Jonathan Rudenberg

@[email protected]
179 Followers
298 Following
26 Posts
debugger.
pronounsthey/them
githubhttps://github.com/titanous
Jonathan RudenbergJun 19, 2023
@glauca Hey, any chance you’re going to support configuring webauthn as the sole 2FA option for accounts?
Show threadJonathan RudenbergJun 19, 2023
@tomlowenthal And this is why I’ve been putting off moving somewhere else for years now
Show threadJonathan RudenbergJun 19, 2023
@tomlowenthal Google Workspace is the only other option that I’m aware of…
Show threadJonathan RudenbergJun 16, 2023
Annnd tagging @fastmail here got an immediate response to the ticket confirming that as of this week they "now require an aligned DKIM pass for BIMI".
Jonathan RudenbergJun 16, 2023
@acdha @fastmail Yes, exactly, I think this will be what finally pushes me to move off.
Show threadJonathan RudenbergJun 16, 2023
So @fastmail didn’t respond at all to my report sent to security@ about the BIMI spoofing issue. The auto reply from their ticket system claimed that it may take “10 business days to respond” which elapsed this morning (and is way too long for an initial response to a security issue).
Show threadJonathan RudenbergJun 7, 2023
Great coverage of the BIMI spoofing issue from AJ: https://cyberscoop.com/security-professionals-tweet-bimi-google-gmail/
Security professional's tweet forces big change to Google email authentication

Gmail is tightening its implementation of an email security protocol after a researcher discovered a flaw allowing brands to be impersonated.

CyberScoop
Show threadJonathan RudenbergJun 6, 2023
@bascule @filippo Codespaces is wired up to sign commits, there’s no reason they couldn’t use the same infra for pushes…
Show threadJonathan RudenbergJun 5, 2023
@aliu I did in the next post in my thread! Great paper!
Jonathan RudenbergJun 5, 2023

@kurtseifried BIMI doesn't show up if you're using the native Mail app on iOS with Gmail because they aren't adding the message headers that it is looking for. The logos do show up in the Gmail app.

My only complaint is about the extremely misleading verified checkmark/tooltip (and equivalent UI in Apple Mail). I agree that the logos have no meaningful impact given that Gmail shows profile images.