Category: Computer Security

Posted on
by

Interesting point at The Intercept: Don’t trust cropping tools for security.

If you crop an image for security reasons, make sure you know whether the tool you’re using crops the data (like most image editors) or just the displayed image (like embedding an image into a PDF/Word doc/etc.) If it’s only cropping the display, people can still get at the full image!

Also, make sure the EXIF doesn’t include a thumbnail of the original!

My advice: if opsec is an issue,

  1. Use an actual image editor.
  2. Save the file without any metadata.

(via Schneier on Security)

Update: Interesting that this article came out just before news of some actually broken tools for Android and Windows that do save over the data…but don’t properly truncate the file, so if the interesting bits happen to have been in the extra space left over, they can still be recovered!

Posted on
by

I made a huge mistake in my article on how to post to Mastodon through IFTTT.

I gave the wrong directions on what to put in the Application Website field in Mastodon. It just needs to be https://ifttt.com. It isn’t used for identifying the source to your Mastodon server as I thought it was, but appears as a link when the post is viewed by itself on the web. If you followed on my mistake, I highly recommend (1) removing the URL from your Mastodon config and just putting in ifttt.com and (2) going into your Webhooks settings at IFTTT and generating a new key. I feel horrible that I messed this up, and I am so sorry to everyone I steered wrong.

Posted on
by

Phishers: Hi, we’re your bank, please click on this attachment for important information.

Security experts: Never click on an unexpected attachment in an email even if you think you know who it’s from. It’s likely to be malware or a scam to steal your login credentials.

Actual banks: Hi, we’re your bank, please click on this attachment for important information. 🤦‍♂️

Seriously, I HATE these systems. The way they keep phishing and malware techniques believable — and have for years! — is worse than any supposed security advantage in not just using email. Half the time the info isn’t any more sensitive than a receipt would be. Or heck, even just “There’s a new message in your account, please log in to see it and use your own bookmarks to get there.” That’s actually more secure!

:sigh:

It’s really too bad all the schemes to add end-to-end security to email over the years have been either too cumbersome to take off for general usage or vendor-specific.

Posted on
by

Purism’s explanations for removing various safety features from Librem One’s social network sound like someone explaining why they removed the mirrors, brakes, horns, seat belts, airbags and signals from the cars they’re reselling, because they know those cars are only ever going to be driven on a track where they’ll never have to change lanes or negotiate with other drivers.

Even though there’s a bunch of driveways on that track, connecting to the public road system.

If a collision does happen, we can call in the tow trucks and ambulances. But giving drivers tools to avoid collisions or reduce injuries? That would be interfering with their freedom!