EnforceSec @EnforceSec

Never trust, always verify. Joined March 2011

Tweets

10
Followers

2
Following

89
Likes

79

dom | icp @dominic_w

18 hours ago

This is craazy. I asked one of our PhD engineers to look into NEAR *Confidential* Intents wondering how they designed their system. Unredacted, word-for-word, this was his answer 😱😱😱 "Everything I found out about the privacy claims and confidential intents is so bad that it seems almost comical and I cannot believe what I am seeing. Apparently they run a completely separate instance of the protocol, which is called FAR (as an opposite to NEAR), and that has a permissioned operator set. The entire confidentiality claim seems to rest upon the fact that it is a permissioned chain and the nodes are trusted to keep things private, there doesn't seem to be any deep technology behind it and it also does not seem to be open source. The entities running the nodes are also not publicly known. I almost feel weird writing this because it is so absurdly bad that it feels like ... I don't know ... a simulation? I know the usual level of overpromising in Web3 but this is so many levels beyond believable that it still feels unreal."

432 361 2K 327K 498

View Details

SNGGLE @snggle_

22 hours ago

You are vulnerable, but GrapheneOS will KILL ITSELF preemptively to stop hackers from accessing their Forum. With the recent php2shell incident, the GOS team took the safest way possible to protect the users. They didn't take any chances when the PHP security team published a warning, they had 3 options: 1. Run their forum and cross fingers that the vulnerability will not be exploited before the patch is shipped. 2. Try to patch it on their own with duct tape and dreams. 3. SHUT OFF the service and remove the attack surface. They chose the safest option. For such a non-essential service like a forum, the 3rd option seems like overkill.But the GOS team has always highlighted the importance of security update frequency. Because of advances in AI and hackers' ability to create malicious code in hours to exploit the most recently discovered vulnerabilities, speed is important. That's why they don't support devices and apps that don't ship security updates as frequently as possible. Attackers won't wait for you to patch. Improve your OpSec before it's too late. Get GOS.

GrapheneOS @GrapheneOS

a day ago

Our discussion forum is the only software we have using PHP. We've taken it down temporarily while waiting for the patches for php.net/archive/2026.p… due to vulnerability details already being available and proof of concept exploits being developed. Don't want to take the risk.

19 96 1K 114K 126

22 87 2K 76K 509

View Details

IRIS C2 @C2IRIS

2 days ago

SNGGLE @snggle_

3 days ago

Was iPhone security broken just with Bluetooth? iPhone was always known for its high security, second only to GrapheneOS. But a leaked Cellebrite document might show they found a way to break their protection. The device is more vulnerable in AFU (After First Unlock) than in

9 42 350 54K 275

4 42 619 30K 334

View Details

V12 @v12sec

2 months ago

Signal's Contact Discovery automatically sends your contact list information to an SGX enclave in the cloud. V12 broke into that enclave and leaked the key, allowing the server host to decrypt everything. Two separate critical bugs: arbitrary read and RCE. Here's how. 🧵

17 152 731 140K 342

View Details

EnforceSec @EnforceSec

4 days ago

@1440000bytes Might help you decide too. Looks like there are a lot of problems. x.com/thefuzzstone/s…

TheFuzzStone @thefuzzstone

3 months ago

I'm uninstalling Cake Wallet. I'm tired of all the bugs in the wallet. And that was just the last straw - I couldn't send any XMR. I restarted the app and cleared the cache (which usually helps), but this time even that didn't work. I've been switching between different Monero

62 31 148 19K 31

0 0 1 14 0

View Details

ani @anirudh_chohan

a week ago

New L2 boom beginning

koeppelmann @koeppelmann

a week ago

.@gnosischain will be the first of many EEZ production chains. This means that if you deploy on Gnosis, every Ethereum user is a potential user of your dapp, and your contracts can directly interact with any other Ethereum contract. All while having fast blocks and cheap gas.

11 24 172 9K 11

0 2 12 620 0

View Details

pashov @pashov

a week ago

Preparing for incidents before they happen truly creates a security-first culture in a team - drills are the proper way to do this Bookmark and use this great open source resource on 'war games' for web3 teams. All thanks to @_SEAL_Org 🙏 github.com/security-allia…

7 5 87 4K 62

View Details

EnforceSec @EnforceSec

a week ago

@tweetemkra @koeppelmann @safe @Google @SEAL_911 @Phish_Destroy Yeah, just tagged his old account, he’s not on X anymore, but you can still use it on their website phishdestroy.io

0 0 1 27 0

View Details

chrisdior @chrisdior777

2 weeks ago

Be me in 2022: > comfortable cybersecurity job > around $6k in savings > sick of working for someone else > quit with just 3 months of runway > start CD Security > found purpose and a reason to give 100% daily I gave a lot to Web3 security, and it gave me everything!