slicnih iskustava. Mnogi djelatnici/djelatnice u firme pogotovo u drzavnim firmama bas na ovaj nacin funkcioniraju nazalost. Hovewer. Oni najcesce nisu na ovom forumu. Ima i neukih koji neznaju drugacije i kad ih se informira promjene nacin ophodenja sa svakodnevnim problemima. Zbog takvih se isplati uzet vremena i opisat bas ovakve stvari. Drugo kaj za nas admine to znaci da smo ko jedna velika zajednica koja se lijeci od psiholoskih posljedica dnevne interakcije sa takvim osobama :D

geronimo_2

16.10.2025. 11:13

ovakvima gore navedenima bi trebalo zakonom zabranit pric bilo kakvoj IT opremi koja je javna/drzavna...
boze sacuvaj.
nagledao sam se i ja svacega.
i onda nam prodaju pricice da ce biti sve safe loooool

domy_os

16.10.2025. 12:19

Microsoft Online Services Subprocessor Disclosure

Citiraj:

This notice is to inform you of an update regarding the Microsoft Online Services Subprocessors List.

Microsoft may use non-Microsoft organizations to help provide Online Services. As a function of their role for Microsoft, a small set of these organizations may process your customer data or personal data, only to deliver the services Microsoft has retained them to provide; they are prohibited from using your data for any other purpose. In accordance with GDPR, we disclose these subprocessors to you in advance of their first engagement and provide notification of any changes over time.

To obtain Microsoft’s disclosure of Online Services Subprocessors, you may locate it within the Microsoft Trust Center located here.

Please see the “Summary of changes since the last disclosure” in the disclosure of Online Services Subprocessors available at the link above for details on the intended changes concerning the addition or replacement of other processors.

tomek@vz

16.10.2025. 20:09

Hebeno :P

Citiraj:

New research shows that threats to privacy and security don't always travel by wire. Increasingly, they come from above – hidden in satellite signals few had ever thought to inspect. Most organizations notified about these vulnerabilities have since moved to encrypt sensitive satellite links. Yet with so many technologies dependent on orbital infrastructure, countless transmissions remain exposed to exploitation.
A new academic investigation has exposed a widespread and largely overlooked vulnerability in global satellite communications. Researchers from the University of California, San Diego, and the University of Maryland found that a significant share of geostationary satellite signals – responsible for transmitting vast amounts of sensitive data every day – remain unencrypted.

> Techspot

tomek@vz

17.10.2025. 18:21

Citiraj:

Trend Micro researchers disclosed details of a new campaign, tracked as Operation Zero Disco, that exploited a recently disclosed security flaw impacting Cisco IOS Software and IOS XE Software to deploy Linux rootkits on older, unprotected systems.
The vulnerability, tracked as CVE-2025-20352 (CVSS score: 7.7), impacts Cisco IOS and IOS XE Software. The high-severity vulnerability resides in the Simple Network Management Protocol (SNMP) subsystem of Cisco IOS Software and IOS XE Software.
The flaw allows remote authenticated attackers to trigger a DoS condition with low privileges or achieve root code execution with high privileges. An attacker could exploit the flaw by sending a crafted SNMP packet to a vulnerable device over IPv4 or IPv6 networks. The root cause of this vulnerability is a stack overflow condition in the SNMP subsystem of the affected software. The vulnerability impacts all devices with SNMP enabled.

> securityaffairs

Citiraj:

A newly uncovered Linux rootkit, dubbed LinkPro, leverages extended Berkeley Packet Filter (eBPF) technology to conceal its presence and maintain persistence on compromised systems.
The Synacktiv CSIRT discovered the malware during an investigation of a breached AWS infrastructure. LinkPro operated as a stealthy backdoor across Elastic Kubernetes Service (EKS) clusters following the exploitation of a public-facing Jenkins server (CVE-2024-238976).

> cyberpress

tomek@vz

18.10.2025. 08:08

Citiraj:

By embedding malicious code into the cryptographic backbone of blockchain networks, hackers are effectively turning one of the most tamper-resistant technologies into a resilient delivery system for cyberattacks. For cybersecurity teams, the findings highlight a growing challenge: the same decentralization that secures digital currencies is now being exploited to hide and distribute malware beyond the reach of any central authority.
Hackers aligned with North Korea are using public cryptocurrency blockchains to conceal and distribute malicious code, adopting a technique researchers describe as a new form of untouchable online hosting.
The approach reuses the design of blockchain smart contracts, a system intended for transparency and trust, to store and deliver malware in ways that are nearly impossible to disrupt.

> Techspot

Sva vremena su GMT +2. Sada je 01:16.

Stranica 25 od 28

« Prva

Show 40 post(s) from this thread on one page