Profile picture
Jan Schaumann @jschauma
, 3 tweets, 2 min read Read on Twitter
Google to deprecate TLS 1.0 and 1.1 in Chrome, going to users in 01/2020: security.googleblog.com/2018/10/modern…
Mozilla has a similar timeframe for deprecating TLS 1.0 and 1.1: blog.mozilla.org/security/2018/…

So yeah, you can get started on turning those off, too.
Stick a fork in it, it's done: both Apple and Microsoft also announced the deprecation of TLS 1.0 and 1.1 in Webkit and Internet Explorer and Edge: webkit.org/blog/8462/depr… blogs.windows.com/msedgedev/2018…

(Well, except for all the unpatchable IoT devices you need to support... :-/ )
Missing some Tweet in this thread?
You can try to force a refresh.

Like this thread? Get email updates or save it to PDF!

Subscribe to Jan Schaumann
Profile picture

Get real-time email alerts when new unrolls are available from this author!

This content may be removed anytime!

Twitter may remove this content at anytime, convert it as a PDF, save and print for later use!

Try unrolling a thread yourself!

how to unroll video

1) Follow Thread Reader App on Twitter so you can easily mention us!

2) Go to a Twitter thread (series of Tweets by the same owner) and mention us with a keyword "unroll" @threadreaderapp unroll

You can practice here first or read more on our help page!

More from @jschauma see all

Profile picture
I kinda feel like there's an #infosec equivalent to Brooks's Law: hiring more infosec people does not make an organization (or project) more secure. Likewise, mirroring complexity, I think we have accidental as well as essential insecurity.
We often measure #infosec team success or impact via navel gazing: how many vulnerabilities we identified, how many open ports we found, how many AWS tokens we found in git.
The remedies? Build more tools to detect more stuff, deploy more agents, create more dashboards, tickets, metrics. All that requires more people, so our headcount requests go up.
Read 11 tweets
Profile picture
Secure co-tenancy in VM hosting is a myth. Arbitrary host RAM leak via speculative side channel: xenbits.xen.org/xsa/advisory-2… intel.com/content/www/us… CVE-2018-3615 CVE-2018-3620
RedHat has a good write-up on this L1TF vulnerability: access.redhat.com/security/vulne…

Apparently aka “Foreshadow”, because branded vuln: foreshadowattack.eu
Additional #foreshadow / #L1TF links:
Wired: wired.com/story/foreshad…
Intel: newsroom.intel.com/editorials/pro…
MS Azure: docs.microsoft.com/en-us/azure/vi…
Google Cloud: cloud.google.com/blog/products/…
VMWare: blogs.vmware.com/security/2018/…
Microsoft: blogs.technet.microsoft.com/srd/2018/08/14…
Read 3 tweets
Profile picture
So other than following up on shit that should have been done but wasn't, sifting through miles of forwarded emails (all with full quote below a statement saying "my comments in red” or “+cindy”), and cursing Slack "threads", I spend a good chunk of my day juggling Jira tickets.
So much of our work is ticket driven, yet many of us seem to lack basic best practices and habits that could make our (ok: my) life a lot easier. So let me present a quick primer:

Essential Ticket Skills - just because Jira sucks doesn't mean you have to!
(Note: most of this applies equally to Bugzilla, GNATS, or whatever bugtracking software; I just happen to use Jira at the moment, so that's what my examples are based on.

And don't you fucking start with Trello or sticky notes and "swimlanes". Those can fuck right off here.)
Read 24 tweets

Related threads

Profile picture
BREAKING: Potential hijack underway. ThousandEyes detected intermittent availability issues to Google services from some locations. Traffic to certain Google destinations appears to be routed through an ISP in Russia & black-holed at a China Telecom gateway router.
This is a developing story. Stay tuned for additional analysis. #google #hijack
ThousandEyes BGP Route Visualization shows the 216.58.192.0/19 prefix being leaked into the Internet, which would cause traffic to #Google to be routed via networks in #Russia, #China and #Nigeria
Read 9 tweets
Profile picture
Massive ad fraud scheme on Android exposed by @CraigSilverman who unraveled an intricate web of shell cos found using sophisticated techniques to evade detection like recording humans on apps for bots to mimic, stealing vast amounts of mobile ad dollars. buzzfeed.com/craigsilverman…
This new adfraudbot that records humans using apps to evade detection defrauded Google’s own ad network of ~$10,000,000 security.googleblog.com/2018/10/google…
“It’s clear to us that the people orchestrating this scheme are both familiar with the ad tech industry and with the mainstream data science approach to detecting ad fraud”

Fraudsters quake when @CraigSilverman breaks another long term investigation. buzzfeednews.com/article/craigs…
Read 4 tweets
Profile picture
141. A la hora del montoneo fashionista jashtaguero, resulta que todos son fulanita o fulanito; hasta el perro son. Pero cuando toca revisar el nivel de responsabilidad personal en el crimen de la #PederastiaEclesiástica, no hay quien se apunte con el #TodosSomosCómplices
142. aciprensa.com/noticias/papa-…

⬇️
143. #Bergoglio da consejos de qué hacer con un hijo homosexual; sin embargo este "Padre espiritual" está atiborrado de hijos espirituales homosexuales -curas-, a los que les solapa sus abusos en contra de seminaristas:

Todo está claro en el enlace del tuit 135 de este hilo.
Read 681 tweets
Profile picture
1) "CLEAN GMAIL"

My theory about why #PeterStrzok sent #LisaPage this text message.

It connects a #Qanon post to Google & plot to frame @POTUS for collision, and may provide insight into how #NSA has the info.

#QAnon #WWG1WGA @POTUS #GreatAwakenening #redpill #ReleaseTheTexts
2) Yesterday's #Q post exposes the use of the #Gmail draft communication trick, whereby you share an account with other(s) and instead of sending email, you save it as a draft for the other person(s) to read.

#QAnon #WWG1WGA @POTUS #GreatAwakenening #redpill #ReleaseTheTexts
3) This was made famous by former #CIA director General Patreaus & mistress. Which was a head scratcher. Why would #PeterStrzok & #LisaPage (+others) use same technique Patreaus was busted using?

#QAnon #WWG1WGA @POTUS #GreatAwakenening #ReleaseTheTexts

washingtonpost.com/news/worldview…
Read 14 tweets
Profile picture
I’ll be tweeting about some post-quantum crypto things as the come up this week in this thread.
LEDAkem is a code-based crypto primitive for key encapsulation based on quasi-cyclic low-density parity-check codes (QC-LDPC). Large-ish keys (7KB+), slow (100ms+), but compact private keys, only simple binary field math and based on NP-complete problem. ledacrypt.org
Learning Parity with Noise (LPN) is a problem used in code-based crypto. A new algorithm to decode linear codes with many errors was introduced that reduces the security level of some LPN schemes. Key idea is the use of the nearest neighbor search. eprint.iacr.org/2017/1139.pdf
Read 41 tweets
Profile picture
1. Apparently I don't know how to thread, so here goes my second attempt at blasting you with critical news on this "Intel Chip problem" which is not an Intel problem but an entire chipmaker design problem that affects virtually all processors on the market.
2. Christmas didn't come for the computer security industry this year. A critical design flaw in virtually all microprocessors allows attackers to dump the entire memory contents off of a machine/mobile device/PC/cloud server etc.
3. Our story on the motherlode of all vulnerabilities just posted here: nytimes.com/2018/01/03/bus… More will be post soon.
Read 19 tweets

Trending hashtags

#BlueHairedLawyer #IDW #NoOneWhoSpeaksGermanCouldBeAnEvilMan #Recap #Chosen #Lost #Happy #HomersPhobia #Durham #Devcon4 #interference #JosephZen #ThisJS #Honduras #SupriseEvidence #Montanari #MP #unfair #Ramsey #Ossandón #SeminaristasAbusados #Concilios #CiudadGótica #TwitterProtegePederastas #NickPark

Did Thread Reader help you today?

Support us! We are indie developers!

This site is made by just three indie developers on a laptop doing marketing, support and development! Read more about the story.

Become a Premium Member and get exclusive features!

Premium member ($30.00/year)

Too expensive? Make a small donation by buying us coffee ($5) or help with server cost ($10)

Donate via Paypal Become our Patreon

Thank you for your support!