jc_sec

You'll have to rip tmux from my cold dead hands

This was my experience with matrix.org, mostly pedos and far right extremists or other weird anti social characters . Turned me off from these kinds of platforms big time.

They burned me bad with Google Music...never again.. Google is a joke, this reminds me I need to find a GMail alternative.

Huge fan of bottle. I use it for a lot of things.

I understood this to be the main concern with regards to harmful radiation. The article states that when HTO is consumed and comes in contact with biological molecules it binds to them and can stay in the body for years. It goes on to state the the negative effects of this may be underestimated.

There's an article like this every week or so.. I don't get it. Git isn't that hard.. You can pretty much get by 99% of use cases with like four or five commands.

Try a quick nmap scan on an AWS or Google IP range for tcp port 10250 to see some scary results.

Yep. The kubelet ports were exposed. From the article:

As it turns out, our coworker’s server was also publicly exposing the kubelet ports (tcp 10250, tcp 10255). Although the problem here was obvious, it should raise some questions about your own Kubernetes deployment, as it did for us.

Thanks for being the only sane person in this thread.

Also as others have pointed out, the purpose of the project is to introduce a security control to curtail the sharing of plaintext passwords via communications channels WHICH PEOPLE ALREADY DO. At my company just last week a vendor emailed us ftp credentials in plain text. If they were to use pass.sh (that they can operate themselves) it greatly reduces the risk of those credentials being compromised due to privilege escalation from a compromised email account or the likes. This is a HIGHLY simply concept the aims to solve a RAMPANT security problem in large organizations.

Its nice of you to make this long winded diatribe about security which you have gotten completely wrong.

The content entered into the text box is accessible simply by visiting a link, which means that the data is not end to end encrypted

Me thinks you don't quite understand what end to end encryption means. When you visit pass.sh it forces you onto a TLS session. Anything you enter into that box is encrypted in transit. The data is encrypted in the database, and the password deletes itself from the database automatically after X views and/or X days.

I expected more from a "senior engineer at Virtu" but now I know what company to stay away from. Thanks.

Lol, its not equivalent because its a link that deletes itself automatically after X days and X views. In a scenario where an email/slack/etc account becomes compromised down the road a password sent in plaintext is immediately compromised where as a password shared with pass.sh has expired and is no longer a valid link.

If you cant understand the very basic security control there then I really can't help you. You sound like someone who has been stuck in IT too long.

You are kidding yourself if you think relying on over a support agent to verify identity is better than the solution here. Humans are inherently fallable as social engineering has proven time and again.

Haven't heard of this until now. Looks cool I'll check it out.

Yes, that was the inspiration for this project. I've used pwpush and even suggested some changes to that project. I wanted something more lightweight (non rails) and simpler to integrate. Nothing against pwpush, just my version of it ;)

this comment made my day... :)

but yeah that backend validation is on my radar.

Thanks for checking me out

Hi, author here...

Firstly, this project is open source. If you suspicious of where the data is being stored or my intentions, you are free to fork and run it yourself.

That being said.. I am not claiming to have achieved some novel security accomplishment. Yes, this is a simple symmetric encryption using a vetted crypto lib, backed by a key value store, and using UUID4 to generate the links.

Its a trade of for convenience and security. It's better than emailing passwords in plaintext and makes security more accessible to folks who dont have the time/incinlination/technical ability to set up keybase and/or estbalish PKI for sharing secrets.

Understand the audience this is targeting..