PC Ekspert Forum - Privatnost i sigurnost podataka i korisnika

PC Ekspert Forum (https://forum.pcekspert.com/index.php)

- Razno (https://forum.pcekspert.com/forumdisplay.php?f=13)

- - Privatnost i sigurnost podataka i korisnika (https://forum.pcekspert.com/showthread.php?t=322402)

Citiraj:

Autor tomek@vz (Post 3825183)

Signal?

https://matrix.org/ecosystem/hosting/

Citiraj:

Autor strikoo (Post 3826285)

https://matrix.org/ecosystem/hosting/

I šta se desi ako zatvore matrix.org domenu ?

Citiraj:

Autor Neo-ST (Post 3826288)

I šta se desi ako zatvore matrix.org domenu ?

Onda pređeš na Session i zaboraviš na sve ostale gluposti, uključujući Signal.

Session se bazira na Signal protokolu, dok se Matrix/Element može koristiti i kroz self-hosting.

Ajde da ne potrošim pet sati uludo, mogu li s matrixom zamijeniti whatsapp, viber i slične aplikacije? U smisla da eliminiram to sranje s telefona ali da i dalje mogu komunicirati s ekipom koja ih koristi?

Izgleda da se može, a i Element kao aplikacija koja se bazira na Matrix protokolu, podržava slične funkcionalnosti.

Citiraj:

Matrix supports bridging messages from different chat applications into Matrix rooms. These bridges are programs that run on the server and communicate with the non-Matrix servers.

Bridges for the following notable applications are maintained by the community:

Apple iMessage
Discord
Email
Facebook Messenger/Instagram
Google Chat
GroupMe
Mastodon
RSS/Twitter feeds
Signal
Skype
Telegram
SMS
WeChat
WhatsApp
LinkedIn

Hmeh, ima tu tona raznih ograničenja. Lakše je samo šutnut to sranje, WA naročito.
https://ems-docs.element.io/books/el...hatsapp-bridge

Citiraj:

Cybercriminals are exploiting weak email authentication settings in Zendesk, using the platform's customer support systems to bombard targets with thousands of spam and harassing messages that appear to come from legitimate companies like The Washington Post, Discord, and NordVPN. KrebsOnSecurity reports:

Citiraj:

Zendesk is an automated help desk service designed to make it simple for people to contact companies for customer support issues. Earlier this week, KrebsOnSecurity started receiving thousands of ticket creation notification messages through Zendesk in rapid succession, each bearing the name of different Zendesk customers, such as CapCom, CompTIA, Discord, GMAC, NordVPN, The Washington Post, and Tinder.

The abusive missives sent via Zendesk's platform can include any subject line chosen by the abusers. In my case, the messages variously warned about a supposed law enforcement investigation involving KrebsOnSecurity.com, or else contained personal insults. Moreover, the automated messages that are sent out from this type of abuse all come from customer domain names -- not from Zendesk. [...]

In all of the cases above, the messaging abuse would not have been possible if Zendesk customers validated support request email addresses prior to sending responses. Failing to do so may make it easier for Zendesk clients to handle customer support requests, but it also allows ne'er-do-wells to sully the sender's brand in service of disruptive and malicious email floods.

"We recognize that our systems were leveraged against you in a distributed, many-against-one manner," said Carolyn Camoens, communications director at Zendesk. "We are actively investigating additional preventive measures. We are also advising customers experiencing this type of activity to follow our general security best practices and configure an authenticated ticket creation workflow."

Citiraj:

A high-severity vulnerability in the Pluggable Authentication Modules (PAM) framework was assigned the identifier CVE-2025-8941.
This vulnerability stems from the heart of Linux operating systems, enabling attackers with local access to exploit symlink attacks and race conditions for full root privilege escalation.
Root access, the ideal of control in Unix-like environments, could open doors to widespread system compromise and data breaches, underscoring the risks in even the most trusted open-source tools.
Security researchers warn that this issue demands immediate attention, especially for servers and desktops relying on Linux-PAM for user authentication.
Local users might become superusers, raising concerns for both corporate networks and personal devices. The disclosure of this flaw shows the ongoing difficulties in securing authentication systems as threats continue to change.

> cybersecuritynews

------

Citiraj:

"Eleven days ago, the nonprofit entity that develops the protocol, Signal Messenger LLC, published a 5,900-word write-up describing its latest updates that bring Signal a significant step toward being fully quantum-resistant," writes Ars Technica:

Citiraj:

The mechanism that has made this constant key evolution possible over the past decade is what protocol developers call a "double ratchet." Just as a traditional ratchet allows a gear to rotate in one direction but not in the other, the Signal ratchets allow messaging parties to create new keys based on a combination of preceding and newly agreed-upon secrets. The ratchets work in a single direction, the sending and receiving of future messages. Even if an adversary compromises a newly created secret, messages encrypted using older secrets can't be decrypted... [Signal developers describe a "ping-pong" behavior as parties take turns replacing ratchet key pairs one at a time.] Even though the ping-ponging keys are vulnerable to future quantum attacks, they are broadly believed to be secure against today's attacks from classical computers.

The Signal Protocol developers didn't want to remove them or the battle-tested code that produces them. That led to their decision to add quantum resistance by adding a third ratchet. This one uses a quantum-safe Key-Encapsulation Mechanism (KEM) to produce new secrets much like the Diffie-Hellman ratchet did before, ensuring quantum-safe, post-compromise security... The technical challenges were anything but easy. Elliptic curve keys generated in the X25519 implementation are about 32 bytes long, small enough to be added to each message without creating a burden on already constrained bandwidths or computing resources. A ML-KEM 768 key, by contrast, is 1,000 bytes. Additionally, Signal's design requires sending both an encryption key and a ciphertext, making the total size 2,272 bytes... To manage the asynchrony challenges, the developers turned to "erasure codes," a method of breaking up larger data into smaller pieces such that the original can be reconstructed using any sufficiently sized subset of chunks...

The Signal engineers have given this third ratchet the formal name: Sparse Post Quantum Ratchet, or SPQR for short. The third ratchet was designed in collaboration with PQShield, AIST, and New York University. The developers presented the erasure-code-based chunking and the high-level Triple Ratchet design at the Eurocrypt 2025 conference. Outside researchers are applauding the work. "If the normal encrypted messages we use are cats, then post-quantum ciphertexts are elephants," Matt Green, a cryptography expert at Johns Hopkins University, wrote in an interview. "So the problem here is to sneak an elephant through a tunnel designed for cats. And that's an amazing engineering achievement. But it also makes me wish we didn't have to deal with elephants."

Citiraj:

Microsoft said in a blog post this week that "over half of cyberattacks with known motives were driven by extortion or ransomware... while attacks focused solely on espionage made up just 4%."

And Microsoft's annual digital threats report found operations expanding even more through AI, with cybercriminals "accelerating malware development and creating more realistic synthetic content, enhancing the efficiency of activities such as phishing and ransomware attacks." [L]egacy security measures are no longer enough; we need modern defenses leveraging AI and strong collaboration across industries and governments to keep pace with the threat...

Over the past year, both attackers and defenders harnessed the power of generative AI. Threat actors are using AI to boost their attacks by automating phishing, scaling social engineering, creating synthetic media, finding vulnerabilities faster, and creating malware that can adapt itself... For defenders, AI is also proving to be a valuable tool. Microsoft, for example, uses AI to spot threats, close detection gaps, catch phishing attempts, and protect vulnerable users. As both the risks and opportunities of AI rapidly evolve, organizations must prioritize securing their AI tools and training their teams...

Amid the growing sophistication of cyber threats, one statistic stands out: more than 97% of identity attacks are password attacks. In the first half of 2025 alone, identity-based attacks surged by 32%. That means the vast majority of malicious sign-in attempts an organization might receive are via large-scale password guessing attempts. Attackers get usernames and passwords ("credentials") for these bulk attacks largely from credential leaks. However, credential leaks aren't the only place where attackers can obtain credentials. This year, we saw a surge in the use of infostealer malware by cybercriminals...

Luckily, the solution to identity compromise is simple. The implementation of phishing-resistant multifactor authentication (MFA) can stop over 99% of this type of attack even if the attacker has the correct username and password combination.
"Security is not only a technical challenge but a governance imperative..." Microsoft adds in their blog post. "Governments must build frameworks that signal credible and proportionate consequences for malicious activity that violates international rules." (The report also found that America is the #1 most-targeted country — and that many U.S. companies have outdated cyber defenses.)

But while "most of the immediate attacks organizations face today come from opportunistic criminals looking to make a profit," Microsoft writes that nation-state threats "remain a serious and persistent threat." More details from the Associated Press: Russia, China, Iran and North Korea have sharply increased their use of artificial intelligence to deceive people online and mount cyberattacks against the United States, according to new research from Microsoft. This July, the company identified more than 200 instances of foreign adversaries using AI to create fake content online, more than double the number from July 2024 and more than ten times the number seen in 2023.
Examples of foreign espionage cited by the article:

China is continuing its broad push across industries to conduct espionage and steal sensitive data...

Iran is going after a wider range of targets than ever before, from the Middle East to North America, as part of broadening espionage operations..

"[O]utside of Ukraine, the top ten countries most affected by Russian cyber activity all belong to the North Atlantic Treaty Organization (NATO) — a 25% increase compared to last year."

North Korea remains focused on revenue generation and espionage...

There was one especially worrying finding. The report found that critical public services are often targeted, partly because their tight budgets limit their incident response capabilities, "often resulting in outdated software.... Ransomware actors in particular focus on these critical sectors because of the targets' limited options. For example, a hospital must quickly resolve its encrypted systems, or patients could die, potentially leaving no other recourse but to pay."

Jel vam krepo signal app jutros?

AWS se skršil i povukel dosta toga, uključujući i Signal.

Meanwhile, Telegram radi na Vodki i pegla i dalje :D

Jasno, kad ga Pavel doma kod sebe hosta, skupa s backup arhivom svih "privatnih" razgovora.:)

:lol2::lol2::lol2::goood:

koliko će ovo još stranica trajati? :D

Citiraj:

Autor Ivo_Strojnica (Post 3826548)

koliko će ovo još stranica trajati? :D

Hvali Boga da su PCE registracije disejblane pa pacijenti s bug foruma mogu samo gledati i sliniti :)

Citiraj:

Autor Ivo_Strojnica (Post 3826548)

koliko će ovo još stranica trajati? :D

A moramo se malo našalit, ne budi ljubomoran 😁

EDIT:
https://x.com/elonmusk/status/1980206753209082334

Između Pavela i Elona, ne znaš koji više laže dok zine, a obojica se s milijardama na računima "bore za sigurnost i privatnost malog čovjeka", dok istovremeno hostaju platforme za širenje propagande i teorija zavjere.:) Čudno kak nitko od njih u svim onim intervjuima ne spomene uistinu škakljive teme, poput presađivanje kose i estetskih zahvata, ali to im je valjda tabu tema. Lakše je širiti PR bajke kako su sve sami postigli i od malena programiraju čuda tehnike, tako da nam svima bude bolje kad odletimo na Mars i prek Telegrama šaljemo srčeka.

https://i.postimg.cc/KcNvS8Pb/image.jpg

Ako se dobro sjećam, i Elon i Snowden su promovirali Signal kad je tek počeo, a ne znam šta je to škakljivo oko presađivanja kose...
To danas dosta ljudi radi u Turskoj koliko znam.

Nije škakljivo koliko je sarkazam s moje strane, jer likovi nisu u stanju sami sebe pogledati u zrcalo, a tu dijele pametne po intervjuima i to kaj oni nešto promoviraju ne znači ama baš ništa, jer uredno mijenjaju kaput ovisno o tome kaj im je u tom trenu bilo u interesu. Signal je danas zajedno s nekoliko stotina aplikacija po našem vremenu od 03:00h do 05:00h, zbog skršenog AWS-a bil nedostupan i evo odma Elona s argumentom da im više ne vjeruje, jer njegova riječ i mišljenje su jako bitni, pa ajmo brže bolje sve podrediti njemu i takvima. Kaj se Elon kao "zagovornik ljudskih prava i slobode govora" ne izjasni zakaj mu Twitter/X ne radi kad ide u Kinu moliti pare i radnu snagu za Tesline autiće na struju, dok se potajno nada kak mu ovi neće jednim potezom sjebati sve firme, jer mu ionako proizvode to kaj on prezetira kao svoje.:)

Citiraj:

Autor kopija (Post 3826553)

Hvali Boga da su PCE registracije disejblane pa pacijenti s bug foruma mogu samo gledati i sliniti :)

I bolje, ono tamo na bugu nije normalno.

Sto se tice AWS-a zanimljiv podatak kao i kod Microsofta.

https://fxtwitter.com/elonmusk/statu...21072512635117

Sent from my SM-S931B using Tapatalk

Citiraj:

Autor Bono (Post 3826610)

I bolje, ono tamo na bugu nije normalno.

Ideja im je bila i ovaj forum preuzeti na sličan način, ali nisu računali da netko ipak prati sve profile koje su godinama kreirali i čuvali za takve potrebe.

Makar i sam časopis se godinama srozaval kvalitetom, a službena stranica je postala više nalik zadovoljna.hr, nego nekaj povezano sa svijetom tehnike i tehnologije.

Citiraj:

Autor Bono (Post 3826610)

Sto se tice AWS-a zanimljiv podatak kao i kod Microsofta.

https://fxtwitter.com/elonmusk/statu...21072512635117

Sent from my SM-S931B using Tapatalk

Zasto me ne cudi....

Citiraj:

AI chatbot Grok is now being led by Diego Pasini, a college student who graduated from high school in 2023 — and who’s been at the company for less than a year. His promotion comes right off the back of a brutal round of layoffs at the team which saw more than 500 staffers, including high-level employees, get the axe. Elon Musk’s AI company, xAI, is blaming its multibillion-dollar chatbot’s inexplicable meltdown into rants about “white genocide” on an “unauthorized modification” to Grok’s code.

https://i.postimg.cc/yNCSJ9qg/xAI.png

To je to, jebe lud zbunjenog s tim AI pizdarijama.:):D

Citiraj:

Autor tomek@vz (Post 3826499)

Ovo je baš zanimljivo. Šteta što sam totalni idiot za enkripciju.

Citiraj:

Autor The Exiled (Post 3826612)

Ideja im je bila i ovaj forum preuzeti na sličan način, ali nisu računali da netko ipak prati sve profile koje su godinama kreirali i čuvali za takve potrebe.

Another day, another conspiracy theory.

Nije baš, kad su o tome pričali na svojem super tajnom BUG Discord kanalu i onda kroz popularne Intel, AMD, GeForce i Radeon teme probali izvesti, ali hey, you do you.:):D

O čemu su pričali? Kako uopće izgleda "preuzimanje foruma" i čemu to?
Odakle uopće mržnja prema ovom forumu i zašto?

Riječ je o skupini koja je popušila ban na svemu gdje su mogli iz svih mogućih razloga, a onda kad ni to nije bilo dosta, ideja je bila koristeći odavno kreirane profile, pridobiti povjerenje ostalih forumaša, pa nakon toga krenuti s pranjem mozga kakvo je danas aktualno na BUG forumu, a rasprave su im u rangu ravnozemljaških alternativnih činjenica. Otvori bilo koju temu na Intel, AMD, Radeon ili GeForce podforumu unatrag pet godina i samo gledaj tko sve ima banned etiketu i to je to, jer materijala ne nedostaje.:)