Profile picture
Alec Muffett @AlecMuffett
, 4 tweets, 2 min read Read on Twitter
Facebook upgrading third party HTTP links, to HTTPS, across the site! Well done! facebook.com/notes/protect-…
Quote: «We have recently upgraded our link security infrastructure to include HSTS preloading, which automatically upgrades HTTP links to HTTPS for eligible websites. This will improve people's security and will also often improve the speed of navigation to sites from Facebook.»
It would be an interesting academic exercise to cross-reference this mechanism against the crowdsourced (and slightly hairy/flaky) HTTPS-Everywhere list from the likes of @EFF :-
Major props to @JonMillican for this work! :-)
Missing some Tweet in this thread?
You can try to force a refresh.

Like this thread? Get email updates or save it to PDF!

Subscribe to Alec Muffett
Profile picture

Get real-time email alerts when new unrolls are available from this author!

This content may be removed anytime!

Twitter may remove this content at anytime, convert it as a PDF, save and print for later use!

Try unrolling a thread yourself!

how to unroll video

1) Follow Thread Reader App on Twitter so you can easily mention us!

2) Go to a Twitter thread (series of Tweets by the same owner) and mention us with a keyword "unroll" @threadreaderapp unroll

You can practice here first or read more on our help page!

More from @AlecMuffett see all

Profile picture
justsecurity.org/62114/give-gho…
1/ Applying this idea to WhatsApp, it would mean that—upon receiving a court order—the company would be required to convert a 1-on-1 conversation into a group chat, with the government as the third member of the chat. But that’s not all.
2/ In WhatsApp’s UX, users can verify the security of a conversation by comparing “security codes” within the app. So for the ghost to work, there would have to be a way of forcing both users’ clients to lie to them by showing a falsified security code, ...
Read 39 tweets
Profile picture
THREAD: QUESTION FOR ALL SECURITY PEOPLE — in this day and age, would you buy a single-vendor IT security solution which advertised itself as "the gold standard" for data security protection?

Would you give that claim any credence whatsoever?
The infosec world has a long-established term for such glib claims: "Snake Oil" - this terminology goes back to the 1990s or earlier, for vendors who were selling sub-par cryptography as "military-grade" or other supposed but meaningless description interhack.net/people/cmcurti…
Particularly telling for "Snake Oil" are the words and phrases that are used to describe the security solution, process, or tool, its development, mechanism, or vendor:

* "Trust Us, We Know What We're Doing"
* "Unbreakability"
* "Military Grade"

interhack.net/people/cmcurti…
Read 27 tweets
Profile picture
@breenemachine @alexstamos 1/ Well, I've been doing this stuff to 30 years and still learn every day/week; that said, the generalities are several thousand years old and after a while you will see the same issues coming up in new clothes. But you can read around the topic in your own time. […]
@breenemachine @alexstamos 2/ Maybe half of the people I have worked with in infosec have been CS students. There is no barrier to entry. I have worked with chemists, physicists (me = astronomer), med students, linguists, performing arts students, english lit majors, and some have have no college degree.
@breenemachine @alexstamos 3/ There are 2x main paths to learning: 1 is to seek formal education - cyber-this, ethical-hacking-that - and it's fine. You'll learn, but if you only learn "security stuff" then you'll be a pentester, and I love pentesters but lord, we have enough already.
Read 17 tweets

Related threads

Profile picture
001/ [article content in this tweet series 001-180 reproduced with permission from Martin Howe QC of Lawyers for Britain @lawyers4britain]
#quote "Leaving the EU on WTO terms: pulling down the barriers to world trade
Introduction: why prices will FALL after Brexit, not rise" /002
002/ #quote "Over the past couple of weeks, the media have been full of lurid scare stories about what will happen if the UK leaves the EU on WTO terms, because negotiations with the EU do not result in a withdrawal agreement." /003
#tariffs #NoDeal #Brexit #WTO #ProjectFear #shortages #food #medicines
003/ #quote "One of the most ridiculous and UNJUSTIFIED of these absurd scare stories is that it will lead to higher prices, and even shortages, of foods and medicines." /004
Read 180 tweets
Profile picture
1/ I’m in Vilnius this week. Here’s an attempt to connect a couple dots from observations and conversations. Bear with me. Want to paint the human side of this story. #Facebook
2/ Just met a 40-year old father of 2 from Venezuela. We’ll call him John. John studied chemical engineering
3/ John’s grand parents were from Lithuania and fled the country in 1944 when the Soviet occupation began. en.wikipedia.org/wiki/Soviet_oc…
Read 23 tweets
Profile picture
Tweet storm on how India has built a worse manipulation engine for elections than Cambridge Analytica
When #Facebook allowed third parties to colonise your relationship with them, they corrupted the purpose for which you and Facebook came together medium.com/@anupamsaraph/…
One such third party, Cambridge Analytica, corrupted your relationship with your government by destroying your right to free choice motherjones.com/politics/2017/…
Read 15 tweets
Profile picture
Facebook Is One Hot Mess — an ever increasing number of Facebook users are being coerced to install intrusive "anti-malware" software on their computers. Bugs in what is a mandatory install for many results in a #SoftBan. Those are the lucky ones.
⤵️#ahemCyberSec
⤴️FB One Hot Mess
— Facebook previously offering #MalwareScanner as a voluntary service didn't warrant much discussion. Their move to make it mandatory requires examining their claim to need this intrusive access to people's systems. The claim is ridiculous.
⤵️#ahemCyberSec
⤴️FB Malware=Links to malware
— certainly Facebook has a duty to protect it's service from people posting links to malware, but that responsibility begins & ends @ the point they receive & process a post. They claim a magical ability to detect "signals"..
⤵️#ahemCyberSec
Read 11 tweets
Profile picture
OK so here's an opinion I'm going to issue in re: programming. hello
A tremendously popular piece of advice is "look at other peoples software to help you learn how to code" but the way modern code works, you can't do that.
Let me explain: If you wanted to figure out how, say, Doom worked, the source code is NOT HARD. There's. Like. v_game.c, and you can open it and read it and there's code that does something.
Read 38 tweets

Trending hashtags

#healthcare #German #Zuckerbergtestimony #EdouardPhilippe #ppc2019 #veterinary #Ross #Russia #RiseAbove #Castaner #VotingRightsActs #domestic #DivisivePolitics #celiac #LesBarbouzesDeManuLaMatraque #YaelBraunPivetDemission #Facebook #IndependenceDay #DeutscheBank #Rybolovlev #cdnpoli #TrumpRussia #countries #bikeATL #StéphaneFratacci

Did Thread Reader help you today?

Support us! We are indie developers!

This site is made by just three indie developers on a laptop doing marketing, support and development! Read more about the story.

Become a Premium Member and get exclusive features!

Premium member ($3.00/month or $30.00/year)

Too expensive? Make a small donation by buying us coffee ($5) or help with server cost ($10)

Donate via Paypal Become our Patreon

Thank you for your support!