Adam Shostack :donor: :rebelverified: / is on Nostr

Author, game designer, technologist, teacher.

Helped to create the CVE and many other things. Fixed autorun for XP. On Blackhat Review board.

Books include Threats: What Every Engineer Should Learn from Star Wars (2023), Threat Modeling: Designing for Security, and The New School of Information Security.

Following back if you have content.

Last Notes

2024-12-28 00:29:28

I could design a worse dialog, if I tried very, very hard.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/727/618/937/233/756/original/64956e9af56bfa17.png

2024-12-12 19:15:38

- reply

@npub1cch…f8nu If I understand it, the failure here isn't the 6 digit code, it's that microsoft failed to implement rate limits, backoff, or any sort of coordination between the authN instances?
(Which will be a great point to emphasize — I want to make sure I understand.)

2024-12-12 19:00:30

Is there any meaningful security benefit to one time codes being more than 4-6 digits?
(For any of TOTP, email, or sms delivery.)

2024-11-10 21:02:11

- reply

@npub1cch…f8nu Thats a good point, thank you, and really, I'd like to be able to say "That's a bad idea." :)
Even if an attacker removes it, having a history of "Don't run this code" or "don't run any code from the repo" is a thing that supply chain security tooling could note and/or flag.

2024-11-10 20:17:06

Now that github is mandating that I add 2FA to "secure the supply chain", is there a standard way to say "I am not part of your supply chain"?
Seriously, the code I write is barely fit for purpose. I use github to make available things like Elevation of Privilege, have a place where the Four Question Framework for threat modeling can evolve in a constrained way, and to report bugs.
I've also posted some code that Claude wrote, with an explicit security warning.
(https://gist.github.com/adamshostack/ca17e69e3145f11d20c871a4a186be51)
No one should use any of that code.

2024-10-25 18:51:28

For training delivery, I have a separate account on my mac to help isolate what's available and reduce the chances for a mistake. The new "Must be signed in" 1Password either breaks the isolation (exposes all my passwords in the desktop boundary) or requires me to pay for extra users. Bitwarden requires me to get the app via the Mac app store, which means the app is associated with an apple account, again, reducing isolation.
What's the best standalone password manager that includes firefox integration?