• The Promise vs. Reality of Passkeys:

  • Passkeys (built atop WebAuthn / FIDO2) are marketed as the ultimate replacement for passwords, promising phishing resistance, cryptographic security, and seamless authentication without shared secrets.
  • Despite the technical merits of public-key cryptography, the real-world user experience introduces severe friction, vendor lock-in, and conceptual opacity for everyday users.

• Ecosystem Fragmentation & Platform Walled Gardens:

  • Major platform holders (Apple, Google, Microsoft) implement passkey synchronization within their proprietary ecosystems (iCloud Keychain, Google Password Manager, Windows Hello).
  • Cross-platform authentication often forces cumbersome workarounds—such as scanning QR codes via Bluetooth proximity between incompatible devices—which frequently fails or degrades user trust.

• Account Recovery & Portability Concerns:

  • Unlike passwords or traditional exportable 2FA seeds (TOTP), passkeys have historically lacked standardized, platform-agnostic import/export mechanisms, making migration between ecosystems painful or impossible.
  • Account recovery becomes high-risk: losing access to an ecosystem account can lead to permanent lockout from third-party services that disabled password fallbacks.

• Shared Accounts and Non-Technical User Barriers:

  • Standard family and enterprise account-sharing patterns (e.g., streaming services, joint utility bills, shared team logins) break down when an authentication credential is bound to a single person's device ecosystem.
  • For non-technical users, abstracting authentication into platform prompts removes transparency regarding where credentials physically reside or how to back them up securely.

Hacker News Discussion

• Platform Enclosure & Loss of User Agency:

  • Commenters frequently point out that passkeys shift control from open protocols and user-owned password managers to big-tech operating system silos.
  • Many express frustration that the underlying cryptography is solid, but the implementation incentives serve corporate lock-in rather than user autonomy.

• Cross-Device Usability Failures:

  • Real-world usage stories highlight significant pain points when operating across mixed environments (e.g., a Linux desktop, an Android phone, and a work MacBook).
  • The hybrid transport mechanism (QR code + Bluetooth LE handshake) is widely criticized as fragile, slow, and confusing for mainstream users.

• Third-Party Password Managers as the Middle Ground:

  • Several participants advocate for managing passkeys exclusively inside dedicated third-party tools (such as 1Password, Bitwarden, or KeePassXC) rather than OS keychains.
  • This approach restores cross-platform synchronization and export capabilities, though some note it circumvents the hardware-isolated enclave guarantees intended by platform vendors.

• Phishing Resistance Still Outweighs UX Defects:

  • Security practitioners in the thread defend passkeys, stressing that origin-bound cryptographic credentials completely eliminate credential stuffing, phishing, and server-side database leaks.
  • Even with awkward UX, defenders argue that passkeys represent an unavoidable and strictly superior baseline compared to weak passwords and easily intercepted SMS 2FA.

• The Reality of Agent Threat Models [00:00:07]:

  • AI agents do not require software vulnerabilities to cause harm; ingesting untrusted data (poisoned dependencies, hidden repository comments, booby-trapped web pages) triggers prompt injection.
  • Prompt injection is an inherent property of probabilistic models, not a fixable bug; security design must focus on blast radius containment rather than prevention.

• Mode 1: Supervised Execution (Human-in-the-Loop) [00:03:00]:

  • Typical developer workflows (e.g., Claude Code, Cursor, Gemini CLI) rely on interactive user approval prompts for commands and filesystem writes.
  • Layering complex sandboxes over interactive human confirmation is redundant; the user functions as the security harness and bears full operational responsibility.

• Mode 2: Unsupervised Agents (The "Walk Away" Model) [00:06:45]:

  • When autonomous agents run unattended, the surrounding harness must assume the agent will be compromised and restrict its destructive capabilities.
  • Network Egress (Primary Defense): Data exfiltration is the primary threat; enforcing strict network boundaries ensures stolen secrets or proprietary code cannot leave the system.
    • Allowlisting Challenges: Basic hostname filtering can be bypassed via direct IP requests, domain fronting, SNI spoofing, DNS exfiltration, or parsing bugs (e.g., null-byte flaws).
    • Enforcement: Network restrictions must be enforced at the kernel/packet routing layer rather than trusting local environment variables (HTTP_PROXY).
    • Deep Inspection: Intercepting outbound leaks requires full TLS decryption/inspection, which introduces operational complexity and trust-store maintenance.
  • Credential Lifecycle & Capability Separation [00:12:19]:
    • Agents must never hold durable, long-lived credentials on disk or in shell configuration files.
    • Utilize dynamic workload identity (e.g., Cloud IAM / Workload Identity Federation, SPIFFE/SPIRE, HashiCorp Vault) to mint ephemeral, narrowly scoped tokens.
    • Advanced architectures use external brokers or sidecars that inject auth headers during transit, completely preventing the agent from seeing or exfiltrating the underlying secret.
  • Execution & Host Isolation Rungs [00:18:11]:
    • Filesystem Scoping: Restricts operations strictly to the immediate workspace to prevent persistent backdoors in dotfiles, shell profiles, or Git configs.
    • Standard Containers: Offer process isolation but share the host kernel, leaving hosts vulnerable to kernel escape exploits.
    • MicroVMs & Hardware Isolation: Sandboxes like Firecracker, Kata Containers, gVisor, or dedicated throwaway physical hardware provide real boundaries for long-running autonomous tasks.

• Mode 3: Multi-Agent Swarms & Fleet Dynamics [00:24:00]:

  • Multi-agent architectures introduce inter-process risks that circumvent single-agent perimeter sandboxes:
    • Prompt Contagion: An injection payload ingested by one agent propagates horizontally across shared communication buses, databases, and prompt handoffs.
    • Dynamic Agent Spawning: Compromised workers can spawn subordinate tasks or cross project boundaries autonomously.
    • Borrowed Authority / Confused Deputy: Subordinate agents implicitly trust messages originating from peer agents; a compromised low-privilege agent can trick a privileged agent into destructive actions.
  • Mitigations require treating inter-agent messaging as untrusted user input, limiting peer connectivity graphs, and minimizing shared memory surfaces.

• Operational Balance & Friction [00:29:52]:

  • Overly restrictive sandboxing leads to workflow interruptions, silent task failures, and "allow-all" approval fatigue.
  • The goal of agent security is pragmatic blast-radius containment (prioritizing strict egress filtering) to capture productivity gains safely without paralyzing utility.

这是一个关于行业共识的声明，但缺乏具体细节。需要了解这些声明的具体内容、签署方的权威性和代表性，以及'紧急行动'的具体含义。AI安全领域的共识可能存在分歧，需要更深入的分析来验证这一说法。

【非共识】这一观点挑战了传统网络安全认知，认为AI正在消除国家级行动与个人行动者之间的能力差距。这意味着未来网络安全防御需要重新思考如何应对这种能力民主化现象，资源有限的小型组织或个人也能实施复杂的攻击。

【数据】这一网络安全能力声明声称Astra在漏洞利用基准测试中取得了100%的完美分数，这是一个显著的飞跃。需要详细了解ExploitBench的测试方法、样本大小和多样性，以及这些结果是否经过独立验证，以评估这一声明的可靠性。

• Core Premise & Methodology:

  • The author used agentic reverse engineering (Claude Opus / Claude Code) over two weeks (totaling ~13 hours of AI churn across 98 prompts) to audit, reverse engineer, and modify the firmware of common desk peripherals.
  • For each device, the AI extracted firmware update protocols, developed custom flashing tools, analyzed security properties (secure boot, signature checks), and enumerated hidden or debug features.

• Targeted Devices & Findings:

  • Insta360 Link Webcam:
    • Runs Ambarella ThreadX RTOS with local vision models for tracking.
    • Lacks firmware tamper protections (only uses a basic MD5 integrity check) and allows silent over-the-wire flashing via vendor USB commands.
    • Patched the firmware LED table to completely disable the green recording activity LED while keeping video capture active.
  • ASUS ROG Swift PG42UQ Monitor:
    • Firmware updates run unauthenticated over I2C bridged via USB with basic checksums and an A/B slot scheme.
    • Identified the exact patch point to permanently suppress the unskippable 8-hour "pixel cleaning" pop-up overlay and built scripts to control hardware overlays (crosshairs, FPS counter) via DDC/CI on Linux.
  • Shure MV7 Microphone:
    • Firmware update protocol exposes a plaintext USB HID vendor command shell (48 commands), accessible straight from a browser via WebHID.
    • Features a 4-tier privilege model with trivial authentication (su sup), granting arbitrary memory read/write, DSP parameter controls, and the ability to disconnect the mute LED indicator from the real microphone state.
  • Elgato Cam Link 4K:
    • Analyzed completely unattended overnight; revealed plain MCU and FPGA bitstreams without firmware verification, including tunneled I2C access to HDMI receiver registers.
  • Elgato Key Light Mini:
    • Features Ed25519 signature checks over SHA-512 hashes, but lacks a secure boot chain.
    • An unauthenticated HTTP POST endpoint on the local Wi-Fi network allows passing raw AT commands to internal UART memory, permitting single-command arbitrary memory writes (ATSE=...) that bypass signature checks entirely.

• Broader Security & Industry Implications:

  • Democratized Tinkering vs. Perceived Threat Models: Automated agentic workflows drastically lower the barrier to modifying proprietary hardware for Linux interoperability and removing anti-features.
  • Host & Network Risks: Malicious firmware implants (turning webcams into silent surveillance or peripherals into rogue HID keyboards via WebUSB/WebHID) no longer require nation-state level R&D; autonomous AI-driven worms could soon probe, reverse engineer, and weaponize IoT and peripheral targets on the fly.

Hacker News Discussion

• Empowerment and Device Ownership:

  • Commenters celebrated the ability to use AI for fixing vendor neglect, such as writing modern Linux DRM/DKMS drivers for legacy GPUs (e.g., Silicon Motion SM750) or stripping ads and cloud requirements from cheap IoT devices (e.g., label makers).
  • Many highlighted the triumph of consumer control over planned obsolescence, vendor lock-in, and abandoned software ecosystems.

• Security Realities and Future "Arms Race":

  • Several participants warned that this represents an unstable temporary equilibrium: vendors currently rely on "security through obscurity" and sloppy firmware implementations, but may eventually lock down consumer hardware with cryptographically enforced secure boot chains, similar to modern smartphones.
  • Concerns were raised that the same accessibility benefiting hobbyists will inevitably facilitate widespread automated malware, corporate spyware, and abuse targeting non-technical users.

• The OLED "Pixel Cleaning" Debate:

  • Users engaged in a lively debate over the monitor's OLED pixel cleaning pop-up. While some pointed out that OLED panels require maintenance cycles to prevent burn-in and prolong hardware lifespan, others criticized hostile vendor UX designs that interrupt live presentations or gaming sessions rather than executing cycles quietly on standby.

Passkeys and Consumer Usability

• Nikita Bier's Post:
  • Asserts that passkeys were created by engineers who failed to understand the average consumer's mindset and mental model.
  • Argues that despite their cryptographic security, passkeys create unnecessary friction and confusion for non-technical users compared to passwords.

Hacker News Discussion

• Cross-Platform & Multi-Device Friction:
  • Users navigating multiple operating systems (macOS, Windows, iOS) and browsers find passkey synchronization confusing and unpredictable.
  • Platform-level implementations often push users into specific vendor ecosystems, complicating cross-device workflows.
• Loss of User Control & Data Transparency:
  • Unlike passwords, passkeys cannot be easily copied, pasted, or manually inspected, raising fear of accidental account lockouts.
  • Proprietary or ecosystem-locked implementations make exporting passkeys difficult, driving concerns over vendor lock-in.
• Shared Account & Family Access Barriers:
  • Credentials meant to be shared across family members or households (e.g., utility accounts or streaming services) become hard to manage when bound to individual passkeys.
• Confusing User Experience & Conflicting Dialogs:
  • Operating systems, browsers, and third-party password managers (like Bitwarden or 1Password) frequently compete for authentication handling, leading to confusing popups and prompts.
• Security vs. Practical Adoption:
  • While passkeys solve major security vulnerabilities like phishing, the gap in user comprehension leads many experienced tech workers and consumers to stick with traditional password managers.

• Ewolucja zagrożeń komputerowych: Choć tradycyjne wirusy znane z lat 2000. wydają się pieśnią przeszłości, w rzeczywistości cyberzagrożeń jest więcej niż kiedykolwiek (np. Kaspersky wykrywa pół miliona nowych szkodliwych plików dziennie). Zmienił się jednak ich cel i charakter – z komputerów osobistych na duże instytucje [00:00:00], [00:00:49].
• Początki – wirus "Brain" (1986 r.): Pierwszy wirus na PC został stworzony w Pakistanie przez braci Basita i Amjada Farooq Alvi jako protest przeciwko piractwu ich programu medycznego. Wirus zawierał ich pełne dane kontaktowe i adres sklepu, stając się globalnym, lecz niegroźnym eksperymentem [00:01:08], [00:01:42].
• Era destrukcji – "I Love You" (2000 r.): 23-letni student z Filipin, Onel de Guzman, stworzył wirusa kradnącego hasła, który wymknął się spod kontroli, zarażając 45 milionów komputerów i generując straty rzędu 10–15 miliardów dolarów. Ze względu na ówczesny brak przepisów o cyberprzestępczości, autor nigdy nie został skazany i dziś prowadzi mały serwis telefonów [00:02:48], [00:03:57], [00:04:46].
• Komercjalizacja i model Ransomware-as-a-Service (RaaS): Współczesne cyberataki to dojrzały biznes przypominający model subskrypcyjny (jak Netflix czy Spotify). Twórcy oprogramowania (operatorzy) wynajmują kod i infrastrukturę hakerską afiliantom, którzy dokonują włamań i wymuszają okupy, dzieląc się zyskami (zazwyczaj w stosunku 80/20) [00:05:20], [00:05:33].
• Instytucje jako główny cel: Indywidualni użytkownicy przestali być opłacalnym celem dla hakerów. Dzisiejsze ataki ransomware wymierzone są w podmioty o krytycznym znaczeniu, takie jak szpitale, urzędy miast czy infrastruktura krytyczna (np. paraliż Colonial Pipeline w 2021 r.), ponieważ presja czasu i zagrożenie życia zmuszają je do natychmiastowego płacenia milionowych okupów [00:06:25], [00:06:53].
• Polska na celowniku: Według raportów bezpieczeństwa (np. ESET), Polska znalazła się na 3. miejscu na świecie pod względem liczby ataków ransomware, co jest powiązane z pozycją geopolityczną kraju. Przykładem są zmasowane ataki na polskie szpitale (m.in. w Szczecinie, Krakowie i Katowicach), które drastycznie paraliżowały ich pracę [00:07:18], [00:07:30].
• Wpływ AI na dynamikę ataków: Wykorzystanie sztucznej inteligencji pozwala hakerom masowo generować perfekcyjne, bezbłędne maile phishingowe (82% w zeszłym roku) oraz stosować zaawansowane deepfake'i. Co najważniejsze, czas od pierwszej infekcji do całkowitego zaszyfrowania danych skrócił się z około 60 dni w 2019 roku do zaledwie 3,5 dnia obecnie, drastycznie zmniejszając margines czasu na reakcję obrony [00:08:15], [00:08:45].

大多数人认为网络安全的主要挑战是发现漏洞，因为传统上找到安全漏洞需要专业知识和时间。但作者认为，随着AI加速了漏洞发现过程，现在的主要瓶颈已经转变为修复漏洞，因为发现的漏洞数量已经远超防御者的处理能力。

大多数人认为政府对Anthropic的出口管制是为了国家安全，但作者指出，网络安全专家认为这是危险的，因为这将削弱美国的网络安全能力。

• Misuse of a Specific Standard: JSON Web Tokens (JWTs) were fundamentally architected as short-lived (~5 minutes or less) Single Sign-On (SSO) or federation data transports, yet they are widely and improperly implemented by developers for long-lived, web-browser user sessions.
• The Stateless Authentication Illusion: True stateless user sessions are an architectural fallacy if security is a priority. Handling instant logouts, immediate user bans, or privilege changes requires maintaining a stateful data store; if a database or distributed cache must be queried anyway, an opaque session ID cookie is simpler and more secure.
• Inherent Specification Vulnerabilities: The JOSE/JWT family specification is heavily criticized by security experts for its excessive complexity and historically relaxed parameters—such as permitting an alg: "none" signature type or exposing systems to public/private key confusion attacks.
• Performance Fallacies: While developers often adopt JWTs to eliminate database lookup overhead on every API request, standard session tokens managed inside a fast key-value store (e.g., Redis or Valkey) introduce negligible latency and avoid the bloated payload size of heavily cryptographic JWTs.
• The Bootcamp Propagation Loop: The adoption of JWTs for basic web app authentication is largely driven by a propagation loop of unvetted blog posts, tutorials, and coding bootcamps that prioritize trends and perceived simplicity over battle-tested security standards.
• Alternative Approaches: For scenarios that legitimately demand short-lived, cryptographically signed tokens, modern secure-by-default specifications like PASETO (Protocol-Agnostic Security Tokens) should be chosen over the flaw-prone JWT standard.

Hacker News Discussion

• Historical vs. Modern Library Security: Several commenters argue that JWTs are safer today because modern, cross-language libraries have finally hardened their defaults (e.g., stripping out alg: "none" support). However, security purists counter that a spec requiring ongoing, scattershot library audits to prevent basic misuse is inherently broken by design.
• Revocation List Overhead: Proponents of JWTs claim that managing an invalidation/revocation list for unexpired JWTs requires orders of magnitude less memory and database storage than maintaining a global registry of every single active session in a large-scale system.
• The DB Lookup Reality: A counterargument highlights that even with a verified JWT, applications almost always perform a database lookup on the accompanying user or identity object anyway to check if an account is still active or authorized, completely neutralizing the "stateless" performance benefit.
• Invalidation Workarounds and State Creation: Some users suggest bypassing individual token revocation lists by adding a tokens_not_valid_before timestamp to a user profile, which updates to now() on logout. Critics point out that this still creates system state and inadvertently forces a nuclear logout across all of a user's active devices instead of just one.
• Legitimate Distributed and Agentic Use Cases: Commenters emphasize that JWTs remain highly valuable for cross-region edge microservices (e.g., replicating compact, short-lived revocation lists between Japan and Europe) and delegating scoped execution permissions to modern third-party subagents.

• Distributed AI Training and Scraping: AI companies require massive amounts of web-scraped data for training, search, and agent grounding. Because traditional data centers face heavy blocking and throttling by security services (like Cloudflare and DataDome), scrapers rely on residential proxy networks to route traffic through home internet connections.
• Bright Data's SDK Network: Bright Data operates a massive commercial residential proxy network (marketing over 150M+ to 400M+ IPs). They source these exit nodes by embedding a consent-based Software Development Kit (SDK) inside consumer-facing mobile apps and Connected TV (CTV) / Smart TV applications.
• Why Smart TVs are the Ideal Proxies: Compared to mobile phones, Smart TVs provide a near-perfect infrastructure for proxy routing:
  • They are permanently connected to high-speed home Wi-Fi and grid power (no battery constraints).
  • They run 24/7 in standby mode and offer effectively unlimited bandwidth.
  • They operate largely unattended with virtually no corporate or family oversight.
  • The consent UI on TVs is typically dense text navigated via remote arrow keys, making it unlikely for users to understand that their bandwidth is being sold to third-party scrapers.
• Deceptive Allocation Limits: While opt-in prompts (such as in the Roku app Petflix) claim the SDK "occasionally" uses free resources, the underlying, publicly queryable SDK configuration sets a massive monthly default Wi-Fi budget of up to 200 GB (max_bw_monthly_wifi: 200,000,000,000 bytes).
• Notable SDK Integration Partners: Public, unauthenticated partner manifest endpoints expose integrations with platforms reaching hundreds of millions of households, including:
  • PlayWorks Digital Ltd: Over 400 CTV game titles across Comcast, Sky, Cox, LG, Samsung, Vizio, and Roku.
  • CloudTV: Integrated across more than 125 TV brands and 15+ OEMs.
  • Viber Media (Rakuten): Massive messaging app ecosystem.
  • Supercent & Moonfrog Labs: Major mobile game publishers.
• Technical Reverse-Engineering & VPN Bypasses: Technical analysis of the iOS framework (brdsdk.framework) reveals that:
  • The SDK dials out to a persistent WebSocket connection tracking device metrics (CPU, memory, network state, battery level).
  • Bypassing VPNs: By forcing network interface bindings directly to Wi-Fi (en0) or cellular (pdp_ip0) instead of the system default route, the SDK completely bypasses user-configured local VPN tunnels (tun0).
  • Broad Definition of "Idle": The SDK configuration allows relaying traffic even when the user is actively on a phone call or the screen is on, provided CPU utilization remains below 70% and memory below 90%.
• Cross-Platform Identity Stitching: The SDK's config file contains tracking properties like dual_pairing maps designed to tie a single user's distinct installations across iOS, Windows, and macOS together into a single unified identity.
• Mitigation and Defense Strategies:
  • DNS Sinkholing: Network-wide blocking of key domains (proxyjs.brdtnet.com, proxyjs.luminatinet.com, proxyjs.bright-sdk.com, and clientsdk.bright-sdk.com) entirely kills the proxy peer tunnel without impacting legitimate public traffic.
  • Network Boundaries: Utilizing TLS SNI filtering on domains matching *.brdtnet.com or *.luminatinet.com.
  • MDM Application Auditing: For enterprise environments, scanning mobile binaries for unique Swift symbols like BrdWebSocketFacade and BrdNetwork.DNSResolver to filter out infected applications.

Hacker News Discussion

• The Irony of Cloud-to-Cloud Scrapes: Users point out the profound irony that both the AI data scrapers and the target websites being scraped are often simultaneously hosted on AWS infrastructures, engaging in a costly, artificial cat-and-mouse game to mask their identities.
• Strict Hardware Isolation ("Dumb" Displays): A popular consensus among commenters is to completely air-gap or isolate smart TVs from the internet, relying exclusively on local HDMI inputs connected to trusted devices (like Apple TV, HTPCs, or Home Assistant setups).
• Automatic Content Recognition (ACR) over HDMI: Contributors point out that simply removing network permissions may not protect privacy entirely if a TV is ever connected later. Academic papers cited in the thread reveal that Smart TVs run Automatic Content Recognition to analyze and log content even on local HDMI inputs while offline, caching data to upload the moment an internet connection becomes available.
• The Threat of VPN Bypassing: The community expressed severe alarm regarding the SDK's ability to explicitly bypass local system VPN configurations via forced network interface bindings, highlighting the growing complexity required to self-host secure, consumer-friendly networks.
• Legal Risks and Misleading Consent: Commenters note that the SDK text hides behind the guise of "downloading public data," masking that its true utility is to circumvent security blocks. There is also discussion regarding the liability risk for home residents if a malicious third party utilizes their residential IP address through these unregulated networks for illicit activities (e.g., severe cybercrimes), though others note Bright Data utilizes strict Know-Your-Customer (KYC) onboarding for their buyers.
• Network-Level Defense: Users shared practical setups for containment, such as creating isolated local VLANs with restrictive firewall configurations, whitelisting device MAC addresses via DHCP policies, and deploying Pi-holes or AdGuard Home setups to drop the domains mentioned in the report.

大多数人认为网络安全的主要挑战是发现漏洞，但作者认为真正的瓶颈在于修复漏洞的过程。这一观点挑战了网络安全行业的传统优先级设置，暗示了防御策略需要根本性转变。

大多数人认为网络安全的主要挑战是发现漏洞，但作者认为真正的瓶颈在于修复和修补这些漏洞，这颠覆了传统网络安全优先级的认知。

大多数人认为AI安全措施应该随着技术发展而逐步完善，但作者认为更高级别的AI模型需要更强的网络安全保障才能发布。这挑战了AI行业逐步推进安全标准的常规做法，暗示高级AI可能需要突破性的安全方法而非渐进式改进。

• The Problem with Passwords: Traditional password-based authentication is inherently insecure, vulnerable to phishing, malware (keyloggers), man-in-the-middle attacks, and massive database breaches.
• What are Passkeys: Passkeys are a marketing term for Web Authentication (WebAuthn) credentials. They use public-key cryptography to authenticate users, where the private key stays on the user's device and the public key is stored by the service.
• Phishing Resistance: Because private keys are never transmitted over the network and are cryptographically bound to specific domains, passkeys are effectively immune to traditional phishing attacks.
• Improved UX and Security: Passkeys offer a superior user experience (e.g., using biometrics or device-bound keys) while significantly reducing the risk of credential theft for both the user and the service provider.
• Key Management: Passkeys can be stored in synced password managers or bound to specific hardware security keys. Even if a device is lost, users can manage their accounts through recovery plans, similar to how they manage existing password managers.
• Transition Strategy: The author argues that for true security, companies should move to a "passkey-first" approach, eventually removing passwords entirely and using one-time codes or magic links as a fallback during the transition.
• Future-Proofing: While current passkeys are susceptible to future quantum computing threats, the industry is already looking toward post-quantum signature schemes to ensure long-term security.

• The Discovery: While attending the Colorado School of Mines, the author discovered that local DNS servers assign a unique subdomain to every device connecting to the campus Wi-Fi network.
• Subdomain Enumeration:
  • Initial Attempts: The author first used Python and brute-force permutations to guess subdomains, but the asynchronous script was too slow.
  • Rust Optimization: Moving to Rust and optimizing the code (incrementing an integer and converting it to base 36) dramatically improved speed. They bypass the standard library by interacting directly with the UDP port and utilizing Bash scripting to distribute offsets across multiple processes.
  • The Crash: The optimized Rust script generated queries so quickly (hitting peak rates up to 4.04 Gbps) that it crashed the campus DNS server, causing a 15-minute network outage. School IT tracked them down because they had spent two weeks talking openly about the project.
• PTR Records: Realizing brute forcing became unrealistic for longer subdomains, the author pivoted to utilizing DNS Reverse Lookup (PTR records), which allowed them to map known active IP addresses back to domain names.
• Port Scanning and AF_XDP:
  • The author created a custom, lightweight network scanner called convoy utilizing Linux's AF_XDP to bypass the core network stack.
  • By horizontally scanning (one port across all machines before moving to the next), they safely achieved scan speeds of 300,000 ports per second on a single core.
• Campus Exploitation:
  • Due to loose network restrictions surrounding wireless casting, certain subnets were accessible.
  • The scanner revealed 36 campus security cameras running on default passwords. Although deep packet inspection rules blocked live video streaming, the author reverse-engineered the web interface's API to synchronously manipulate camera positions.
  • They also found unprotected controls for almost every projector screen and input switch across the campus classrooms.
• Reporting: The vulnerabilities were responsibly disclosed to campus IT, who stated the issues would be patched over the summer. The author received no financial compensation.

Hacker News Discussion

• Network Segmentation Failures: Users expressed shock that a modern university in 2026 would still run a completely flat network architecture, allowing unvetted student devices onto the same subnets as critical infrastructure, surveillance cameras, and IoT equipment without basic VLAN segmentation.
• Lenient Academic Consequences: Commenters heavily debated the IT department's mild reaction to a network crash. Some argued that causing campus-wide outages warrants severe disciplinary action to prevent dangerous professional habits, while others recalled their own college days—noting that universities traditionally serve as a safe environment to learn boundaries, and harsh punishments only incentivize hackers to hide their findings.
• Alternative Enumeration Techniques: Network professionals chimed in with alternative scanning methods, noting that hotel and public networks often share a single central DNS server across guest and internal networks, allowing easy reverse PTR record profiling. Others recommended utilizing broadcast mDNS/Bonjour for local device footprinting.
• Industry Perspectives: Former project managers for AV hardware companies noted that modern firmware explicitly mandates changing default passwords upon setup, placing the blame squarely on poor campus IT implementation.

非共识观点：现在，机构负责人正在努力弄清楚他们如何保护自己的系统免受 Mythos 的网络攻击，这一观点可能反映了政府内部对 AI 安全性的担忧。

这一观点指出，网络安全领域对量子威胁的忽视，暗示了需要采取更积极的措施来应对这一挑战。

• The Concept: Researchers from Hong Kong demonstrated a "side-channel" attack that uses standard fiber optic cables as microphones to eavesdrop on conversations [00:00:25].
• How It Works (Rayleigh Scattering): When sound waves (vibrations) hit a fiber optic cable, they cause micro-deformations in the glass. This affects the light traveling through the fiber, causing phase shifts and reflections back to the source—a phenomenon known as Rayleigh Scattering [00:01:44].
• The "Bottle" Amplifier: While standard cables in a wall can pick up some sound, the effect is weak. To amplify the signal, attackers can wrap a long section of fiber around a hollow object, like a plastic bottle. This creates a "coil" that acts as a highly sensitive acoustic sensor [00:04:54].
• Attack Requirements:
  • Physical Access: The attacker needs access to one end of the fiber (e.g., in a server room) to connect a Distributed Acoustic Sensing (DAS) analyzer [00:03:23].
  • Preparation: The target's end of the cable must be "prepared" (e.g., by a fake technician) with the fiber coil/amplifier to get clear audio [00:04:34].
• Performance and Results:
  • Accuracy: At a distance of 2 meters from the fiber coil, researchers achieved up to 80% accuracy in reconstructing speech [00:07:26].
  • Range: Sound can still be somewhat understood at distances up to 8 meters, though quality drops significantly [00:07:44].
  • Immunity: Unlike electronic microphones, fiber optic "microphones" are completely immune to ultrasonic jammers [00:08:43].
• Practicality: The video concludes that this is not a threat to the average person due to the extreme complexity and access required. However, it is a fascinating example of how physical properties can be exploited for espionage in high-security environments [00:10:22].

• The Vulnerability: Researchers at LayerX discovered that Claude Code—Anthropic’s agentic, terminal-based AI coding tool—can be manipulated into performing offensive cyberattacks by simply editing a project's configuration file.
• The "CLAUDE.md" Attack Vector: Claude Code uses a file named CLAUDE.md to store system prompts and project context. Because the AI views this file as authoritative "truth" for the project, attackers can insert specific instructions to bypass safety guardrails.
• Zero-Code Exploitation: The exploit requires no complex programming or advanced prompt engineering. By adding a few lines of text to CLAUDE.md claiming authorization for a "penetration test," the AI will abandon its refusals and execute malicious tasks.
• Capabilities Unleashed: Once the guardrails are bypassed, Claude Code can autonomously perform:
  • SQL Injection (SQLi): Automatically generating and executing payloads to dump databases.
  • Credential Theft: Harvesting usernames and password hashes via automated CURL requests.
  • Data Exfiltration: Sending sensitive local files to external servers.
• Key Risks:
  • Malicious Public Repos: Users cloning a public repository could unknowingly execute a "poisoned" CLAUDE.md file.
  • Insider Threats: Malicious or compromised employees can silently modify this file in internal repositories, as it is often ignored by security scanners.
• Recommendations:
  • For Anthropic: Implement safety scanning specifically for the CLAUDE.md file and alert users when instructions violate standard AI safety policies.
  • For Developers: Treat CLAUDE.md as executable code rather than harmless documentation. It should be subject to code reviews, access controls, and security auditing.

大多数人认为AI在网络安全领域的应用主要局限于防御辅助，而非直接参与核心安全任务。但作者暗示GPT-5.5已具备'高级'网络安全能力，这一分类表明AI已从被动防御工具向主动安全参与者转变，挑战了网络安全领域对人类主导地位的认知。

大多数人认为AI在网络安全领域的进步应该是渐进式的，但作者暗示GPT-5.5代表了网络安全能力的显著跃升，达到了'高'级别而非仅仅'临界'级别。这一观点挑战了人们对AI安全能力发展速度的预期，暗示AI在防御复杂网络威胁方面可能比人们想象的进步更快。

大多数人认为AI在网络安全领域的应用应该被严格限制或视为威胁，但作者认为GPT-5.5的网络安全能力是'进步'而非危险，并将其归类为'高级'而非'关键'风险级别。这与主流的'AI网络安全威胁论'相悖，暗示AI可能成为网络安全防御的重要工具而非主要威胁。

大多数人可能认为高级 AI 模型的访问权限非常难以获得，但作者指出，一个黑客小组通过从 Mercor 数据泄露中获得的信息来猜测 Mythos 的在线位置，这表明了数据泄露可能对更广泛的网络安全构成威胁。

在视觉敏锐度测试中从54.5%跃升至98.5%是一个惊人的进步，这展示了AI在网络安全领域的突破性进展，'our single biggest Opus pain point effectively disappeared'表明这一进步解决了实际应用中的关键瓶颈。

令人惊讶的是：Claude Mythos Preview在利用Firefox漏洞方面的成功率从Opus 4.6的不到1%跃升至72%，这种能力提升是指数级的，展示了AI在网络安全攻防领域可能带来的革命性变化。

令人惊讶的是：深度伪造诈骗已经造成数千万美元的损失，这表明AI技术已被大规模用于犯罪活动，而传统安全系统几乎无法应对这种新型威胁。

令人惊讶的是：每个安全验证请求都有一个唯一的Ray ID，这表明Cloudflare等安全服务提供商为每次验证会话创建详细记录，用于跟踪和分析潜在威胁，这种级别的追踪机制是普通用户很少意识到的网络安全基础设施的一部分。

令人惊讶的是：AI生成的概念验证(PoC)能够揭示人类安全补丁中的不完整之处。这表明AI不仅能发现漏洞，还能评估现有补丁的有效性，这种能力对于提高软件安全性具有重要意义，因为人类开发者可能会忽略这些细微的补丁缺陷。

令人惊讶的是：Claude Mythos Preview模型已经发现了数千个高危漏洞，包括所有主流操作系统和网络浏览器中的漏洞。这表明AI模型已经达到了能够超越大多数人类专家发现软件漏洞的水平，这种能力在网络安全领域具有革命性意义。

大多数人认为安全响应时间虽然缩短但仍有一定的缓冲期，让组织有时间应对新发现的漏洞。但作者认为AI已经将这个窗口从数月缩短到几分钟，这是一个根本性的转变，意味着传统的安全响应模式已经过时。

令人惊讶的是，Claude Mythos能够自主发现并利用一个存在了27年的OpenBSD漏洞。这一事实表明AI模型在网络安全领域的能力已经达到了令人难以置信的水平，能够找到人类专家和安全系统长期未发现的漏洞。这引发了关于AI安全性和控制机制的深刻问题。

令人惊讶的是：文章揭示了网络安全领域的根本性转变——过去需要高技能黑客多年经验才能完成的漏洞利用工作，现在AI可以在短时间内完成。这种技术民主化虽然提高了效率，但也大大降低了攻击门槛，使网络安全形势急剧恶化。

• Core Concept: 2FA adds a second layer of security by requiring something the user knows (password) and something they possess (a device generating codes).
• Offline Functionality: The most interesting technical aspect is that 2FA applications (like Google Authenticator or Aegis) work entirely offline after an initial secret key exchange.
• HOTP (HMAC-based One-Time Password):
  • Relies on a Secret Key (K) known by both the server and the client.
  • Uses a Counter (C) that increments every time a new code is generated.
  • The code is generated using an HMAC function (typically with SHA-1) and a process called Dynamic Truncation (DT) to turn a large hash into a readable 6-digit number.
• TOTP (Time-based One-Time Password):
  • This is the standard for most modern apps. It is essentially HOTP, but replaces the manual counter with the current time (T).
  • Time is measured in steps (usually 30 seconds), allowing the server and phone to stay synchronized without communicating.
• Security Considerations:
  • Secret Key: If the secret key (often shared via QR code) is intercepted, an attacker can generate codes indefinitely.
  • Algorithm Integrity: Standard 2FA relies on SHA-1, which, while technically "broken" for some cryptographic uses, remains secure for the short-lived, 6-digit nature of OTPs.
• Implementation Steps: For a programmer, implementing 2FA involves:
  1. Generating and storing a unique secret key for a user.
  2. Displaying it as a QR code (Base32 encoded).
  3. Verifying the user-entered 6-digit code by running the same HOTP/TOTP algorithm on the server side.

• Core Argument: Passkeys are excellent for phishing-resistant authentication, but using them as the primary key for data encryption (via the PRF extension) creates a "disaster waiting to happen."
• The "Blast Radius" Problem: Overloading a passkey for encryption significantly increases the risk. If a user loses or deletes their passkey, they don't just lose access to an account—they permanently lose the underlying data (photos, documents, crypto wallets, etc.).
• User Misunderstanding: Most users do not realize that deleting a passkey from a manager (like Apple, Google, or Bitwarden) is equivalent to destroying the encryption key for their backed-up data.
• Recovery Failures: In scenarios where a user recovers an account via phone or email, they may successfully log in but will be unable to decrypt their history/backups without the original passkey, leading to irreversible data loss.
• Appropriate Use Cases: The PRF (Pseudo-Random Function) extension is legitimate when used for "durable" purposes, such as unlocking credential managers that have separate robust recovery mechanisms (master passwords, recovery keys).
• Call to Action for Industry:
  • Identity Industry: Stop promoting passkeys as a primary encryption tool for user data.
  • Credential Managers: Implement explicit warnings when a user attempts to delete a passkey that utilizes PRF.
  • Service Providers: If using PRF, provide clear documentation (e.g., via prfUsageDetails endpoints) and warn users during the setup process that the passkey is tied to data access.

• Problem: Users of the "Portal Pasażera" (PKP PLK's official search engine) noticed that train departure times were changing randomly upon every page refresh.
• Mechanism: The site was not displaying technical errors, but rather "poisoned data"—valid train names with completely randomized departure and arrival times.
• The "Why": This is a deliberate anti-scraping measure designed to thwart unofficial apps and bots from stealing data. Instead of blocking access (which is easy to bypass), the system serves false information to devalue the data.
• Collateral Damage: The system often misidentifies legitimate human users as bots, particularly those sharing a public IP address (e.g., via mobile networks, Starlink, or large corporate/university Wi-Fi).
• Detection: The "lottery" is triggered when the system detects a high frequency of requests from a single IP. It alters times by several minutes to over an hour.
• Risks: Passengers relying on these randomized times may miss their actual trains or wait unnecessarily long at stations, as the interface provides no warning that the data being shown is fake.
• Recommendation: To ensure accuracy, users should verify schedules via alternative sources like carrier-specific sites (e.g., intercity.pl), physical station posters, or by changing their network connection to obtain a new IP.

• The iLife A11 smart vacuum was found to constantly send detailed data, including 3D home maps, to manufacturer servers without explicit user consent.
• When the user blocked telemetry transmissions, the vacuum was remotely disabled by a command from the manufacturer, resulting in repeated failures.
• Reverse engineering revealed the device runs a Linux OS with an open root access port and includes software allowing the manufacturer to remotely control or disable it.
• Service centers temporarily restored functionality by reconnecting the device to manufacturer servers, but it failed again once telemetry was blocked.
• This hardware and practice are common in many smart vacuums from brands like Xiaomi, Wyze, and Viomi, raising broad privacy and control concerns.
• The case highlights significant security risks and loss of user autonomy inherent to many "smart" IoT devices relying on cloud connectivity.

• The article describes the case of a user (Mateusz) whose Google account was hijacked after he ran malware (a stealer) sent from a compromised friend's Discord account.
• The malware stole the user's active session cookie, not their password. This allowed the attacker to bypass all login protections, including 2-Step Verification (like a YubiKey), because they were able to take over an already-authenticated session without needing to log in.
• Using this hijacked session, the attacker convinced Mateusz to join a "Family Group" (Google Family Link) and simultaneously changed his account's birth date to an age under 13.
• This action immediately flagged the account as a "child's account," with the attacker as the "parent/guardian," which locked Mateusz out and triggered a 14-day permanent deletion process.
• Mateusz is now in a "digital Catch-22": standard account recovery forms do not work for "child accounts," and Google's support (including YouTube and Google Play) has been unhelpful, closing his tickets despite him having proof of ownership.
• The article criticizes Google for an "astounding oversight" in its business logic that allows an adult account's age to be so easily changed to a child's, creating a major vulnerability.
• As a result, Mateusz lost 13 years of data (Gmail, Drive, Contacts) and access to all his purchases on Google Play.
• The article concludes that since 2FA can't stop session hijacking, the only effective way to protect against the data loss from this specific attack is to regularly back up your Google account data using Google Takeout.

tasks done by defensive secuirty personnel

what is defensive secuirty

what is offensive security

Brief explanation why not to change Wordpress login URL

Comparison of the frequency of posting by the most popular polish cybersecurity blogs: 1. Sekurak 2. Niebezpiecznik 3. Z3S

LEARNING LESSONS FROM THE CYBER-ATTACK British Library cyber incident review 8 MARCH 2024

Dykstra, J., Shortridge, K., Met, J., & Hough, D. (2022). Sludge for Good: Slowing and Imposing Costs on Cyber Attackers. arXiv. https://doi.org/10.48550/arXiv.2211.16626

Choice architecture describes the design by which choices are presented to people. Nudges are an aspect intended to make "good" outcomes easy, such as using password meters to encourage strong passwords. Sludge, on the contrary, is friction that raises the transaction cost and is often seen as a negative to users. Turning this concept around, we propose applying sludge for positive cybersecurity outcomes by using it offensively to consume attackers' time and other resources. To date, most cyber defenses have been designed to be optimally strong and effective and prohibit or eliminate attackers as quickly as possible. Our complimentary approach is to also deploy defenses that seek to maximize the consumption of the attackers' time and other resources while causing as little damage as possible to the victim. This is consistent with zero trust and similar mindsets which assume breach. The Sludge Strategy introduces cost-imposing cyber defense by strategically deploying friction for attackers before, during, and after an attack using deception and authentic design features. We present the characteristics of effective sludge, and show a continuum from light to heavy sludge. We describe the quantitative and qualitative costs to attackers and offer practical considerations for deploying sludge in practice. Finally, we examine real-world examples of U.S. government operations to frustrate and impose cost on cyber adversaries.

Found via author post: Kelly Shortridge: "How can we waste attackers’ ti…" - Hachyderm.io

This is a literacy problem akin to a nation-wide fire hazard.

Disposable root server:

bash ssh root@segfault.net # Password is 'segfault'

Advices to set verify-full encryption for: - developers - PostgreSQL server maintainers - users - PostgreSQL tool makers - PostgreSQL creators

Table with SQL clients and their default SSL mode:

Table with programming libraires and their default SSL mode:

That's why one should use an external app to store passwords, instead of leaving them in a browser

WiFi QR code format

Send passwords via email? A bad idea!

Many companies send our passwords via email. Whether these emails come from our IT department, a colleague, a SaaS solution or elsewhere, it's not a good idea to send and receive passwords via email.

Security Best practices

Why offer an Onion Address rather than just encourage browsing-over-Tor

How to download, verify, and use gpg4win... Checking digital signatures of downloaded software...

I understand how a centralized system can be subject to DDoS, but how can a blockchain-based crypto-currency network (distributed on several identical nodes) be possibly affected by DDoS? Are we talking here of a single node being affected? Can we just remove the node and move on as is the case if there is attempt to falsify data in a specific node?

Example of scanning docker image for a log4j vulnerability

In what way can service providers have offerings that distinguish them from others?

The overlap between these areas is going to required increased communication between service providers and campus personnel, and probably helping students/faculty understand where reporting of issues needs to happen.

Why it's worth to use ad blockers & how site owners could replace this business model

5 simple steps how to spoof invite.ics files

Is it possible that FBI stores this data on us?

SHA-1 has been broken; therefore, make sure not to use it in a production based environment

Schaake, M. (2020, June 9). Ensuring Cybersecurity for Critical Civilian Infrastructure | by Marietje Schaake & Stéphane Duguin. Project Syndicate. https://www.project-syndicate.org/commentary/cybersecurity-against-attacks-on-hospitals-by-marietje-schaake-and-stephane-duguin-2020-06

Noticing a common text structure across all of the NIST guides. Another shout out to FISMA

Definition of FCI

Low = limited moderate = serious high = severe or catastrophic

FISMA outlines three objectives around security:

1. Confidentiality'
2. Integrity
3. Availability

The low, medium, and high refer what risk of potential impact would the data have in any of the three got breached.

This is similar to the C3PAO model in cmmc

Created in 2011 by the OMB in compliance with FISMA act of 2002.

System Development Life Cycle,

thing to stress requires a continuous monitoring and reporting system in place.

People will need to know the requirement to modernize federal IT

How we have to manage PII

precursor to FISMA and NIST

People will need to know the process maturity approach derived from CERT-RMM

Definition of process maturity. history of cmmc

history of cmmc, two requirements and the connection to nist-800-171

Make connection to NIST-39 and RMF

Find the FISMA act

BlackArch <--- kind of Kali Linux based on Arch Linux

Cloudflare introduces sandboxed web browsing. It's like a browser inside a browser, so we can rest assured that we won't be infected by the websites we visit

Database of Google's Dorks: Google Hacking Database

Hackers do use Wayback machine to find specific security flaws on your website

20% actions for 80% of effect to protect your API keys/passwords/SSH encrypted keys/certificates

What can be done with out passport number

What information can be found on the "Manage Booking" page inside the website code

2 ways antiviruses detect malware:

• Signature-Based Detection - based on signatures (known byte sequences) updated continuously. For example, the method deletes software immediately after it's downloaded
• Heuristic and Behavioral-Based Detection - based on malware's "behaviour" (each of its instructions)

It is important to underline that doesn't mean we have seen the surge in numbers of attacks or new malware (eg. AV test shows rather average number of new malware discovered throughout the top pandemics month comparing to last years: https://www.av-test.org/en/statistics/malware/). Instead, we are seeing new types of threats which take Covid19 as context: either specific phishing campaigns which are based on Covid19 hooks, or greater consequences of attacks against critical infrastructure like hospitals and medical centers - but also e-learning and e-commerce platforms (see the short video summary of threats: https://www.youtube.com/watch?v=XFCV_wIIEr8 ).

Castelo, M. (2020 April 15). 4 Cyberhygiene Practices for Secure Remote Learning. EdTech. edtechmagazine.com/k12/article/2020/04/4-cyberhygiene-practices-secure-remote-learning

To completely defend the CSRF attack, one needs to generate a CSRF token

Thanks to Cross-Origin Resource Sharing (CORS), Same-Origin Policy (SOP) is being relaxed and CSRF is blocked from cross-origin reads, but not from writes (so POST is still effective but attacker cannot read the response)

Cross-Site Request Forgery (CSRF) attack example: sending cookies to the origin (bank site) even when the request originates from a different origin

Nguyen, C. T., Saputra, Y. M., Van Huynh, N., Nguyen, N.-T., Khoa, T. V., Tuan, B. M., Nguyen, D. N., Hoang, D. T., Vu, T. X., Dutkiewicz, E., Chatzinotas, S., & Ottersten, B. (2020). Enabling and Emerging Technologies for Social Distancing: A Comprehensive Survey. ArXiv:2005.02816 [Physics]. http://arxiv.org/abs/2005.02816

IoT Security Compliance audit checklist must be followed by all developers working in this domain. Doing so can effectively prevent cyber attacks that have become so common.

Sounds very unlikely.

Wow, scary number!

Cybersecurity advances

Despite this deposition from two years ago, U. Md. still hasn’t updated this page.

I used to think the most fanciful thing about the movie "War Games" was not the A.I., but the defense computer connected to a public network. But if industrial control systems can be reached by the Internet or other public lines -- then maybe the government is that stupid.