🎉🎉 PHP 7.3 is here!

Here are the things I'm excited about.

Just published 15,000+ words on security keys. 🔐📱💻

With SIM attacks at their highest, now is a great time to take a closer look at your online security.

Removing SMS from your two-factor auth is a start, but authenticator apps have downsides too...

https://t.co/Dk0MPJHL2V

Just look at these headlines from recent SIM swap and port attacks.

It's all too established for attackers to find ways to socially engineer control of your phone number and start gaining control of your accounts.

I first talk about some general security tips.

Unfortunately not all websites let you remove your phone number from accounts.

You may consider migrating your phone carrier to @googlefi , which requires email account access to do anything (and can be locked down with security keys and even Advanced Protection)

Beyond SMS, I talk about issues that TOTP authenticator apps (the code generators) have as a form of two-factor auth. They're so, so much better than relying on SMS for your second factor but they still have issues like utilizing shared secrets and lacking phishing prevention.

Enter security keys!

Utilizing public key cryptography they don't have any shared secret between the client and the server. They prevent phishing by taking the website domain into account.

Even if you get tricked by a clone phishing website, your key won't.

Singing the Blues:
Taking Down an Insider Threat

"I had all of the advantages. I was already inside the network. No one suspected me. But they found my hack, kicked me off the network...

...and physically hunted me down."

Many pentests start from the outside, wanting to see how the perimeter might be breached.

This pentest started from the inside. My client wanted to assume they had already been breached, and, if breached, how far could an attacker go.

Could they stop me once I was inside?

So they snuck me in. Disguised me as a new employee. Gave me a work computer, an ID badge, an account in their system... hell, I even had a cubicle w/my assumed name on it.

The only person who knew who I really was was their CISO. Everyone else thought I was Jeremy in Marketing.

During most of the first morning, I completed onboarding, made introductions, and completed menial tasks.

But I had to act quick. I only had a week onsite. I had to hack their network while not raising suspicion.

So I set about it.

You have to understand... most "Internal Pentests" are straight forward. The hard part is breaching the network, but once you're inside, it's a target rich environment. End of Life computers, default passwords, everyone a Local Administrator...

Originally, tweet length was 160 minus username length. One day, I turned to Jack and pointed out that I got one more character than him. He said, "That's not fair. We should standardize." I agreed. He said, "How about 140?" I said, "Sure." And he updated the code.

Last year, we upgraded tweet length to 280 and guess what? Use of 'please' is up 54% and 'thank you' is up 22%. I love that! Also, people are asking more questions and having more conversations. All this, and the majority of tweets are still under 140. It worked.

Following up last year’s surprisingly popular "10 things you likely didn’t know about Darkroom" and your many requests for more tips, we put together a second edition that focuses on workflows in Darkroom. Click through to read it all right here in this thread.

1/10 Copy & Paste your Edits in Batch. Skip the hassles of re-applying each edit over and over again by copying your edits from the tap-and-hold library menu, History tool, or the Actions (•••) menu. Go to your other photos, and paste your edits onto them.

2/10 The joy of seeing your wonderful shot in motion is why we love Live Photos so much, and why we fully support editing and exporting them! While editing, Tap the “LIVE” button at the left top when viewing a Live Photo for playback.

3/10 Turn your iPhone to landscape for an iPad like editing experience, bringing some iPad exclusive functionality to iPhone. In the library grid we show the Library Sidebar, when viewing or editing we show the Photo Strip, and in the color tool we show our Color Histogram.

4/10 Manage while editing with the Photostrip. With the photo strip available on all devices in landscape orientation, you can skip & hop through your library while editing, or quickly compare multiple photos to find the one with the perfect expression or the perfect light.

A thread about Eastshade's bike mechanic!

When I originally thought of putting a bicycling in Eastshade, I was pretty sure it wasn't going to work, for the simple fact that if it was easy, we'd see a lot more rideable bikes in games. Well, I was wrong. It took a mere week.

Its essentially a first person controller with extra momentum, resulting in the the movement direction lagging behind your look direction. Then I used the angle between the look and the movement to dictate camera "bank" and handle bar rotation, and voila! Game changing feature!

The look of the bike was harder than the movement. Bicycles are fairly modern, so it was tricky to fit it to the setting. I took some artistic liberties and settled on a penny farthing (but wooden), ignoring how impossible that would be to ride on the rugged terrain in Eastshade.

Surprisingly, the hardest part was sound. It didn't feel like riding a bike until I found the right sounds and how to trigger them. For a while I was stuck thinking too realistically. A penny farthing is fixed gear, pedaling sounds nothing like a regular modern bike.

Finally I abandoned realism and went with sounds normal people would associate with biking. We're all so used to modern bikes that we strongly associate the distinct ticking of a freewheel mechanism (think of the sound when you stop pedaling and coast on a modern bike).