This is a strange future. I thought I was talking with a hearing-impaired friend last night. It turned out he didn't hear a word I said - but not for the typical reason.
He was streaming a baseball game to his bluetooth-equipped hearing aids!
🍍David Longenecker🍍
@dnlongen
- 35 Followers
- 99 Following
- 91 Posts
Munin, Keeper of LoreThe CEO's password was just "password"
Whiskey.
With a side of Tango.
And a heaping helping of Foxtrot.
"For years, cybersecurity startup Tanium Inc. pitched its software by showing it working in the network of a client...but Tanium never had permission...a company selling security actually was giving outsiders an unauthorized look at information from inside its customer’s system"
[ Yes! I know! You -can- get the money back on a fraudulent debit charge....
....after the bank has investigated, etc.
Why bother going through that hassle? Use a credit card so they act as a firewall to soak any fraudulent charges, and pay it off immediately after.]
IHG done got pwned again.
https://threatpost.com/ihg-confirms-second-credit-card-breach-impacting-1000-plus-hotels/125033/
So if you stayed at a Holiday Inn Express [or Crowne Plaza, or... ] then you probably should pay attention to your card statements.
This is why it's always better to use a credit card rather'n a debit card if possible - gamble with the bank's money, not yours.
terribleplan@dnlongen Yeah. I'm just saying I think a mutually authenticated channel would be neat. Is there such a thing as diffie-hellman for humans?
I just heard that USAA is adding multifactor authentication for human-to-human customer service calls. Nice move!
Anyone know of any other banks that do this?
In March, crooks made off with personal information on around 100,000 taxpayers by breaching a website tool intended t help with the FAFSA.
This letter sent by the IRS to affected taxpayers implies the crooks made off with far more than just income data. Credit monitoring is OK for detecting fraudulent new accounts - but does nothing if the crook has enough information to social engineer your bank.
https://www.securityforrealpeople.com/2017/04/a-letter-from-irs.html
Over the weekend, a well-known security vendor had their LinkedIn business page hijacked. Inevitably, out came shaming calls of "you should have used two-factor."
I put together some thoughts at Peerlyst; TL;DR is, shaming is easy, but properly securing multiple authorized users' access to organization social media pages takes some planning. Does *every* authorized admin or content publisher have 2FA enabled?
Please, please, please, please, please do NOT issue short leases [>24h] to everything on the network because you're "running out of IPs"
That is not a game you want to be playing, and it will make me very sad.