Privatnost i sigurnost podataka i korisnika

[Neo-ST]

Autor Ivo_Strojnica

ajd kupi si stari mobitel. :D

Pa sad imam stari mobitel, S23 Ultra. To je po današnjim standardima staro. Nego šta sam s time onda dobio, opet sam podložan hackiranju 😅

[Ivo_Strojnica]

nisi.
Uzmeš stari mobitel, neki tanki, tipa pixel 6a, instaliraš na njega authentificator i to je to.
Taj mobitel nije nikad na netu niti može biti (osim ako nisi dovoljno inteligentan pa ga spojiš malo na wifi da vidiš jel na njemu još uvik dobro radi browser).

Eto ga, riješen problem.

[Neo-ST]

Autor Ivo_Strojnica

tanki

Najbitniji detalj...


Nego malo mi se čini overkill uzimat mobitel samo za 2fa? I onda ga stalno palit-gasit samo kad mi treba pristup nekom siteu...
Da nema neki hardware key koji može skenirat QR codove?

[xlr]

Autor Neo-ST

Da nema neki hardware key koji može skenirat QR codove?

Mogu i hw kljucevi imati TOTP, ali ti onda treba companion app. Primjer:
https://www.token2.com/shop/product/...pin-complexity

Companion app:
https://www.token2.com/site/page/tok...app-user-guide

Ne znam imaju li Yubico i ostali bolje/lakse rjesen ovaj korak citanja TOTP-a iz kljuca. Ali vjerojatno je i ovaj scenario podlozan prijeopisanom napadu

[Ivo_Strojnica]

Autor Neo-ST

Najbitniji detalj...


Nego malo mi se čini overkill uzimat mobitel samo za 2fa? I onda ga stalno palit-gasit samo kad mi treba pristup nekom siteu...
Da nema neki hardware key koji može skenirat QR codove?

Istina, katastrofa. Radije kupi neki specificirani uređaj koji radi na način koji ti nije intuitivan i vrlo vjerojatno je skuplji.

Čisto da se osjećaš kul.

Čemu jednostavno, jel tako?

[tomek@vz]

Autor Neo-ST

Najbitniji detalj...


Nego malo mi se čini overkill uzimat mobitel samo za 2fa? I onda ga stalno palit-gasit samo kad mi treba pristup nekom siteu...
Da nema neki hardware key koji može skenirat QR codove?

Ideja iza zasebnog moba samo za TOTP je dedicirani uredaj koji koristis samo za to. Dakle ne mora biti biti onlajn, striktno instaliras TOTP aplikaciju i izbacis sve ostalo, kompletni lockdown tako da su gore opisani vektori napada - nemoguci. Night-ovo rijesenje je bolje jer je dovoljno jeftino iskreno i dovoljno glupo (bez ikakavih smart/phone home funkcija).

[xlr]

E sad, koliko je jeftino, ne znam... Kazu da baterija traje 4-5 godina ako svaki dan 10 puta citas TOTP i jednom mjesecno upisujes seed preko NFC-a. Bummer je sto kad ode baterija, moras uzeti novi uredjaj i prebaciti seedove

"Will I lose access to the TOTP profiles when the battery is dead?
A. Yes, but you will have enough time to prepare. Molto-1 will have a battery indicator on the display. You should replace your token (and migrate the TOTP tokens by resetting the second factor on each respective service) when the indicator shows the battery level as "empty" - you will still have a couple of months to do this."

Ako zbilja traje po 5 godina, ajde de.

Ali ako stalno pored sebe imas neki stari fon koji samo sjedi u ladici i realno ti ne predstavlja trosak jer si ga vec amortizirao lol, alternativa s Aegisom i prebacivanjem seedova je skroz na mjestu.

[Ivo_Strojnica]

ili još bolje, napraviš da ti se ne može otvoriti authentifikator bez da upišeš password/biometriju.
Aegis authentificator, naprimjer.
Čim ga minimiziraš, nema pomoći.

[Neo-ST]

Našao sam idealan uređaj: https://www.reiner-sct.com/en/produkt/tanjack-deluxe/

[Night]

Autor Neo-ST

Ovo mi izgleda iznimno nepraktično.
Npr. u trenutnom 2fa appu u mobitelu imam 30+ 2fa pinova za razne siteove.
Kad mi treba 2fa za neki site, moram u search početi upisivati ime tog sitea da mi izbaci 2fa za njega.
Ovaj uređaj može spremiti samo 10 accountova? To je prvi problem.

Imaš drugi model na koji ide 100 accounta, baterija od sata ima 8g trajanje, a ova glavna se puni preko USBa i ima par mjeseci trajanja :

https://www.token2.eu/shop/product/m...hardware-token

Ako treba i QR onda što ekipa tu već napisa, stariji mobitel, instalirati sve što treba i pogasiti mu mrežu.

Autor Neo-ST

Našao sam idealan uređaj: https://www.reiner-sct.com/en/produkt/tanjack-deluxe/

Ovo izgleda cool. Samo što kad umjesto cijene piše "Business customer request" čini mi se da bi moglo biti iznenađenja

[Bono]

Microsoft is adding AI powered facial recognition to OneDrive.

And it can be disabled, but get this:

“You can only turn off this setting 3 times a year.”

https://fxtwitter.com/LundukeJournal...29065421750316

Sent from my SM-S931B using Tapatalk

[Libertus]

Majko mila...

[kopija]

Pa zamisli kolko resursa je potrebno da bi se obradilo npr 15GB slika.
I onda ti to iz fore uključiš pa isključiš, sve ode u vjetar.
Normalno da hoće ljude demotivirat da drkaju po tom switchu.


This guy gets it:

It probably has to run a pretty heavy workload each time it goes through your gallery so they probably mean you can't just turn it off and on and off and on forever. But that doesn't get as many clicks

[Neo-ST]

Autor Night

Ovo izgleda cool. Samo što kad umjesto cijene piše "Business customer request" čini mi se da bi moglo biti iznenađenja

Moraš otvoriti stranicu na desktopu pa ti se otvori opcija da dodaš u cart i možeš naručiti kao fizička osoba. Ovaj "Business customer request" je samo ako želiš naručiti kao biznis.
Ne znam zašto na mobilnoj stranici nema "add to cart" botuna.

Također imaju i jeftiniji model sa kamerom, koji doduše nema search opciju (ako ti je potrebna kad npr. imaš puno 2fa accountova).

[tomek@vz]

Roughly 200,000 Linux-based Framework laptops shipped with a signed UEFI shell command (mm) that can be abused to bypass Secure Boot protections -- allowing attackers to load persistent bootkits like BlackLotus or HybridPetya. Framework has begun patching affected models, though some fixes and DBX updates are still pending. BleepingComputer reports: According to firmware security company Eclypsium, the problem stems from including a 'memory modify' (mm) command in legitimately signed UEFI shells that Framework shipped with its systems. The command provides direct read/write access to system memory and is intended for low-level diagnostics and firmware debugging. However, it can also be leveraged to break the Secure Boot trust chain by targeting the gSecurity2 variable, a critical component in the process of verifying the signatures of UEFI modules.

The mm command can be abused to overwrite gSecurity2 with NULL, effectively disabling signature verification. "This command writes zeros to the memory location containing the security handler pointer, effectively disabling signature verification for all subsequent module loads." The researchers also note that the attack can be automated via startup scripts to persist across reboots.

---

Bruce Schneier and Barath Raghavan say agentic AI is already broken at the core. In their IEEE Security & Privacy essay, they argue that AI agents run on untrusted data, use unverified tools, and make decisions in hostile environments. Every part of the OODA loop (observe, orient, decide, act) is open to attack. Prompt injection, data poisoning, and tool misuse corrupt the system from the inside. The model's strength, treating all input as equal, also makes it exploitable. They call this the AI security trilemma: fast, smart, or secure. Pick two. Integrity isn't a feature you bolt on later. It has to be built in from the start. "Computer security has evolved over the decades," the authors wrote. "We addressed availability despite failures through replication and decentralization. We addressed confidentiality despite breaches using authenticated encryption. Now we need to address integrity despite corruption."

"Trustworthy AI agents require integrity because we can't build reliable systems on unreliable foundations. The question isn't whether we can add integrity to AI but whether the architecture permits integrity at all."

[Bono]

Autor kopija

Pa zamisli kolko resursa je potrebno da bi se obradilo npr 15GB slika.
I onda ti to iz fore uključiš pa isključiš, sve ode u vjetar.
Normalno da hoće ljude demotivirat da drkaju po tom switchu.


This guy gets it:

Jadni ne mogu limitirati resurse, imas pravo 3 puta ugasiti, a oni ce ti 4x godisnje resetirati postavke. Tipicna indijska posla...

Sent from my SM-S931B using Tapatalk

[Neo-ST]

Mislim da bi ovo moglo spadati pod ovu temu ali nisam 100%, pa premjestite ako nije:

GrapheneOS is finally ready to break free from Pixels, and it may never look back

[kopija]

Roughly 200,000 Linux-based Framework laptops shipped with a signed UEFI shell command (mm) that can be abused to bypass Secure Boot protections -- allowing attackers to load persistent bootkits like BlackLotus or HybridPetya.

Vidi vraga, ja mislio da je SecureBoot nekakva urota zlog Microsofta protivu linuxaša, kad ono ispada da je u biti security feature.
Ko što je Tin rekao "krhko je znanje, možda je pao trag istine u me, a možda su sanje".

[tomek@vz]

Autor kopija

Vidi vraga, ja mislio da je SecureBoot nekakva urota zlog Microsofta protivu linuxaša, kad ono ispada da je u biti security feature.
Ko što je Tin rekao "krhko je znanje, možda je pao trag istine u me, a možda su sanje".

Moze li malo vise cinjenica bez sarkazma? Grazie


I da - that sucks:

Roughly 200,000 Linux-based Framework laptops shipped with a signed UEFI shell command (mm) that can be abused to bypass Secure Boot protections -- allowing attackers to load persistent bootkits like BlackLotus or HybridPetya. Framework has begun patching affected models, though some fixes and DBX updates are still pending. BleepingComputer reports: According to firmware security company Eclypsium, the problem stems from including a 'memory modify' (mm) command in legitimately signed UEFI shells that Framework shipped with its systems. The command provides direct read/write access to system memory and is intended for low-level diagnostics and firmware debugging. However, it can also be leveraged to break the Secure Boot trust chain by targeting the gSecurity2 variable, a critical component in the process of verifying the signatures of UEFI modules.

The mm command can be abused to overwrite gSecurity2 with NULL, effectively disabling signature verification. "This command writes zeros to the memory location containing the security handler pointer, effectively disabling signature verification for all subsequent module loads." The researchers also note that the attack can be automated via startup scripts to persist across reboots.

Dakle - vise je Framework problem nego Linux problem. Mozes imati najsigurniji sigurnosni koncept na svijetu ali ako je lose implementiran imas doslovce ovakvo sranje.