h2g2bob @h2g2bob@mastodon.dbatley.com

Google has just updated its 2FA Authenticator app and added a much-needed feature: the ability to sync secrets across devices.

TL;DR: Don't turn it on.

The new update allows users to sign in with their Google Account and sync 2FA secrets across their iOS and Android devices.

We analyzed the network traffic when the app syncs the secrets, and it turns out the traffic is not end-to-end encrypted. As shown in the screenshots, this means that Google can see the secrets, likely even while they’re stored on their servers. There is no option to add a passphrase to protect the secrets, to make them accessible only by the user.

Why is this bad?

Every 2FA QR code contains a secret, or a seed, that’s used to generate the one-time codes. If someone else knows the secret, they can generate the same one-time codes and defeat 2FA protections. So, if there’s ever a data breach or if someone obtains access .... 🧵

#Privacy #Cybersecurity #InfoSec #2FA #Google #Security

Space Colony Art from the 1970s

The cylinder becomes a kind of Eden regained in these space fantasies, an Arcadia retrofitted with solar panels and cosmic-ray shields. https://publicdomainreview.org/collection/space-colony-art-from-the-1970s/

The reason why Drax are my old friends is that if you ask Telehouse London for a renewable energy statement they will give you a certificate from Drax saying that they use "100% renewable energy".

We as taxpayers, (still) fund them doing this and then they hand out certificates of greenwashing to other companies. It makes me even more sad how few people who asked me for those certs were interested in knowing more.

No, I will never stop going on about this.

https://tools.bitfolk.com/wiki/Renewable_energy_statement

NEW PROJECT!
The only page that lets you keep track of Oprah Winfrey, Mark Wahlberg, Christopher Biggins AND 1970s Tom Baker
https://vole.wtf/celeb-clock/

https://www.danlynch.org/blog/2024/02/the-corresponding-source/ - I am producing a new show for @conservancy called The Corresponding Source. Just blogged about it. Give it a listen and see what you think 🙂

#podcast #freesoftware #audio

We need to end the pretence that burning wood is doing anything useful for the climate emergency. Change the law. https://www.bbc.co.uk/news/science-environment-68381160

Important update from the "is this prime" game: 87 is now by far the most incorrectly tested number, ending just under 1 in 7 games.
After that, 51 and 57 are still almost neck and neck, ending 4.6% of games each.

https://isthisprime.com/game/

#IsThisPrime

Such a great definition, arf arf

⚠️ Update: Live metrics show that X/Twitter has now been restricted in #Pakistan for over one week, with service remaining fully or intermittently restricted for most users; the incident comes amidst a surge in internet censorship during elections marred by irregularities 📉

Finally got around to writing a story about the i-SOON data leak (as opposed to just madly tooting about how interesting it is). Probably my favorite part of this leak shows an i-SOON employee proudly telling his boss that they successfully hacked one of the universities on the govt's target list, only to be told that university wasn't actually on the list. Whoops:

"A new data leak that appears to have come from one of China's top private cybersecurity firms provides a rare glimpse into the commercial side of China's many state-sponsored hacking groups. Experts say the leak illustrates how Chinese government agencies increasingly are contracting out foreign espionage campaigns to the nation's burgeoning and highly competitive cybersecurity industry."

https://krebsonsecurity.com/2024/02/new-leak-shows-business-side-of-chinas-apt-menace/

Ending today by discovering the mysterious GPO telephone numbers station that vanished overnight was created by a friend

Here’s a cautionary tale about digitisation of #archives

For the WW1 centenary, the National Library of Wales created cymru1914.org, to pull together scans of primary sources relating to the period. By all accounts it was brilliant.

Naturally, like all such projects, the site disappeared once the money ran out, taking everything with it. Rip.

Today in "Daylight Savings Chaos Monkey"

If you have backups but you have never tried to restore them, you do not have backups. This is true.

I made a MySQL oopsie, and tried to restore a table from my voluminous backups of same, and was met...
https://jwz.org/b/ykM4