decrypt[.]fail

#decentralization

In the last couple of months I have spent a good amount of time reading, trying out, and thinking about decentralized social networks on the Internet. This post summarizes my understanding of the three different types I have come across.

#infosec

Key Performance Indicators (KPI) are what people in business generally use to measure the performance of a business function or team. In the Cybersecurity world we are blessed (or cursed) with plenty of KPIs. And even in the cyber sub-section of phishing we still have a lot of metrics that email security vendors force on us – Here are some examples:

• Number of hard spoof emails blocked
• Number of soft spoof emails blocked
• Number of phishing emails quarantined
• Number of malicious attachments quarantined
• Number of phishing URLs blocked
• Number of phishing emails reported by users
• Number of phishing test failures

Now, let's take a step back! Does any of the above metrics make any sense to a normal (non cyber) person? And who is giving you your cyber budget again..?

#infosec

Over the last couple of years there have been numerous debates on whether it is a good idea to get rid of password expiration. The arguments against password expiration are usually variations of the below:

Forcing users to change their passwords on a regular basis leads to widespread use of weak passwords. Frequent password changes in many systems lead to password re-use (aka user is using the same password everywhere) Putting the burden of security on the user is wrong, technology should do the heavy lifting. What is interesting about most of the conversations I read, is that they seem to ignore all the other password improvements that the advocates for getting rid of password expiration usually cite – When you get rid of password expiration, you are supposed to also do the following:

A. Improve password length significantly (switch from passwords to pass phrases)

B. Get rid of some password complexity requirements (Special characters are really hard to remember!)

C. Introduce a Password Blacklist (e.g. block the word 'password' or its variations like 'p4ssw0rd')

D. Monitor your user accounts for leaked credentials and force password changes once you detect a leaked credential!

Now, A,B,C are really easy to deliver – You can just install and configure some tech, which will do the job for you. It is pretty much a set and forget kind of thing to implement. However, D is a completely different beast – See the paragraphs below.

#decentralization

I have recently built a new Mastodon instance to create an additional home for InfoSec professionals on the Fediverse. Being a new Mastodon admin, I was evaluating the different ways to get more content on the Federation Timeline. This post summarizes my experience, findings, thoughts, and possible feature requests.