Post

How to get URL link on X (Twitter) App

On the Twitter thread, click on or icon on the bottom
Click again on or Share Via icon
Click on Copy Link to Tweet
Paste it above and click "Unroll Thread"!
More info at Twitter Help

John Opdenakker

May 7, 2020 • 12 tweets • 9 min read • Read on X

I just noticed that today is #WorldPasswordDay. One of my favorite security topics. And whatever people wish or say passwords are here to stay for many more years to comes. Here's a thread with some blogs about passwords I've written that you might find interesting.

#Infosec

How to create strong passwords:

johnopdenakker.com/how-to-create-…

#WorldPasswordDay #Infosec

Why length matters, also when it comes to passwords...
johnopdenakker.com/secure-passwor…

#WorldPasswordDay #Infosec

When to change your password?

johnopdenakker.com/when-its-time-…

#WorldPasswordDay #Infosec

And why forcing regularly password changes is a security antipattern...

johnopdenakker.com/the-non-sense-…

#WorldPasswordDay #Infosec

Why Password reuse is a bad idea:

johnopdenakker.com/no-excuse-for-…

#WorldPasswordDay #Infosec

About credential stuffing attacks:

johnopdenakker.com/how-to-defend-…

#WorldPasswordDay #Infosec

Why MFA matters and some pitfalls:
johnopdenakker.com/better-account…
johnopdenakker.com/enable-2fa-don…

#WorldPasswordDay #Infosec

About the answers to security questions which should be treated as passwords:

johnopdenakker.com/how-to-answer-…

#WorldPasswordDay #Infosec

About how to monitor data breach exposure:

johnopdenakker.com/how-to-monitor…

#WorldPasswordDay #Infosec

About making sure your passwords are available for your loved ones when you're dead
johnopdenakker.com/make-sure-love…

#WorldPasswordDay #Infosec

https://twitter.com/j_opdenakker/status/1258292245746327552?s=20

I've also written several blogs about password managers. You can find some of them here:

https://twitter.com/j_opdenakker/status/1258292245746327552?s=20

or via johnopdenakker.com/tag/password%2…

#WorldPasswordDay #Infosec

• • •

Missing some Tweet in this thread? You can try to force a refresh

This Thread may be Removed Anytime!

Twitter may remove this content at anytime! Save it as PDF for later use!

More from @j_opdenakker

John Opdenakker

@j_opdenakker

Mar 29, 2021

Interesting research by Trinity College Dublin about which data iOS (on iPhone) and Android (on Pixel) send to Apple and Google.

Even idle devices share telemetry data (also when user explicitely opted out) with Apple/Google on average every 4.5 mins.

scss.tcd.ie/doug.leith/app…

"phone IMEI, hardware serial number, SIM serial number and IMSI, handset phone number etc are shared with Apple and Google."

"iOS sends the MAC addresses of nearby devices, e.g. other handsets and the home gateway, to Apple together with their GPS location."

"Google collects around 20 times more handset data
than Apple"

Read 4 tweets

John Opdenakker

@j_opdenakker

Aug 7, 2020

https://twitter.com/BeeFaauBee09/status/1291687117891014656

Well, let me elaborate a bit on this one. Pentests are only one of the crucial parts of a secure software development lifecycle. I like to think about it as the ultimate quality gate. a short thread

#infosec

https://twitter.com/BeeFaauBee09/status/1291687117891014656

If a pentest is the only security test you do that's still much better than nothing. It can result in a lot of high vulnerabilities to fix and fixing them for sure will improve the security of your applications. While your developers will (have to) learn how to fix these issues..

and improve their secure coding skills you should go a lot further. Ensure the dev teams threat model applications, train them if necessary. A secure application starts with a secure architecture. Added benefit of threat modeling with your team is mutual understanding of the app

Read 8 tweets

John Opdenakker

@j_opdenakker

Aug 3, 2020

A thread with observations about #infosec professionals on Twitter. Probably won't make friends by saying this but anyway...
- A lot of infosec professionals live in utopia and are so far disconnected from avg users' reality
- Still SO MUCH user blaming instead of helping

- A lot give recommendations without having or taking into account the full picture. Ex: yes password cracking is a concern but there are other password related risks you should also be concerned about. Can't take into account what you don't know but please be open to learn.

- A lot fail/refuse to talk the language of the avg user. Failing is not the problem, but at least try. Come from your cloud and speak human language.

Ex: "just use MFA"
1) Avg user doesn't know what MFA is
2) For them it's not simple to use
3) Not available for all services

Read 7 tweets

John Opdenakker

@j_opdenakker

Jul 3, 2020

https://twitter.com/j_opdenakker/status/1278746946019168272

A thread (rant) about this article and why telling people how to delay/block automatic updates is just a shit thing to do. It already starts with the title: "How to Block Windows 10 Updates for As Long As You Want".

#infosec

https://twitter.com/j_opdenakker/status/1278746946019168272

There's a very good reason why Windows and other vendors foresee auto-update features. To protect people that otherwise would never patch. This article is also read by average non-tech/security aware users, most of them don't understand the security risks and even if they do...

they're most likely not able to properly assess their own threat model and base their conclusion on existing threat intelligence. So things like recommending apps to circumvent the maximum delay of patching (which is already a poor advice for non tech/security savvy users) is bad

Read 6 tweets