Dave Troy @davetroy

2 posts2 participants0 posts today

@c_th1@digitalcourage.social · 3d

Meine Datenschutz und Privatsphäre Übersicht 2025, für die Allgemeinheit

Teilen erbeten

als PDF:

https://cryptpad.digitalcourage.de/file/#/2/file/NdmBgSYkRCto8B+JmJkE9mQ4/

#DSGVO #TDDDG ( #unplugtrump )
#Datenschutz #Privatsphäre #sicherheit #Verschlüsselung
#encryption #WEtell #SoloKey #NitroKey #Email #Cybersecurity #Pixelfed #Massenűberwachung
#Google #Metadaten #WhatsApp #Threema #Cryptpad #Signal
#Hateaid #Cyberstalking #Messenger #Browser #Youtube #NewPipe #Chatkontrolle #nichtszuverbergen #ÜberwachungsKapitalismus #Microsoft #Apple #Windows #Linux #Matrix #Mastodon #Friendica #Fediverse #Mastodir #Loops #2FA #Ransomware #Foss #VeraCrypt #HateAid #Coreboot #Volksverpetzer #Netzpolitik #Digitalisierung #FragdenStaat #Shiftphone #OpenSource #GrapheneOS #CCC #Mail #Mullvad #PGP #GnuPG #DNS #Gaming #linuxgaming #Lutris #Protondb #eOS #Enshittification
#Bloatware #TPM #Murena #LiberaPay #GnuTaler #Taler #PreppingforFuture
#FediLZ #BlueLZ #InstaLZ #ThreatModel
#FLOSS #UEFI #Medienkompetenz

**Paco Hope #resist** @paco@infosec.exchange · 5d

Paco Hope #resist @paco@infosec.exchange

Some of my colleagues at #AWS have created an open-source serverless #AI assisted #threatmodel solution. You upload architecture diagrams to it, and it uses Claude Sonnet via Amazon Bedrock to analyze it.

I'm not too impressed with the threats it comes up with. But I am very impressed with the amount of typing it saves. Given nothing more than a picture and about 2 minutes of computation, it spits out a very good list of what is depicted in the diagram and the flows between them. To the extent that the diagram is accurate/well-labeled, this solution seems to do a very good job writing out what is depicted.

I deployed this "Threat Designer" app. Then I took the architecture image from this blog post and dropped that picture into it. The image analysis produced some of the list of things you see attached.

This is a specialized, context-aware kind of OCR. I was impressed at boundaries, flows, and assets pulled from a graphic. Could save a lot of typing time. I was not impressed with the threats it identifies. Having said that, it did identify a handful of things I hadn't thought of before, like EventBridge event injection. But the majority of the threats are low value.

I suspect this app is not cheap to run. So caveat deployor.
#cloud #cloudsecurity #appsec #threatmodeling

A typical AWS serverless architecture from the blog that I linked to. It shows a very large box representing an AWS account, and bunch of smaller boxes containing icons, with each box representing a capability (like file upload, users and authentication, etc). Inside each of those boxes are some icons representing services, like Lambda, IAM, Cognito, S3, etc.

An screen capture of a list of things in a web browser. The table header is labeled "Flows" and it lists flows like the following:

End users authenticate through web browsers or mobile devices via Amplify and CloudFront to Cognito User Pools, potentially using External Identity Provider integration. Source: End Users, Target: Cognito User Pools

Authenticated users make API requests through CloudFront and API Gateway to access backend services. Source: End Users. Target: API Gateway

API Gateway routes authenticated requests to appropriate Lambda functions for processing. Source: API Gateway. Target: Lambda Functions

An screen capture of a list of things in a web browser. The table header is labeled "Assets" and it lists things like the following:

End Users: Users that access the application through web browsers or mobile devices, interacting with the frontend interfaces

External Identity Provider: Third-party authentication service integrated with Cognito for user authentication and authorization

API Gateway: Manages all API requests, acts as the primary entry point for backend services, controls access to Lambda functions and business logic

A screenshot of a table in a web page. The header is labeled "Trust Boundary" and it contains items like:
Public-to-private network boundary separating internet users from AWS cloud resources. Source: End Users. Target: CloudFront Distribution

Authentication boundary validating user identity before allowing access to backend resources. Source: End Users. Target: Cognito User Pools

External authentication service integration boundary. Source: Cognito User Pools. Target: External Identity Provider

#ai #threatmodel

@c_th1@digitalcourage.social · Mar 25 *

Mar 25 *

@c_th1@digitalcourage.social

Meine Datenschutz und Privatsphäre Übersicht 2025, für die Allgemeinheit

Teilen erbeten

als PDF:

https://cryptpad.digitalcourage.de/file/#/2/file/NdmBgSYkRCto8B+JmJkE9mQ4/

@c_th1@digitalcourage.social · Mar 23

Mar 23

@c_th1@digitalcourage.social

Meine Datenschutz und Privatsphäre Übersicht 2025, für die Allgemeinheit

Teilen erbeten

als PDF:

https://cryptpad.digitalcourage.de/file/#/2/file/NdmBgSYkRCto8B+JmJkE9mQ4/

Meine Datenschutz und Privatsphäre Übersicht 2025, für die Allgemeinheit Feedback erwünscht

@c_th1@digitalcourage.social · Mar 2 *

Mar 2 *

@c_th1@digitalcourage.social

Meine Datenschutz und Privatsphäre Übersicht 2025, für die Allgemeinheit

Teilen erbeten

#DSGVO #TDDDG ( #unplugtrump )
#Datenschutz #Privatsphäre #sicherheit #Verschlüsselung
#encryption #WEtell #SoloKey #NitroKey #Email #Cybersecurity #Pixelfed #Massenűberwachung #Sicherheitspaket
#Google #Metadaten #WhatsApp #Threema #Cryptpad #Signal
#Hateaid #Cyberstalking #Messenger #Browser #Youtube #NewPipe #Chatkontrolle #nichtszuverbergen #ÜberwachungsKapitalismus #Microsoft #Apple #Windows #Linux #Matrix #Mastodon #Friendica #Fediverse #Mastodir #Loops #2FA #Ransomware #Foss #VeraCrypt #HateAid #Coreboot #Volksverpetzer #Netzpolitik #Digitalisierung #FragdenStaat #Shiftphone #OpenSource #GrapheneOS #CCC #Mail #Mullvad #PGP #GnuPG #DNS #Gaming #linuxgaming #Lutris #Protondb #eOS #Enshittification
#Bloatware #TPM #Murena #LiberaPay #GnuTaler #Taler #PreppingforFuture
#FediLZ #BlueLZ #InstaLZ #ThreatModel
#FLOSS #UEFI #Medienkompetenz

https://cryptpad.digitalcourage.de/file/#/2/file/hfzvE2FX7wKg8kbtUScqrvqI/

Meine Datenschutz und Privatsphäre Übersicht 2025, für die Allgemeinheit

**Quixoticgeek** @quixoticgeek@v.st · Feb 25

Feb 25

Quixoticgeek @quixoticgeek@v.st

Fediverse. I need your magic. Please tell me your most amusing and wtf #ThreatModel fails.

**Kevin Severud** @severud@infosec.exchange · Feb 22

Feb 22

Kevin Severud @severud@infosec.exchange

Redundant systems is not waste or inefficiency. It is protection from threats known and unknown. We are now seeing this on a national and global scale.
#threatModel #infoSec
#zeroTrust?

@c_th1@digitalcourage.social · Feb 5

Feb 5

@c_th1@digitalcourage.social

Meine Datenschutz und Privatsphäre Übersicht 2025, für die Allgemeinheit

Teilen erbeten

#DSGVO #TDDDG #Datenschutz #Privatsphäre #sicherheit #Verschlüsselung
#encryption #WEtell #Email #Cybersecurity #Pixelfed #Massenűberwachung
#Google #Metadaten #WhatsApp #Threema #Cryptpad #Signal
#Hateaid #Cyberstalking #Messenger #Browser #Youtube #NewPipe #Chatkontrolle #nichtszuverbergen #ÜberwachungsKapitalismus #Microsoft #Appel #Windows #Linux #Matrix #Mastodon #Friendica #Fediverse #Mastodir #Loops #2FA #Ransomware #Foss #VeraCrypt #HateAid #Coreboot #Volksverpetzer #Netzpolitik #Digitalisierung #FragdenStaat #Shiftphone #OpenSource #GrapheneOS #CCC #Mail #Mullvad #PGP #GnuPG #DNS #Gaming #linuxgaming #Lutris #Protondb #eOS #Enshittification #Bloatware #TPM #Murena #Shiftphone
#LiberaPay #GnuTaler #Taler #PreppingforFuture #FediLZ #BlueLZ #InstaLZ #ThreatModel
#FLOSS #UEFI #Medienkompetenz

( Ich bitte euch außerdem um > #niewiedercdu #noAFD )

https://cryptpad.digitalcourage.de/file/#/2/file/hfzvE2FX7wKg8kbtUScqrvqI/

@c_th1@digitalcourage.social · Feb 3

Feb 3

@c_th1@digitalcourage.social

Meine Datenschutz und Privatsphäre Übersicht 2025, für die Allgemeinheit

Teilen erbeten

( Ich bitte euch außerdem um > #niewiedercdu #noAFD )

( neuer link )

https://cryptpad.digitalcourage.de/file/#/2/file/EjjovZQgmtn6MZGqAKbJY1uO/

@c_th1@digitalcourage.social · Jan 19

Jan 19

@c_th1@digitalcourage.social

Meine Datenschutz und Privatsphäre Übersicht 2025, für die Allgemeinheit

Teilen natürlich erbeten

   #DSGVO #TDDDG #Datenschutz #Privatsphäre #sicherheit #Verschlüsselung
#encryption #WEtell #SoloKey #NitroKey #Email #Cybersecurity #Pixelfed #Massenűberwachung #Sicherheitspaket
#Google #Metadaten #WhatsApp #Threema #Cryptpad #Signal
#Hateaid #Cyberstalking #Messenger #Browser #Youtube #NewPipe #Chatkontrolle #nichtszuverbergen #ÜberwachungsKapitalismus #Microsoft #Appel #Windows #Linux #Matrix #Mastodon #Friendica #Fediverse #Mastodir #Loops #2FA #Ransomware #Foss #VeraCrypt #HateAid #Coreboot #Volksverpetzer #Netzpolitik #Digitalisierung #FragdenStaat #Shiftphone  #OpenSource #GrapheneOS #CCC #Mail #Mullvad #PGP #GnuPG #DNS #Gaming #linuxgaming #Lutris #Protondb #eOS #Enshittification
#Bloatware #TPM #Murena  #LiberaPay #GnuTaler #Taler #PreppingforFuture
#FediLZ #BlueLZ #InstaLZ #ThreatModel
#FLOSS #UEFI #Medienkompetenz

auch als PDF:

https://cryptpad.digitalcourage.de/file/#/2/file/ZWgOiNJnLh7v33Sax11aevTg/

Replied in thread

**Anti.** @antiaall3s@chaos.social · Jan 16

Jan 16

Anti. @antiaall3s@chaos.social

COVID News Pandemic LongCOVID

**Todd A. Jacobs | Pragmatic Cybersecurity** @todd_a_jacobs@infosec.exchange · Jan 13

Jan 13

Todd A. Jacobs | Pragmatic Cybersecurity @todd_a_jacobs@infosec.exchange

#DuckDuckGo is now offering free, #anonymized access to a number of fast #AI #chatbots that won't train in your data. You currently don't get all the premium models and features of paid services, but you do get access to privacy-promoting, anonymized versions of smaller models like GPT-4o mini from #OpenAI and open-source #MoE (mixture of experts) models like Mixstral 8x7B.

Of course, for truly sensitive or classified data you should never use online services at all. Anything online carries heightened risks of human error; deliberate malfeasance; corporate espionage; legal, illegal, or extra-legal warrants; and network wiretapping. I personally trust DuckDuckGo's no-logging policies and presume their anonymization techniques are sound, but those of us in #cybersecurity know the practical limitations of such measures.

For any situation where those measures are insufficient, you'll need to run your own instance of a suitable model on a local AI engine. However, that's not really the #threatmodel for the average user looking to get basic things done. Great use cases include finding quick answers that traditional search engines aren't good at, or performing common AI tasks like summarizing or improving textual information.

The AI service provides the typical user with essential AI capabilities for free. It also takes steps to prevent for-profit entities with privacy-damaging #TOS from training on your data at whim. DuckDuckGo's approach seems perfectly suited to these basic use cases.

I laud DuckDuckGo for their ongoing commitment to privacy, and for offering this valuable additional to the AI ecosystem.

https://duckduckgo.com/chat

duckduckgo.comDuckDuckGo AI Chat at DuckDuckGoDuckDuckGo. Privacy, Simplified.

@c_th1@digitalcourage.social · Dec 17, 2024 *

Dec 17, 2024 *

@c_th1@digitalcourage.social

Meine Datenschutz und Privatsphäre Übersicht, für die allgemeine Nutzung.

#DSGVO #TDDDG #Datenschutz #Privatsphäre #sicherheit #Verschlüsselung #WEtell #SoloKey #NitroKey #Email #Cybersecurity #BigBrotherAwards #Massenűberwachung #Sicherheitspaket
#Google #Metadaten #WhatsApp #Threema #Cryptpad #Signal
#Hateaid #Cyberstalking #Messenger #Browser #Youtube #NewPipe #Chatkontrolle #nichtszuverbergen #ÜberwachungsKapitalismus #Microsoft #Appel #Windows #Linux #Matrix #Mastodon #Friendica #Fediverse #Loops #2FA #Ransomware #Foss #VeraCrypt #HateAid #Coreboot #Volksverpetzer #Netzpolitik #Digitalisierung #Informatik #Shiftphone #OpenSource #GrapheneOS #CCC #Haecksen #Mail
#Mullvad #PGP #GnuPG #DNS
#Gaming #linuxgaming #Lutris #Protondb #e_OS #2025
#Murena #LiberaPay #GnuTaler #Taler
#FediLZ #BlueLZ
#InstaLZ #ThreatModel
#FLOSS #Medienkompetenz

als PDF zum Download:

https://cryptpad.digitalcourage.de/file/#/2/file/jhTsnXLoAe9K6RAeRl6lkW9H/

hier auch als neutrale Version, ohne Profil Link, natürlich ebenfalls zum Weitergeben:

https://cryptpad.digitalcourage.de/file/#/2/file/QGxYlYe03dOGUBNqbbbLO2UL/

Meine Datenschutz und Privatsphäre Übersicht, für die allgemeine Nutzung In zwei Versionen

**Reclaim Your Tech** @reclaimyourtech@assemblag.es · Sep 9, 2024

Sep 9, 2024

Reclaim Your Tech @reclaimyourtech@assemblag.es

https://reclaimyour.tech/posts/technical/privacy-modeling

In this post, I describe #privacy #threatmodeling by using the excellent https://privacyguides.org site as a primary resource.

I give an example threat model with strengths and weaknesses. I encourage readers to tweak it to better suit their needs.

Reminder: Replies to this toot will appear in the link's comment section.

Reclaim Your TechPrivacy Threat ModelingA key responsibility involved in owning your own digital infrastructure is privacy threat modeling. What is Privacy Threat Modeling? According to priv…

#security #capitalism #enshittification

**OWASP Foundation** @owasp@infosec.exchange · Sep 4, 2024

Sep 4, 2024

OWASP Foundation @owasp@infosec.exchange

Get ready for #AppSec Days #Singapore! Interested in getting more engaged? Join us as a volunteer and help make this conference unforgettable! Check out our volunteer openings NOW: https://owasp.wufoo.com/forms/z7wfrfl07e63af/ #cybersecurity #devsecops #AI #threatmodel #infosec

**Emory** @emory@soc.kvet.ch · Aug 8, 2024

Aug 8, 2024

Emory @emory@soc.kvet.ch

that #privacy threat modeling workshop presentation is underway and feel free to stick your head in i guess, it's a little light on details though.
https://mitre.zoomgov.com/j/1611729413?pwd=uvbFw8zDZgQTKEtXthgoP4IYoaA8sC.1

Zoom VideoJoin our Cloud HD Video MeetingZoom is the leader in modern enterprise video communications, with an easy, reliable cloud platform for video and audio conferencing, chat, and webinars across mobile, desktop, and room systems. Zoom Rooms is the original software-based conference room solution used around the world in board, conference, huddle, and training rooms, as well as executive offices and classrooms. Founded in 2011, Zoom helps businesses and organizations bring their teams together in a frictionless environment to get more done. Zoom is a publicly traded company headquartered in San Jose, CA.

#infosec #threatmodel

**considerate** @c0nsid3rate@infosec.exchange · Jul 20, 2024

Jul 20, 2024

considerate @c0nsid3rate@infosec.exchange

Who had the "failure of a CrowdStrike update" (or something like) in their threat model? And if you did, was it categorized as low likelihood and high impact? How many other things do we categorized that way? It might be time to take another look at those items we consider "low likelihood." And if the impact is high or critical, maybe dig a little deeper. Are you ready?

#infosec
#cybersecurity
#threatmodel
#risk
#CrowdStrike

**Emory** @emory@soc.kvet.ch · Jun 19, 2024

Jun 19, 2024

Emory @emory@soc.kvet.ch

okay @obsidianmd after a ton of scrolling around for the last week i hearby endorse Smart Second Brain for integrating local AI into your notetaking and #PKM practices.

https://github.com/your-papa/obsidian-Smart2Brain

it can use #ollama and any models you fetch for it are available to Obsidian, as are the new embeddings models for doing RAG. i've forked a vault of #threatmodel cards i use and am about to get weird /flex

#smart2Brain seems to be the safest and easiest which hardly ever happens. well done. #obsidian

GitHubGitHub - your-papa/obsidian-Smart2Brain: An Obsidian plugin to interact with your privacy focused AI-Assistant making your second brain even smarter!An Obsidian plugin to interact with your privacy focused AI-Assistant making your second brain even smarter! - your-papa/obsidian-Smart2Brain

**Adam Shostack** @adamshostack@infosec.exchange · Jun 6, 2024

Jun 6, 2024

Adam Shostack @adamshostack@infosec.exchange

In the return of #threatmodel thursday, I look at work by @rmogull and Chris Farris in their Universal Cloud Threat Model

https://shostack.org/blog/universal-cloud-threat-model-threat-model-thurs/

Continued thread

**Multi Purr Puss** @platymew@layer8.space · Apr 23, 2024 *

Apr 23, 2024 *

Multi Purr Puss @platymew@layer8.space

@ubuntu #LinuxContainers; currently (in the noble server RC), i have to import an auth cert into my browser, in order to be granted access to the fancy new web GUI of #lxd

Here's the #threatModel; everyone, who can access my browser, WILL have full root access (via terminal or console) to all my containers (or VMs).

That's why i'd prefer some kind of session-based auth - you know, a "logout" button.

Recent searches

Search options

Administered by:

Server stats:

#threatmodel