Replying to
@miniBill@mastodon.uno
@miniBill@mastodon.uno @peterwilsoncc@aus.social That leads to an attack called hash-schucking.
Remote
Firstyear
@firstyear@infosec.exchange
Senior LDAP/IDM Tech Debt Collector
@SUSE. Supermarket Thought Leader. Author of Kanidm, concread and webauthn-rs. he/him
804
Followers
222
Following
50
Posts
Joined November 04, 2022
Posts
Replying to
@peterwilsoncc@aus.social
@peterwilsoncc@aus.social The 64 char limit is to prevent a KDF DOS attack during authentication. Bcrypt limits input to 72 bytes for a similar reason.
Replying to
@decryption@aus.social
@decryption@aus.social Its william at firstyear dot id dot au - I sent you some yubikeys a few years back.
Replying to
@decryption@aus.social
@decryption@aus.social Can you email me about it and I'll help you out tomorrow?
Replying to
@hackuador@functional.cafe
@hackuador@functional.cafe The thing is that even if someone else does something unlawful, the car driver should not have been in a position where that happened.
Consider that was a motorbike rider (which I formerly was). If you are in a position where someone does something unlawful and you have to evade and then *hit a bus* you are dead. Literally. Dead.
So ultimately as a motorcyclist I was trained to pre-empt and monitor the road as your life is on the line every second - you must build a safety margin at all times or else. Those skills *have* saved my life multiple times.
In other words this was an avoidable situation - there was no need for a car to torpedo a bus. The driver of that car was in an unsafe position *before* the former performed the unlawful action.
If you are a motorcyclist you would be dead.
If you were on a bicycle, you would be dead.
So why is it that operator of a nearly 1 ton metal machine is given a slap on the wrist for what *could have been* multiple deaths? Why was the other driver given a similarly trivial slap on the wrist for endangering others.
Ultimately my point is that we have a separation in our society where car drivers are given a free pass for highly dangerous actions - we make excuses for the actions that would otherwise be deadly.
Replying to
@firstyear@infosec.exchange
Maybe the bus should have worn high-vis.
Apparently you can just torpedo the side of a bus with your car and walk out with a $700 fine? https://www.abc.net.au/news/2026-07-30/qld-car-lodges-in-bus-rocklea/106974526
Replying to
@jana@social.jsteuernagel.de
@jana@social.jsteuernagel.de If I recall its based on what browser you use. https://github.com/kanidm/webauthn-rs/tree/master/cable-tunnel-server
Replying to
@jana@social.jsteuernagel.de
@jana@social.jsteuernagel.de the scanning of the qr code sets up a cable tunnel which is proxied via google. So whatever you do on the phone is then sent via google to land on the browser.
Replying to
@arichtman@eigenmagic.net
@arichtman@eigenmagic.net Yeah I love to see all the places that Kanidm ends up in, it's quite fun.
Replying to
@jana@social.jsteuernagel.de
@jana@social.jsteuernagel.de Ahh it looks like what happens is that a caBLE tunnel is setup (which btw, still goes via google, sorry to let you know). Then via that caBLE tunnel, your phone can use the yubikey to sign the request since cable is pretty much ctap2-over-noise-tunnel-started-by-bluetooth-qr-magic.
Replying to
@daisy@cloudisland.nz
@daisy@cloudisland.nz @xssfox@cloudisland.nz @daedalus@eigenmagic.net
What you are referring to as Daisy is actually Daisy/Linux
Replying to
@hailey@hails.org
@hailey@hails.org @xssfox@cloudisland.nz Spittin truths here holy shit
Replying to
@xssfox@cloudisland.nz
@xssfox@cloudisland.nz At country scale 6% is *A LOT* of users who missed this alert.
Replying to
@xssfox@cloudisland.nz
@xssfox@cloudisland.nz look the thought has crossed my mind. And if it was going to happen itd be in a password manager ....
Replying to
@firstyear@infosec.exchange
Or in meme form, passkeys be like:
Replying to
@firstyear@infosec.exchange
Or in meme form, passkeys just say:
Replying to
on social.chinwag.org
@mike@social.chinwag.org Yeah fair mate. If you ever want to know more lmk, I'm always happy to help out. But generally a pw + totp in a password manager is pretty good in many cases.
Replying to
on social.chinwag.org
@mike@social.chinwag.org Solid response.
But it is a lot easier to understand as a high-entropy password that is hot-glued into my password manager. But when I use it I can't be phished and a bunch of other attacks just go away.
Generally my advice is engage with passkeys on your terms, not the websites or vendors.
This may come as a shock, but did you know Passkeys are single factor?
Why yes, I am causing problems again today.
https://fy.blackhats.net.au/blog/2026-07-23-passkeys-are-single-factor/
Replying to
@LapTop006@aus.social
@LapTop006@aus.social @devopscats@toot.cat yeah always happy to help out :)
Count Binface is giving me life, and oh how I wish we had someone like this in Australia.
At this point, I feel like it's actively negligent to have openssl or gnutls in your project as a dependency.
Replying to
@ideogram@social.coop
@ideogram@social.coop There is a gardening service called "lawn and order" around too.
Replying to
@xssfox@cloudisland.nz
@xssfox@cloudisland.nz Yeah - facing a similar issue with mirror hosting rn too.
My partner got a new electric toothbrush and it seems the head has a pressure relief valve so that if you "suck" on the head you bring in air instead. Im struggling to find the design and engineering why this is part of the design. Any ideas?
This might be the most unhinged crate I've ever seen https://docs.rs/decrust/latest/decrust/
RE: @acarsdrama@live.acarsdrama.com
Its not commonly known but all 737s have a standard issue furry on board that can be unleashed midflight to resolve technical issues.
Something I setup a few years ago that I have never regretted since is an ArchiveBox instance at home - It's been fantastic as a way to not only bookmark but keep copies of information that I've found useful over time. Also cool because it automatically archives links/references too which can be great for preservation.
Replying to
@firstyear@infosec.exchange
Currently in the problem space I have I think I need to split T into two traits - one for setup and one for the main operations so that during setup the inner type that does impl T can be returned, while still allowing a outer operations of A / B to follow a trait S. That way I can make C that uses A's setup S and returns a B impl T.
Weird rust question: I have a trait T that is implemented by A and B. I want to make a new type C that contains an A (eg C) where C impl T, but without having to redefine every trait method that T has with fn method() { self.a.method() }. Is there a way to "project" an inner types trait to an outer?
In my research my current vibe is "no", so I'm thinking the best option may be to allow C to deref to A, but that breaks dyn.
Replying to
@mike@social.chinwag.org
Replying to
@jpm@aus.social
@jpm@aus.social @mike@social.chinwag.org Not even kidding, recently when I tried out OmniOS it kernel panicked on my system and a dev helped me debug it then and there on the spot. Was an amazing experience, and I haven't seen that level of kindness and patience in a distro/os in a long time.
IMPORTANT! We have released Kanidm v1.9.3 which contains six security fixes, two rated HIGH for remote unauthenticated denial of service. Please upgrade immediately! https://github.com/kanidm/kanidm/releases/tag/v1.9.3
IMPORTANT - In the coming days we will be releasing an important security update for Kanidm which will resolve six issues. Two of these advisories are rated HIGH. You should be ready to upgrade to 1.9.3 / 1.10.0 asap once they are released.
Replying to
@opensuse@fosstodon.org
@opensuse Avoiding any project that embraces and/or allows ai slop.
Replying to
@catsalad@infosec.exchange
@catsalad@infosec.exchange I'm thrilled to announce a new opportunity for strategic alignment! *
I'm currently looking
to optimize my nutritional intake and would love to collaborate on a high-impact resource allocation. Could we sync on filling my food bowl to ensure peak performance and continued growth? Grateful for the support!
#GrowthMindset #ResourceManagement #Synergy
Replying to
@firstyear@infosec.exchange
@purrperl@noc.social Ive had only one issue using the linux emulation. You can run linux containers with podman on freebsd now but the only error is rpm fails to install so you cant build linux images on freebsd. I need to report the bug.
But otherwise its been great, not much reason to hold onto many linux machines now for me.
Its been such a fun experience to be using freebsd again, its really brought back some joy of messing with servers to me.
Replying to
@bert_hubert@eupolicy.social
@bert_hubert@eupolicy.social @daedalus@eigenmagic.net Yeah my lecturer at uni circa 2010 said it was cyclical, going from local machcines to mainframes to local machines and he predicted the trend back to "mainframes" would occur again.
Replying to
@fastmail@mastodon.social
@fastmail@mastodon.social Its a real shame your passkey impl has flaws as it attempts to force platform only keys.
Very excited to share what I've been working on these past months - Kanidm and 389-ds are both being used in the new SUSEID / OpenSUSE community authentication stack. My colleague Jose spoke about this at CCC https://media.ccc.de/v/5019-suseid-open-by-design-sovereign-by-choice