My cross-platform and cross-browser NTLM bug is public:
https://issues.chromium.org/issues/40080133
Kudos to @Bitquark who reported it separately.
Kudos also to @torproject and @mozilla who did make efforts.
@zak @zenbrowser : a still unfixed vulnerability: if NOT using Touch ID, on some websites you may be able to sign in using a passkey WITHOUT authenticating locally - using biometrics or your passcode (screen unlock code).
This vulnerability also exists WITH Touch ID set up, provided that "Password Autofill" is disabled.
BTW this vulnerability also permits access to:
• https://icloud.com
• https://account.apple.com
(When asked to provide your fingerprint, tap the X at the top right and tap in the "Email" field one more time).
This is a HUGE risk for people who do not want to use biometrics: if a thief grabs their iPhone when unlocked, or watches them enter their passcode and later steals their iPhone, the thief can use ALL of the owner's passwords and some of their passkeys stored in the "Passwords" app (formerly known as iCloud Keychain).
This increases the risks of theft as shown by WSJ's Joanna Stern in https://youtube.com/watch?v=QUYODQB_2wQ.
In addition, a (grand) child or anyone else who (shortly) borrows your iPhone/iPad may have access to more of your cloud-accounts than you're aware of.
Workaround if you don't want to use biometrics to unlock your iPhone/iPad (this does not fix any problem if a thief learns (or successfully guesses) your passcode (screen unlock PIN or password):
• Set up a Touch ID anyway, for example for your left pinky finger (if you're righthanded)
• Disable "iPhone Unlock" in "Touch ID and Passcode" (visible in the first screenshot).
• Use a safer password manager (such as KeePassium) than the Apple "Passwords" app (iCloud KeyChain).
In any case:
• Make sure that "Password Autofill" (in settings -> "Touch ID and Passcode") is set to ENABLED;
• When you enter your passcode in a public place (such as a bar, bus or train), make very sure that nobody gets to see you enter it.
"[...] easy to use solutions that are at the same time private and secure. [...]"
It is easier, faster, cheaper and overall simpler to get someone setup with #XMPP + #OMEMO espechally if they don't have a #PhoneNumber and/or #ID to acquire a #SIM.
And if you go and say, "Just buy a [insert country here] [e]SIM!" and expect #TechIlliterates without a #CreditCard, #PayPal or other means of #OnlinePayment to fiddle around with some #eSIM if not having to get some #eSIMcard because they can only afford to maintain one SIM and can't spend triple-digits on a new devices then you completely missed the point!
It's not that I expect anyone to get #TechLiterate within minutes, but similar to setting up a cordless DECT phone it's something one has to do once in 5 years and just have them put the password in a safe spot to retain...
Point is that #Signal #WontFix their setup and that was evidently clear even before @Mer__edith succeeded #MoxieMarlinspike: Their entire operation has a distinct #CryptoAG stench as it's an #unsustainable #VCmoneyBurning party!
A counterexample on how this could've been done are #Tor, #eMail and other truly #OpenSource as in #MultiVendor & #MultiProvider standards.
NOTHING compells Signal to demand PII, run a #Shitcoin #Scam aka. #MobileCoin that even seasoned #TechLiterates and #CryptoBros can't setup properly, and in fact Signal using phone numbers makes it trivial to discriminate against users and easier for them to identify them!
If my reasoning didn't resonate with you, then try helping i.e. undocumented migrants aka. "#SansPapier|s" to get setup with it without violating laws and/or ToS and/or needing an imported SIM which I'm shure most folks don't have on hand!
Whereas it's trivial to get people setup on one of many XMPP servers I've personally tested!
AFAIK Signal doesn't even have an #OnionService / .onion for their Website, much less any #API enpoints to use it with!
You're free to also provide evidence and supporting data to your arguments, rather then neighsaying against proven to be more secure and reliable [by virtue of decentralization] options like XMPP+OMEMO and/or #PGP/MIME.
The proper fix is to actually assess the situation and acknowledge the risks and limitations as well as the very nature of communications, which means upgrading later is exponentially more painful, thus getting people properly setup once is way easier.
Speaking of #monocles: That business is at least #sustainable because it's funded by users (€2 p.m.) which they can pay anonymously
@Fischblog Kapitalismusfuckyeahbaby! #WorksAsDesigned #NoBug #WontFix #Closed
systemd-tmpfiles, deleting /home
@kirtai @landley And it's not as if this problem is completely new or hasn't been solved a thousand times just in the last two decades alone...
Like it's not as if Amazon doesn't literally operate one of the biggest #CDNs in the world nor doesn't know how to resume file transfers on #HTTPS (if we assume they are too lazy / incompetent / paranoid to use #IPFS and/or #BitTorrent and/or do(n't) have the files fully encrypted!)...
They decided to "#wontfix" this issue even if it hurts their users!
It is Halloween again and you are all welcome to share your systemd horror story with us! CVEs are growing every year and the wolves are howling #wontfix to the moon! https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=systemd
This seems like a local ( 
+
) & remote ( + 
+ 
Beavis - "Let's check the work ticket system. There. Heh, heh."
#XCorpTechSupport
#TicketClosed #WontFix #WorkingAsExpected ←(>▽<)ﾉ
¯\_(ツ)_/¯
@konstantin
Good principles. And it shouldn't even be a question. However, unforunately democracy is not healthy so it cannot become healthiER, and jounalists are not helping here at all. #TechSolutions #WontFix #SocialProblems
of all the things to criticize europe about this one is #wontfix
done differently 
