Code Wrangler @haveibeenpwned, former Microsoft MVP, @dotnetfdn member, @stebets@infosec.exchange.
Reykjavík, Iceland
Joined February 2009
- Tweets15.6K
- Following1.4K
- Followers2.3K
- Likes9.7K
Pinned Tweet
It’s official now. I’ll be joining @troyhunt and @Charlotte_Hunt_ later this summer, working full time for @haveibeenpwned!Really excited about this awesome opportunity and I’m very much looking forward to it! 🥳
Massive day for @Charlotte_Hunt_ and I today as we welcome our first ever *proper* @haveibeenpwned employee: @stebets troyhunt.com/have-i-been-pwn…
Here they come….
If passkeys have people this upset, wait until they hear about DBSC 🤣
Your session is hardware bound to your device...
Somewhere, a cookie just found out it can be device-bound 🍪🔐
scotthelme.co.uk/device-boun…
The original article jumps to some conclusions and frankly has potentially unsafe and dangerous recommendations. @Scott_Helme dives into the details.
Quite a few people have sent me the "Passkeys are a trap. Do not use them." post on Substack.
The post recommends people abandon passkeys and stick to passwords + TOTP, citing what appears to be concerns with attestation as the primary reason.
I’ve written a rebuttal as this is really dangerous advice and it's based on some incorrect technical claims.
scotthelme.co.uk/passkeys-ar…
Stefán Jökull Sigurðarson retweeted
Quite a few people have sent me the "Passkeys are a trap. Do not use them." post on Substack.
The post recommends people abandon passkeys and stick to passwords + TOTP, citing what appears to be concerns with attestation as the primary reason.
I’ve written a rebuttal as this is really dangerous advice and it's based on some incorrect technical claims.
scotthelme.co.uk/passkeys-ar…
Stefán Jökull Sigurðarson retweeted
If only they’d checked first 🤔
'Wachtwoord 123456 leidde tot datalek met gegevens van 8,8 miljoen Denen' #securitynl security.nl/posting/957023/%…
Maybe he wanted a more optimal tool for his use-case. Maybe he wasn’t happy with the performance of the other tools? Maybe he thought their design sucked. There are multiple reasons why someone might want to write their own version.
Also, he had to prompt it with details.
Stefán Jökull Sigurðarson retweeted
If you complete this reCAPTCHA, you're absolutely screwed 😬
One suspicious domain led us to 2,000+ compromised WordPress sites, a fake reCAPTCHA lure and a macOS infostealer targeting crypto wallets, browser cookies and Keychain data.
We traced the campaign to sanctioned Russian infrastructure and published the IOCs:
blog.report-uri.com/chasing-…
C#/.NET being pushed hard running infrastructure at Ethereum's scale.
Nethermind runs on ~3k nodes and accounts for ~33% of staked nodes - supporting a ~$334B native asset, ~$146B of stablecoins and ~$54B deposited in DeFi apps.
Nethermind 2.0 has some amazing performance work in it: up to 2.55x block throughput, p99 block processing from 1.65s to 208ms, eth_call RPC 15-27% faster and Keccak-256 ~30% faster with platform intrinsics.
Stefán Jökull Sigurðarson retweeted
Does @haveibeenpwned have a friend at @OpenAI? We’re struggling to get our MCP server into their plugin store and the reasons why are super vague. Getting it into Claude was a breeze, it shouldn’t be this hard.
And on that note. @HilmarVeigar has written this excellent blog post on the Python 3 upgrade and some history on where the journey with Python all began. Love reading stuff like this :) CC: @ThePrimeagen
linkedin.com/pulse/eve-onlin…
EVE Online didn't run on your standard Python before (it ran Stackless Python) which makes this upgrade even more impressive. @kristjanvalur has a lot of backstory here and @ccp_chimichanga can go into more dirty details if you want. It's a pretty cool story b.t.w.
Wait… why couldn’t this have happened on @X? Then I would at least have got some money from all these followers…
Stefán Jökull Sigurðarson retweeted
They exposed data on 8.8 million people with no exploit, no malware, and no access to MAG’s servers.
Three server-side API keys sat in public JavaScript for 4+ years and FulcrumSec found them. They could have modified and deleted data too.
I verified how the Manchester Airports Group breach happened:
scotthelme.co.uk/no-hacking-…
All these anti-AI people are simply going to get left behind as AI becomes more capable.
The developer of Paint dot Net (@rickbrewPDN) posted, on BlueSky, that he used Claude to develop (vibe code) a clean room, reverse engineered implementation of Direct2D (resulting in a version of PaintDotNet that can run on Linux under Wine, something many users want).
BlueSky users quickly went on the attack. Often in profane, vulgar ways. Because using AI is verboten among certain demographics.
Prompting the PaintDotNet dev to delete his BlueSky post, and publish the following:
“Alright everyone, message received. I was not expecting this response, I honestly had no idea before I made the post
Like I said, the code is experimental. A proof of concept showing that PDN-on-WINE is possible. It's not finished. I can literally just delete it. It won't be part of the next build.”
Stefán Jökull Sigurðarson retweeted
This is a very convincing ClickFix lure that's impersonating the Cloudflare 'Human Verification' process.
We've been tracking this operator mostly through their Magecart campaign, but they're dual-purposing their infrastructure and also serving a ClickFix attack on non-ecommerce sites.
Full details and IoC list: blog.report-uri.com/one-load…
Stefán Jökull Sigurðarson retweeted
Starlink Mini keeps you connected to high-speed internet on the go 🛰️❤️
I’ve got a @Starlink Mini on the pano roof for our Euro road trip! 📡🛰️
Awesome roads, great food, beautiful views, fast WiFi. What more could a nerd want?! 😎
Not directly Omarchy related, but after listening to @dhh second interview with @lexfridman I was inspired to see if GitHub Copilot could just write me a FanControl plugin for my non-supported Lenovo X1 Carbon Gen 4 (on Windows). It did and it worked! It figured out…
And it did all this in about 30 minutes, including installing the plugin into FanControl and updating when required. A magical AI experience when I think about it.