Exactly! AD FS is part of Tier 0 in the same way as Active Directory itself and needs to be treated and secured as such. Of course, security goes a long way when it's part of a holistic approach like zero trust.
Mitigation is also not really possible when using SSO. One way would be to require the target service to require a second factor in addition to a valid SAML token, but then each user needs to keep current its second factor, whatever it might be, in each target service. This get unmanageable quite quick not to mention that there are basically no SaaS or self-hosted applications out there that support SSO and a second factor at the same time.
Yes, Apple is supporting older devices, but has made my SE 2020 nearly unusable (slow as hell, horrible UI bugs when typing) after updating to iOS 17. Everything worked perfectly until then. It seems as though Apple wants me to buy a more expensive phone. A friend had the exact same problem and now upgraded to a newer model.
Exactly, as a user you need to be aware of this addition of risk. Anonymous OSS maintainers are the issue here. When I want to use a project and want to reduce the risk here, I need to vet the maintainers in a similar way I would vet a company I want to invest in.
I disagree with the article that server-side iterations in this case are useless. They are used for access control.
Bitwarden's API likely doesn't permit anybody to access the encrypted blobs of anybody. You have to authenticate at the server to be able to access your blob. Since the iterations might be low for producing the master key and therefore the master password hash, the server must treat the master password hash as just another password and therefore iterate the hash quite often (100,000x).
Assuming no malicious insider or an outside attacker gets their hands on the encrypted blobs this is the most important attack prevention.
And it's not possible to change/withdraw consent after allowing it. I've searched 5 minutes and found no link or widget that would get me to that screen.
A part of my work tasks consists of reviewing answers to security questionnaires.
These are reasonable questions and I see quite a lot of value if they are filled out extensively and in a good faith approach. Most of the answers of usual security questionnaires can be deduced from the responses to this DSQ.
I really have a problem with Q6:
> Have you had any security breaches in the last two years?
> If yes: please explain the breach, and provide copies of any postmortem/root cause analysis/after-action reports.
Almost nobody will answer this truthfully. I see a couple of options:
1. There was a breach and it was public, then why are you asking. Do your research!
2. There was a breach and it was not made public. The company will likely not admit it to you.
3. There was a breach but it was a) not relevant to your case/b) internal/c) the data lost was not customer data/d) we forgot that there was/etc.
While lying in case of 2. might make the vendor liable (IANAL) they might be able to argue that 3 was actually the case.
> Germany’s park visit data is further evidence that lockdown measures do not fully determine behaviour, and that people have their own motives.
I find the graphs without much meaning. I live in Germany and we didn't have a strict lockdown where you would get a fine for doing non-essential outside activity. In April cultural and fitness were closed. Therefore the only way to do something is to go outside.
The interesting thing would be to understand how many other people you were meeting with which I would think that data does not provide. I mean Google likely has that data but didn't anonymize it in order to release it.
Meeting more people than allowed and not covering your mouth and nose is something that was spot checked and still is.
A fingerprint is there to either identify you or confirm that it is you. Now, if we would allow the software to accept a smooth fingerprint as assign it to a person then this would allow anybody to impersonate that person without additional identification means. This is not a software bug, but a security feature.
Of course the software should be able to detect that there is no fingerprint and require the operator of that software to check for the identity by other means.
Sometimes we don't always have human operators and more things are automated.
> In contrast, with the Nitro System, the only interface for operators is a restricted API, making it impossible to access customer data or mutate the system in unapproved ways.
That's great but what are the approved ways? This does not prevent access to customer data. Is there and built-in audit functionality to see accesses that were approved and done/attempted? This would also need to be implemented in all levels of the stack.
This basically means that AWS closed a compliance issue through technical control at the lowest level.
> The authoritative server [of .odns] decrypts the session key with his private key, and then subsequently decrypts the requested domain with the session key.
So this basically means that the .odns operator is yet another entity that can scoop up some domain names. The one privacy advantages that I see in comparison with using Cloudflare or others as DoH providers is this:
.odns operator can only group the domains that they see to a resolver of the ISP of the user. Cloudflare could group domains by IP address of the user.
It does, but only to google domains and only in non-incognito mode. If you're still paranoid and clear your cookies after you close Chrome, you can add a commandline option to Chrome so that this UUID is randomized on each start of Chrome.
Mitigation is also not really possible when using SSO. One way would be to require the target service to require a second factor in addition to a valid SAML token, but then each user needs to keep current its second factor, whatever it might be, in each target service. This get unmanageable quite quick not to mention that there are basically no SaaS or self-hosted applications out there that support SSO and a second factor at the same time.