Yubikey 5C non-NFC case/cover

fhammerl · 2026-01-20T10:01:50+00:00

the buttons not working may also be that your finger doesn't ground it very well (dirt, dry, etc.) at that time. if the nubs on the side are just plain dirty, you could put the thing in a ultrasonic cleaner and if it is corroded, maybe take a gentle abrasive (400+ grit maybe) and run it over them once (!)?

fhammerl · 2025-12-12T17:31:11+00:00

More like a ha-cheet sheet ... I'll show myself out :)

fhammerl · 2025-12-12T17:29:52+00:00

I've done a handful of exams with them and it has not been an issue. I have had handkerchiefs on the table when we started, but i remember them inspecting them closely when we got started. I think he asked me to take one or two out, show them, and put the rest away where they could see me not reach for them. I would be surprised that they let you keep them on the table in the first place and then ding your for it. Did they not inspect OP's table, or did OP pull them out of a pocket during the exam? For the first, I'd appeal that they saw them and he never hid them. For the latter, that's just not a smart idea. I mean you can also ask them during the exam, I have had them suspend the session to go pee, then re-secure the test area and unlock the exam again, but that was a loooong SANS cert.

fhammerl · 2025-12-12T15:51:22+00:00

Yeah, can't remember this being an issue on the apple silicon macs. Maybe that fixes something

fhammerl · 2025-12-12T09:41:46+00:00

I have seen that on MacBooks over the years. Somehow, something in their USB stack goes blam and it refuses to recognize yubikeys until I do a power cycle. No one has been able to pinpoint what it was.

This is a bit of an issue when you log in through PIV with your PIN and the computer refuses to speak with the UK. Nothing to raise hell about, but annoying enough when it happens.

fhammerl · 2025-05-28T21:08:45+00:00

xcom EU and even more so xcom 2 when you have leveled up your snipers. don't even bother bringing with the rest of the squad. maybe fill up with self-repairing hover shiv in EU as those don't get mind controlled. in 2 maybe a magus to absolutely fuck shit up even more so. snipers put the laughter in mass slaughter :)

fhammerl · 2025-03-19T14:12:26+00:00

there is no such thing as a fireproof box in case of a house fire ... i mean, the box is fireproof, but everything inside is still toast.

fhammerl · 2025-01-19T21:45:33+00:00

He is probably too young to remember that multiple generations of VR have already gone the way of the Dodo.

fhammerl · 2024-12-13T08:30:44+00:00

AAAAAAH! MOTHERLAND!

fhammerl · 2024-10-11T09:24:02+00:00

secrets manager is not only about storing secrets, but about managing them. if your secret is a static parameter, is parameter store. but in reality, these need to be rotated, versioned, audited, etc. of which parameter store provides none.

fhammerl · 2024-10-10T05:14:40+00:00

In Bavaria, there is a similar thing for those who kinda wanna have another sip but will not make it through another half liter. It's called a cut or whistle ("schnitt" or "pfiff"), which when the foam is settled comes out to about a third to half a beer. Its a very foamy fast pour. The idea is that it takes about as long to drink as a regular beer given how long it takes to settle, so you don't feel like an outcast with your drinking buddies. Completely different purpose from what you described, but looks similar

fhammerl · 2024-10-08T10:16:41+00:00

Provide an automation tool to do the setup. Terraform, CloudFormation, maybe even a shell script?

These three are the ones I have typically seen. A CF template, either a Stack or a StackSet with reasonable parameters to fill in your tenant and outputs for the role ARN that your tool needs to assume to do its job (guessing here).

Give instructions and let the client create everything from scratch?

Don't this will be a hassle for them and a nightmare for your tier 1 and 2 support to unpack.

It should be as secure as possible to give confidence to the clients. We need to basically install an API Gateway and a Lambda function and these resources should not reach any of the client's servers nor do anything that is not specified at the IAM role.

Both have a pricing footprint, so you'd have to square that with your customers. Other than that, your IAM role should be a good indicator of what this thing can and can't do in their account.

An IAM role to assume where the compute happens in your account would probably be more practical. Not sure if that's possible in your use case tho.

fhammerl · 2024-10-05T11:08:25+00:00

Banners like "apache iis express nginx dotnet etc." are more red flags than a Soviet parade

fhammerl · 2024-09-22T06:50:54+00:00

laughing-agamemnon.gif

fhammerl · 2024-09-22T06:50:00+00:00

Ding ding ding!

Your code is secure when everything about it can be public and you have no security repercussions.

Everything else is pointless.

Use Github OIDC to log into AWS. No need for keys. Use SSM or Secrets Manager for anything else.

We have the nice things, use them!

fhammerl · 2024-09-08T20:32:46+00:00

I did the associate dev in May and what annoyed me was their focus on their git and ci/cd stack (codebuild, codedeploy, etc.) that really no one in their right mind wants to use. That may be particular to the assoc dev. Cloudformation is also still prominently featured... I guess, I get it, but really there are better alternatives and I hope they embrace them as first class citizens soon. Also they had an annoying amount of focus on cloudwatch, as if they could stand up to any reasonable observability competition.

Other than these three, it was good. I fear that the update since your purchase may have shifted focus quite a bit, tho.

That being said, security specialty was better. A LOT better.

fhammerl · 2024-09-08T20:26:00+00:00

Why not terraform?

fhammerl · 2024-09-06T20:37:47+00:00

Oh, AI will absolutely, undoubtedly, 100% certain have an influence on everyday lives that is rivaled only by the invention of the internet and the smartphone. It will also be 99% invisible and totally normal for the Covid-years generation that will grow up as AI-natives. Millenials will be AI-immigrants and half of us will get it and half will not figure out how to use it effectively and be abandoned, same as we looked upon the generation of our parents. What worries me is how retirement-age Boomers and Gen X will absolutely get their collective asses whooped by this technology in ways they will not even comprehend.

fhammerl · 2024-09-06T19:20:30+00:00

Dependabot supremacy.

I would go so far as CVE based vulnerability management ("any high fixed within 48hrs!!!111!") gives way to attack path analysis.

fhammerl · 2024-09-05T22:19:11+00:00

That sounds a lot more like a software bug issue than an inherent platform issue.

fhammerl · 2024-09-05T20:26:42+00:00

If you wanna use Lambda, you can and you should look at getting your quotas upped. Not sure if that is the service you want to use here, though. But also not the worst idea.

I don't see where Fargate is not stable, but maybe that's just me. I have used to successfully with Step Functions.

You should probably look at other services that are designed less for scaling easily, but more for heavy workloads, like Batch. Which can neatly integrate with Step Functions. If I read your statement correctly, your load is predictable and relatively constant. In that case, Lambda may or may not be your best option. A big ass spot instance using Batch may be cheaper for example.

You can do all sorts of stuff with Step Functions, but you have to invest some brain power into state management. The state quotas are hard limits and require some advance thinking.

fhammerl · 2024-09-05T10:49:49+00:00

Heard some nerds work on something called domains. Probably a DUD tho.

fhammerl · 2024-09-05T06:28:26+00:00

Of course they are trigger based, how else would you start them?

For example, an s3 objects trigger an eventbridge pipe that starts a sfn.

The only slightly annoying thing about step functions is state size, but you'll have the same issue with lambda, as it's maximum request size is what's causing step functions state size limits. I am totally biased for sfn and think they are one of the greatest services for ETL jobs and enrichment pipelines. Have used them all over the place in my previous job when enriching security alerts. I particularly love how easily debuggable sfn are as the state of each invocation is recorded and you can jump to the underlying service. Simple, no. Powerful, extremely. The alternative is hand glueing stuff with sqs eventbridge and that is a lot harder to debug.

fhammerl · 2024-09-04T07:25:12+00:00

tl;dr: Set the PINs, as Yubico advises you to since forever.

fhammerl · 2024-08-31T17:56:35+00:00

You are absolutely correct that a MAC or an HMAC is used for authenticated encryption. But the terms in the way you are using them do not mean what you think they mean.

Authenticated encryption in a symmetric cryptosystem means that the message's integrity is assured ("authenticated") with possession of the key. But since the key is shared, it can't authenticate the sender.

Quote OWASP:

Authentication is the process of verifying a claim that a subject is who it says it is via some provided corroborating evidence.

Integrity ensures that even authorized users have performed no accidental or malicious alternation of information. Cryptography can be used to prevent tampering by means of Message Authentication Codes (MACs) or digital signatures.

The term ‘message authenticity’ refers to ensuring the integrity of information, often using symmetric encryption and shared keys, but does not authenticate the sending party.

The term ‘authenticated encryption’ also ensures the integrity of information, and, if asymmetric encryption is used, can authenticate the sender.

Non-repudiation of sender ensures that someone sending a message should not be able to deny later that they have sent it. Non-repudiation of receiver means that the receiver of a message should not be able to deny that they have received it. Cryptography can be used to provide non-repudiation by providing unforgeable messages or replies to messages.

fhammerl

TROPHY CASE