Independent investigative journalist. Covers cybercrime, security, privacy. Author of 'Spam Nation,' a NYT bestseller. Former Washington Post reporter, '95-'09. Twitter: @briankrebs Linkedin: https://www.linkedin.com/in/bkrebs/
Anyone know if Signal publishes the SHA-1 (or some hash) of its desktop versions? I don't like installing critical apps like this without verifying their integrity.
I know I'm showing my age in a Man Shakes Fist at Cloud way, but it wasn't so long ago that software makers actually published this information on their downloads page.
This is fitting. The top topic on Xitter right now is of course the global Crowdstrike/Windows clusterfuck. But the AI summary of the discussion is hilarious, b/c it summarizes a bunch of sarcastic posts and makes it sound like a positive (or at least can-do) story.
TIL you can quickly find your own posts by including "from:me" in the search box and then a key word or phrase you're searching for. Yes, it took me this long to figure that out.
@briankrebs In the default Masto web app (which I don't normally use) if you start typing in the search box, it pops up lots of helpful hints about useful things search can do.
It's always amazed me that ID.me, which you have to use in order to interact w/ the IRS online these days, has a top level domain from the country of Montenegro. Ublock Origin says they're injecting tracking links from Italy's TLD when you login at the irs.gov website.
What's next? Cookies from Colombia? AI from Anguilla?
@briankrebs I propose a law that bars third party data brokers from any site or interaction which directly or indirectly requires government ID per law. KYC and tax are two examples. Any related data should be tainted as "fruit of the ID Tree" and restricted from outside the authority collecting it.
Google is too big to fail, and yet they seem to be failing at basic things they used to do well (like search) while removing useful features (like cache) and adding a bunch of crap nobody needs or wants.
Want to know if a given domain name shows up anywhere in search? Well screw you, we're not going to tell you that anymore, but here's 1,400 completely useless and irrelevant results that could possibly have some info (but don't). When the search engine could have done what it's done for years, and admit that it doesn't know WTF you're talking about and say "no results found." Now it just makes shit up if it doesn't know the answer.
Hey cool! My search result shows the term I was looking for is present on 7 websites. Shoot! None of them are online anymore. How about showing us your cached version of the site, you know the one that was used to create this search result? Oh wait, no, you can't see that anymore. Why? Here's Danny Sullivan's dismissive and mystifying explanation: "“It was meant for helping people access pages when way back, you often couldn’t depend on a page loading,” Sullivan wrote on X. “These days, things have greatly improved. So, it was decided to retire it.”
Want software? Great, Google will serve a malicious ad on top that looks a lot like an organic search result but which is paid for by scammers and installs malware.
Google is too big to fail, and yet they seem to be failing at basic things they used to do well (like search) while removing useful features (like cache) and adding a bunch of crap nobody needs or wants.
Want to know if a given domain name shows up anywhere in search? Well screw you, we're not going to tell you that anymore, but here's 1,400 completely useless and irrelevant results that could possibly have some info (but don't). When the search engine could have done what it's done for years, and...
Didn't realize my wireless plan capped tethering speeds, but now it makes sense. When your phone gets ~10-15 mbps and your tethered computer gets .5 or .6 consistently, you know they're screwing w/ the service you paid for.
Welp, I'm ashamed it took me this long to realize, but changing the TTL on my computer seems to have released the throttling.
@briankrebs Hak5 did a whole segment on this back in the day. I want to say they showed up to configure the phone to change the ttl to 64 but it's been ages since I watched the episode.
@briankrebs I have 350 Mbit/s but as a hotspot I only get 20-40 Mbit/s out of it. Also there is no option at all to get a wired wifi here. So it is sadly the only option.
@briankrebs do you know where such things are done by providers? I've never heard of such here in germany and never had bandwidth issues on tethered devices.
One of the more limiting things about Signal is you have to give out your mobile number to everyone. Even if it is a burner, I still don't want to advertise to the world that it's mine.
Was happy to read today that Signal is now beta testing a new username feature.
Today marks one year since I walked away from 360,000 followers on that other site and joined this incredible community here!
That was easily one of the most positive moves I've ever made, and I frankly haven't looked back. Thank you to @jerry and everyone else who keeps this place humming. Come to think of it, it's time to renew our annual support!
@briankrebs@jerry I don't miss the constant arguing, insulting and gaslightning.
I also don't miss Mrs. Smith, Hair stylist talking about how Covid vaccines spread turbo-cancer, because Mr. Braindead, her Sisters cousins colleague from work at McDonald's said so.
I don't have any remorse emptying the old account and leave it there to rot.
And I bet, you still have those followers. Just not all of them have a mastodon account. Which you don't need since Mastodon isn't blocking content and ask you to please create an account.
@briankrebs@jerry I don't miss the constant arguing, insulting and gaslightning.
I also don't miss Mrs. Smith, Hair stylist talking about how Covid vaccines spread turbo-cancer, because Mr. Braindead, her Sisters cousins colleague from work at McDonald's said so.
I don't have any remorse emptying the old account and leave it there to rot.
There's an important vulnerability being disclosed today that allows attackers to massively increase the size of DDoS attacks.
The flaw is being tracked as CVE-2023-44487, a.k.a. "HTTP/2 Rapid Reset Attack." According to Damian Menscher at Google, the attack "works by sending a request and then immediately cancelling it (a feature of HTTP/2). This lets attackers skip waiting for responses, resulting in a more efficient attack."
There's an important vulnerability being disclosed today that allows attackers to massively increase the size of DDoS attacks.
The flaw is being tracked as CVE-2023-44487, a.k.a. "HTTP/2 Rapid Reset Attack." According to Damian Menscher at Google, the attack "works by sending a request and then immediately cancelling it (a feature of HTTP/2). This lets attackers skip waiting for responses, resulting in a more efficient attack."
I'm confused by the HTTP 1.1 diagram. What about request pipelining? Or do common web servers work such that the client is required to receive the response to their first request before the second one will be processed?
404 Media found that when you write about LSD, MDMA, guns, and stolen credit cards for sale on Instagram, IG flags you for not following their recommended guidelines -- i.e. for calling attention to stuff that is blatantly in violation of their own policies but that is nevertheless inexplicably left alone.
Hey, this bury your head in the sand approach has worked for Meta/FB for years. Why stop now?
404 Media found that when you write about LSD, MDMA, guns, and stolen credit cards for sale on Instagram, IG flags you for not following their recommended guidelines -- i.e. for calling attention to stuff that is blatantly in violation of their own policies but that is nevertheless inexplicably left alone.
@briankrebs They are concerned about their profits. The most efficient solution to prevent damage to their profits is to stop people from noticing there’s a problem, rather than attempting to fix the problem.
I recently profiled a person involved in a series of particularly aggressive spam campaigns advertising crypto scams that involved so many fake new accounts that it briefly disrupted registration on some Mastodon communities.
Trend Micro has a new report out which states that the person I profiled was an affiliate of the "Impulse Team," a Russian-language moneymaking scheme that pays people to promote fake crypto investment platforms. Impulse Team has been operating since at least Sept. 2021.
I recently profiled a person involved in a series of particularly aggressive spam campaigns advertising crypto scams that involved so many fake new accounts that it briefly disrupted registration on some Mastodon communities.
@briankrebs Did you go to the website and look at the page? Because it has GPG signatures there
@briankrebs open source projects typically do this for their downloads. Makes one wonder why everyone doesn't.
@briankrebs
I recall webpages with more than one hash tied to the download file. Even PGP Signatures.
Apparently, web site maintenance is too expensive.