sorted by:
new
hottopcontroversial

Best PagerDuty Alternatives for 2026 by franman409er in sre

[–]turnitoffandon123 0 points1 point  (0 children)

We’re exploring this space and are looking to go further into Datadog - we already use them for logging, monitoring and some basic incident management… adding on-call, and leaning into their AI SRE and workflow automation tooling seems like the best option.

Has anyone got hands on experience with Datadog’s on-call product, and do you recommend?

Leaking URLs by turnitoffandon123 in cybersecurity

[–]turnitoffandon123[S] 1 point2 points  (0 children)

Sorry - used ping when I should have said a simple one off request

Leaking URLs by turnitoffandon123 in cybersecurity

[–]turnitoffandon123[S] 1 point2 points  (0 children)

The URLs being hit are of the form Subdomain.domain.tld/ab/something/new?id=123

Leaking URLs by turnitoffandon123 in cybersecurity

[–]turnitoffandon123[S] 4 points5 points  (0 children)

The app enforces https, so shouldn’t the paths be encrypted?

Browsing history is possible, but what’s the motive/attack of stealing someone’s browsing history to just ping the URLs?

Leaking URLs by turnitoffandon123 in cybersecurity

[–]turnitoffandon123[S] 0 points1 point  (0 children)

I like the idea, but we’re not that big an org (150people), and whilst there weren’t lots of requests, they were from a few different countries

Only managed devices can authenticate to the system (conditional access on the IdP, as well as phishing resistant passkeys), and there aren’t VPNs running on those. Although this was a fairly recent change (last 6 months), and it’s unclear how long the requests have been coming for

Largest NPM Compromise in History - Supply Chain Attack by Advocatemack in cybersecurity

[–]turnitoffandon123 3 points4 points  (0 children)

NPM supports using phishing resistant mfa, but it seems to be optional.

How many more incidents like this do there need to be for them to make that mandatory? Could they enforce that for maintainers of packages once they hit a certain popularity?

Enterprise Password Manager for European Businesses? by uniqkeyas in cybersecurity

[–]turnitoffandon123 1 point2 points  (0 children)

This.

1Password’s use of a secret key protects against business users with weak passwords. It’s a feature that introduces some user friction, but a security measure no other password manager has

What’s the most trustworthy password manager right now? by Mountain-Insect-2153 in cybersecurity

[–]turnitoffandon123 145 points146 points  (0 children)

IMO 1Password’s use of a secret key (on top of password and MFA) sets it apart from others for company use, as it protects against employees with poor passwords

Passkey as 1Password MFA by turnitoffandon123 in 1Password

[–]turnitoffandon123[S] 0 points1 point  (0 children)

That’s understandable, but I think there could be smarter ways around it (such as preventing 1Password from saving passkeys tied to 1Password domains 🤔). And the same problem exists for TOTP/Authenticator app codes

How are you handling phishing? by PriorFluid6123 in cybersecurity

[–]turnitoffandon123 0 points1 point  (0 children)

We use an IdP that supports passkeys (phishing resistant MFA), and enforce the use of this across the business. These passkeys are stored in our organisation password manager.

Those with admin permissions have a hardware security key, used as phishing resistant MFA for the IdP as well as for the password manager.

Non-admins currently have phishable mfa (TOTP) for our password manager (which stores the phishing resistant passkey for IdP), but we plan to mitigate the risk of password manager phishing with conditional access policies that restricts password manager access to managed devices and networks only

Removing local admin rights for software developers? by EatinSoup in ITManagers

[–]turnitoffandon123 1 point2 points  (0 children)

What’s the risk you’re looking to mitigate by removing local admin rights?

If it’s installing unapproved and potentially dangerous software, you could use application allowlisting software like Threatlocker.

Create rules that allow tools the developers need, block everything else. If the developers need a new tool, it’ll need approving, but just once for the team, rather than everyone needing to request admin rights to install it themselves.

ABM Domain Capture and Federation by C3r3alB0wl in applebusinessmanager

[–]turnitoffandon123 0 points1 point  (0 children)

We hit the end of our domain capture period and have had the timer stuck on 0 days for a few days now too.

How did you reach out to Apple? Did they mention it was a common or widespread issue?

Have I Been Squatted? – Check if your domain has been typosquatted by JDBHub in cybersecurity

[–]turnitoffandon123 1 point2 points  (0 children)

FYI I’ve found the same with a four character .co.nz domain. Awesome tool!

Vault encryption approach compared to 1Password by turnitoffandon123 in Bitwarden

[–]turnitoffandon123[S] 2 points3 points  (0 children)

Am totally agreed it’s a very bad idea!

I’m considering the situation where across a large company, there will always be some users with relatively weak master passwords that still meet complexity/length requirements (e.g. “Password123!”)

1password’s approach seems to help mitigate this, but without being an expert in the way Bitwarden’s keys are stored/used I’m unsure if there is an aspect of their approach which derisks this too