Royce Williams

@[email protected]
3.5K Followers
3.9K Following
15K Posts

Just doing my undue diligence.

ISP vet, password cracker (Team Hashcat), security demi-boffin, YubiKey stan, public-interest technologist, AK license plate geek. Husband to a philosopher, father to a llama fanatic. Views his.

Day job: Enterprise Security Architect for an Alaskan ISP.

Obsessed with security keys:
techsolvency.com/mfa/security-keys

My 2017 #BSidesLV talk "Password Cracking 201: Beyond the Basics":
youtube.com/watch?v=-uiMQGICeQY&t=20260s

Followed you out of the blue = stole you from someone I respect.

Blocked inadvertently? Ask!

Am I following a dirtbag? Tell me!

Suggestions welcome!

Photo: White 50-ish man w/big forehead, short beard, & glasses, grinning by a display of Alaskan license plates.

Boosts not about security ... usually are.

Banner: 5 rows of security keys in a wall case.

#NonAIContent

#hashcat #Alaska #YubiKeys #LicensePlates

P.S. I hate advance-fee scammers w/heat of 400B suns

❤️:⚛👨‍👩‍👧🛡🙊🌻🗽💻✏🎥🍦🌶🍫!

Stuffhttps://www.techsolvency.com/roycewilliams/mastodon
Keybasehttps://keybase.io/royce
GitHubhttps://github.com/roycewilliams
LinkedInhttps://www.linkedin.com/in/roycewilliams
Gravatarhttps://gravatar.com/tychotithonus
Not "dehashed"!https://www.techsolvency.com/passwords/dehashing-reversing-decrypting/
Royce Williams1d ago
How many millions of person minutes were wasted by deciding to do this?
Royce Williams4d ago

How do we prepare for an accelerated pace of exploits?

I think @mubix is spot on here.

https://infosec.exchange/@mubix/116415117902139733

Even if Claude Mythos (the restricted-access model that is claimed to be good at finding vulnerabilities) is 90% marketing fluff, the remaining 10% is only going to accelerate, and we have some time to adapt.

If our processes need to assume that vulnerabilities will be exploitable an order of magnitude faster ... how do we reprioritize components of our programs? This is a pretty good road map.

And even if you don't think AI is going to trigger that, that just means that it'll be slightly slower, and all of these steps are still major security wins.

Royce Williams4d ago

Wait ... the only [individual-level] MFA that Anthropic trusts for its security-researcher exception program ("Cyber Use Case") is ... Google's?

https://claude.com/form/cyber-use-case

(Now that I think about it, the email-driven auth option is basically magic links, with no MFA. So my only choice here is to introduce a Google dependency?)

Royce Williams5d ago

New security keys from Kensington:

https://www.kensington.com/news/news-press-center/2026-news-press-center/kensington-expands-verimark-portfolio-with-new-nfc-usb-c-and-usb-a-fido2-level-2-security-keys/

FIDO CTAP 2.1, IP68.

USB-A model K64738WW:
https://www.kensington.com/p/products/data-protection/fingerprint-security-keys/verimark-nfc-usb-a-security-key/

USB-C model K64739WW:
https://www.kensington.com/p/products/data-protection/fingerprint-security-keys/verimark-nfc-usb-c-security-key/

No mention of passkey capacity.

(h/t: Nerds.xyz)

Royce Williams6d ago
New YubiKey (or should I say ... yubiKey?) packaging / branding that I hadn't seen yet! Note the slightly more "digital"-ish font in the "5C NFC" part, and the "Article #" (new to me) and the period at the end of "Made in Sweden." and the "by Yubico" at the bottom (formerly just "Yubico") and the new registered trademark symbol after "yubiKey".
Royce WilliamsApr 4
Just stepped into a Burlington for the first time in 20 years. It's like Target and Goodwill had a baby.
Royce WilliamsApr 1
The latest Pixel Watch update seems to have taken away the ability to show the weather for a fixed location. As far as I can tell, the only way I can see what the temperature is in my town ... is to turn on location.
Royce WilliamsMar 8

Like that project that mapped process management to Doom (killing creatures = killing of processed), except mapping managing my shell history to sci-fi time-travel editing of the timeline.

(Screenshot from actual recent cmdline activity, that gave me the idea)

Royce WilliamsFeb 8
Uh oh, @zackwhittaker is Back On His Bird B------- (and I say this with love, as I "Showed anyway" for every single one of these posts, and left satisfied!)
Royce WilliamsFeb 3
Apparently some of the people/AIs writing automatic articles about stock-price shifts and earnings announcements don't know the difference between "sales" and "revenue".