Share this page!

Enter URL or ID to Unroll

You can paste full URL like: https://x.com/threadreaderapp/status/1644127596119195649
or just the ID like: 1644127596119195649

How to get URL link on X (Twitter) App

  1. On the Twitter thread, click on or icon on the bottom
  2. Click again on or Share Via icon
  3. Click on Copy Link to Tweet
  4. Paste it above and click "Unroll Thread"!
  5. More info at Twitter Help
John Opdenakker Profile picture
@j_opdenakker
May 7, 2020 • 12 tweets • 9 min read • Read on X
I just noticed that today is #WorldPasswordDay. One of my favorite security topics. And whatever people wish or say passwords are here to stay for many more years to comes. Here's a thread with some blogs about passwords I've written that you might find interesting.

#Infosec
How to create strong passwords:

johnopdenakker.com/how-to-create-…

#WorldPasswordDay #Infosec
Why length matters, also when it comes to passwords...
johnopdenakker.com/secure-passwor…

#WorldPasswordDay #Infosec
When to change your password?

johnopdenakker.com/when-its-time-…

#WorldPasswordDay #Infosec
And why forcing regularly password changes is a security antipattern...

johnopdenakker.com/the-non-sense-…

#WorldPasswordDay #Infosec
Why Password reuse is a bad idea:

johnopdenakker.com/no-excuse-for-…

#WorldPasswordDay #Infosec
About credential stuffing attacks:

johnopdenakker.com/how-to-defend-…

#WorldPasswordDay #Infosec
Why MFA matters and some pitfalls:
johnopdenakker.com/better-account…
johnopdenakker.com/enable-2fa-don…

#WorldPasswordDay #Infosec
About the answers to security questions which should be treated as passwords:

johnopdenakker.com/how-to-answer-…

#WorldPasswordDay #Infosec
About how to monitor data breach exposure:

johnopdenakker.com/how-to-monitor…

#WorldPasswordDay #Infosec
About making sure your passwords are available for your loved ones when you're dead
johnopdenakker.com/make-sure-love…

#WorldPasswordDay #Infosec
I've also written several blogs about password managers. You can find some of them here: or via johnopdenakker.com/tag/password%2…

#WorldPasswordDay #Infosec

• • •

Missing some Tweet in this thread? You can try to force a refresh
　

Keep Current with John Opdenakker

John Opdenakker Profile picture

Stay in touch and get notified when new unrolls are available from this author!

Read all threads

This Thread may be Removed Anytime!

PDF

Twitter may remove this content at anytime! Save it as PDF for later use!

Try unrolling a thread yourself!

how to unroll video
  1. Follow @ThreadReaderApp to mention us!

  2. From a Twitter thread mention us with a keyword "unroll"
@threadreaderapp unroll

Practice here first or read more on our help page!

More from @j_opdenakker

John Opdenakker Profile picture
Mar 29, 2021
Interesting research by Trinity College Dublin about which data iOS (on iPhone) and Android (on Pixel) send to Apple and Google.

Even idle devices share telemetry data (also when user explicitely opted out) with Apple/Google on average every 4.5 mins.

scss.tcd.ie/doug.leith/app…
"phone IMEI, hardware serial number, SIM serial number and IMSI, handset phone number etc are shared with Apple and Google."

"iOS sends the MAC addresses of nearby devices, e.g. other handsets and the home gateway, to Apple together with their GPS location."
"Google collects around 20 times more handset data
than Apple"
Read 4 tweets
John Opdenakker Profile picture
Aug 7, 2020
Well, let me elaborate a bit on this one. Pentests are only one of the crucial parts of a secure software development lifecycle. I like to think about it as the ultimate quality gate. a short thread

#infosec
If a pentest is the only security test you do that's still much better than nothing. It can result in a lot of high vulnerabilities to fix and fixing them for sure will improve the security of your applications. While your developers will (have to) learn how to fix these issues..
and improve their secure coding skills you should go a lot further. Ensure the dev teams threat model applications, train them if necessary. A secure application starts with a secure architecture. Added benefit of threat modeling with your team is mutual understanding of the app
Read 8 tweets
John Opdenakker Profile picture
Aug 3, 2020
A thread with observations about #infosec professionals on Twitter. Probably won't make friends by saying this but anyway...
- A lot of infosec professionals live in utopia and are so far disconnected from avg users' reality
- Still SO MUCH user blaming instead of helping
- A lot give recommendations without having or taking into account the full picture. Ex: yes password cracking is a concern but there are other password related risks you should also be concerned about. Can't take into account what you don't know but please be open to learn.
- A lot fail/refuse to talk the language of the avg user. Failing is not the problem, but at least try. Come from your cloud and speak human language.

Ex: "just use MFA"
1) Avg user doesn't know what MFA is
2) For them it's not simple to use
3) Not available for all services
Read 7 tweets
John Opdenakker Profile picture
Jul 3, 2020
A thread (rant) about this article and why telling people how to delay/block automatic updates is just a shit thing to do. It already starts with the title: "How to Block Windows 10 Updates for As Long As You Want".

#infosec
There's a very good reason why Windows and other vendors foresee auto-update features. To protect people that otherwise would never patch. This article is also read by average non-tech/security aware users, most of them don't understand the security risks and even if they do...
they're most likely not able to properly assess their own threat model and base their conclusion on existing threat intelligence. So things like recommending apps to circumvent the maximum delay of patching (which is already a poor advice for non tech/security savvy users) is bad Image
Read 6 tweets
John Opdenakker Profile picture
Jun 28, 2020
So for the newcomers in #infosec a thread with some useful resources and people that are worth following in my opinion.
Check out my blog. I haven't been active recently but for instance last year I did a series for cybersecurity awareness month (October)
For people into appsec in particular, here's a blog with application security resources. johnopdenakker.com/some-useful-ap…
Read 9 tweets
John Opdenakker Profile picture
Jun 21, 2020
Trying to reach TUI is harder than explaining how to use 2fa to a non techie
25 minutes in wait already and counting
39 minutes and counting.
Read 4 tweets

Did Thread Reader help you today?

Support us! We are indie developers!

This site is made by just two indie developers on a laptop doing marketing, support and development! Read more about the story.

Become a Premium Member ($3/month or $30/year) and get exclusive features!

Become Premium

Don't want to be a Premium member but still want to support us?

Make a small donation by buying us coffee ($5) or help with server cost ($10)

Donate via Paypal

Or Donate anonymously using crypto!

Ethereum

0xfe58350B80634f60Fa6Dc149a72b4DFbc17D341E copy

Bitcoin

3ATGMxNzCUFzxpMCHL5sWSt4DVtS8UqXpi copy

Thank you for your support!

Follow Us!

Send Email!

:(