• 4 Posts
  • 35 Comments
Joined 2 years ago
cake
Cake day: March 2nd, 2023

help-circle














    • You have a malicious actor on your trusted network.
    • If so, you have bigger problems.

    This is more likely than you think. There’s more computers than you realise on the average network. Many aren’t updated and have vulnerabilities. If there’s one malware on one machine on your network, that means a malicious actor is on your network.

    Common exemples :

    • Home WiFi network with old unpached router, Android smartphone, network printer, security camera, thermostat, robot vacuum cleaner, smart lightbulb, smart TV, …
    • Unsecure WiFi network at the cafe, train station, hotel, … where you connect a laptops that is sometimes used for printing and which has CUPS

  • NOYB has the right to send a complaint if it think a company infringe upon right to privacy. Mozilla isn’t entitled to special treatment or special notice before filling a complaint.

    Mozilla should have expected this. They claim to defend users privacy so they should understand why consent for data collection is important. Also there was public outcry and criticism of opt-out, and yet they haven’t backed down.

    If Mozilla resolve these issues, NOYB could ask for the complaint to be dropped. I hope they do resolve this, and do drop the complaint.


  • Knowledge of the account is an obvious caveat. Yubikey-based MFA is an added layer of protection for accounts, so any kind of attack against MFA assumes the attacker already knows which account to target.

    It’s like saying “our door lock is flawed, but the attacker would need to have knowledge of the door”.

    The cost and complexity is what’s noteworthy and is more relevant. Although attack cost and complexity usuallu goes down with advances in tooling and research. So it may be a good idea to plan a progressive retirement of affected keys.