cjcampbell

5 ms·

1.
by cjcampbell 3mo ago
I’ve also run into various capacity issues in each US region I have worked in. East US 2 has been least constrained for me, but I recall that I was still bouncing around between VM instance types to find one that worked last time I deployed
2.
by cjcampbell 1y ago
I do the same.
3.
by cjcampbell 1y ago
Definitely interested to kick the tires and compare to some of the other solutions out there. As others mentioned, you lose some benefits of an OIDC-integrated SSH CA, but that’s a reasonable trade off in order to reduce complexity for many
4.
by cjcampbell 1y ago
I’ve played a bit with this, but iirc, I ran into limitations with some of the clients that needed to be supported. But if all you need is OpenSSH, you should be set.
5.
by cjcampbell 1y ago
One devious thing about this attack is that the phishing site doesn’t even need to impersonate the site it’s attacking. I have password based logins on hundreds of sites and it’s plausible that I’ll eventually have passkeys on enough sites
6.
by cjcampbell 1y ago
You don’t necessarily have to disable anything, but choose not to use the secondary device authentication flow. Let’s say that you rely on the passkey implementation in your password manager and have that installed directly on your laptop.
7.
by cjcampbell 1y ago
Maybe “phishing passkey protected sessions …” or “phishing passkey protected accounts”. I also echo some of the other critiques, which are that passkeys are advertised as phishing resistant and not phishing proof. I do understand that the a
8.
by cjcampbell 2y ago
Don’t know where I first discovered it, but I have been using ipkitten for years when working with non-tech friends, family, and clients. It seems to help with the intimidation filter of getting into the weeds, so thank you! I didn’t realiz
9.
by cjcampbell 2y ago
The posture implementation is quite easy to work with. There’s a growing list of integrations, and you can also roll your own with the posture API. I’ve used Kolide so far and will be integrating with Kandji on another tailnet. They also ha
10.
by cjcampbell 2y ago
I have significantly more experience in AWS, but I've spent equal time building and securing infrastructure in Azure for at least two years now. While AWS is not without it's rough edges, I'd pick it any day. My number one co
11.
by cjcampbell 2y ago
The flag button sits right in the zone I swipe with my right thumb on mobile. Occasionally I notice and go unflag something. Clicking through this, I found several pages of posts I’ve flagged. I’d guess I’ve done no more than five posts int
12.
by cjcampbell 2y ago
I’m surprised that the author chose to configure a public OIDC client for this scenario. Part of the benefit of this pattern is that it’s possible to use a confidential client, since the BFF can securely hold the client secret.
13.
by cjcampbell 2y ago
They all support OIDC, though in my experience, it’s moderately more clunky to deploy unless a “blessed” integration exists in the app store/directory. Okta provides the best experience of the three. Google Workspace admins have to dro
14.
by cjcampbell 2y ago
I love to see OIDC gaining traction, though I will say that for setting up any sort of custom workforce federation, the administrative experience for OIDC applications often feels like an afterthought. I haven’t looked at all implementation
15.
by cjcampbell 2y ago
Apple deprecated kernel extensions with 10.15 in order to improve reliability and eventually added a requirement that end users must disable SIP in order to install kexts. Security vendors moved to leverage the endpoint security framework a
16.
by cjcampbell 2y ago
I work with a variety of small companies (5-25 FTEs) that are increasingly facing strict MFA requirements in order to maintain insurance. SSO isn’t an explicit requirement, but there are a myriad of general access requirements that they str
17.
by cjcampbell 3y ago
Windows 10 had the same behavior. MacOS has also done this by default for years now. I don’t say this to excuse the behavior. On the contrary, I’ve seen many a small business owner run afoul of compliance requirements because they aren’t aw
18.
by cjcampbell 3y ago
Was that point meant to be reversed … favors the irrelevant over the unknown?
19.
by cjcampbell 3y ago
I probably could have framed this more clearly. I don’t think my point really supports the lock-in argument. Google has been a big proponent of FIDO, having been an early adopter of U2F in Chrome and leveraging it for advanced protection. M
20.
by cjcampbell 3y ago
I'm surprised that they're moving forward with this already. As of last week, there were still enough rough edges on their implementation that I disabled it for my Workspace tenants. The two most irritating: 1. Advanced protection
21.
by cjcampbell 3y ago
True if they are referring to the MagSafe cable. If referring to USB C to C, they’re mistaken. The charging cable for all MacBooks does support USB 2 data rates.
22.
Auditd: The (macOS) logs we need, not the logs we deserve(boberito.medium.com)
2 points by cjcampbell 3y ago|0 comments
23.
by cjcampbell 3y ago
In my experience, a large percentage of compliance officers believe that this is a non-negotiable requirement for HIPAA compliant web apps. My reading of the Security Rule is much more pragmatic, so I would argue that there are other ways t
24.
by cjcampbell 3y ago
Depends on the password manager. 1Password will not autofill if the domain doesn’t match. It’s up to the user at that point to check the url before copy/pasting the code. My guess is that the average user would do that by reflex withou
25.
by cjcampbell 3y ago
The focus of the presentation is on using the forwarder to poison the recursive cache, but my take from a quick skim of the presentation is that plenty of damage could still be done just by abusing the improper bailiwick checks on a non-con
26.
by cjcampbell 3y ago
It’s not my preferred method because I want 2FA to save me if my device is compromised, but it does still add protection against traditional password attacks, credential stuffing, etc. It even adds a layer of phishing resistance, as long as
27.
by cjcampbell 3y ago
And on up-to-date versions, OpenSSH client and tools are available from powershell or cmd.
28.
Pioneering hacker Kevin Mitnick dead at 59(apnews.com)
3 points by cjcampbell 3y ago|0 comments
29.
by cjcampbell 3y ago
I’d expect most firewalls to allow DNS traffic to locally configured resolvers without prompts, and I figure this is also extended to mDNS traffic, which doesn’t leave your local LAN by default. From the mDNS side of things, you could easil
30.
by cjcampbell 3y ago
Just wanted to say I appreciate seeing the responsiveness here. First comment on the thread even. Always better if it doesn’t reach this point, but it’s nice to know you can get a human’s attention one way or another. Hoping to @edwinwee wi

More ›