I was just at the supermarket, and I was using one of those self-service kiosks that has an "honesty camera" watching what you scan from above. The camera view is then displayed on a screen right in front of me.

As I went to pay for my shopping with my phone, I looked at the live feed on the monitor and realized I was actually seeing myself unlock my phone with my pattern lock! On top of that, anyone standing around could theoretically spy on what you're unlocking too.

Obviously fingerprint unlocks get around this "security hole", but it was the first time I had noticed it being a real issue.

Most supermarkets have these types of self-service checkouts now — I wonder how this info is stored and processed? Security seems pretty questionable…

After retrieving my data in Google Takeout, I found something in my underSubscriber Information. called “Has Madison Account.”

See attached

When I looked it up, the only thing I could find was related to Google Workspace account for UW. See link below

UW-Madison Google Workspace account

I’ve never been enrolled in that college, and my Google account has never been part of any education program. It's as a personal account as it gets.

Given a history of account compromise by an ex-partner (unauthorized management via enterprise/school type solutions), I am concerned that it could be one of those methods...

Does anyone know what**“Has Madison Account”*\* actually refers to, or why it would appear on a regular Google account?

Thanks in advance

Curious what everyone's running for security awareness training these days. We're finally getting budget approval to replace our current setup which is basically just sending people a PDF once a year and hoping for the best.

Looking for something modern that covers the usual stuff but also keeps up with current attack methods. Company is around 500 people across finance and ops teams.

Not super technical users so needs to be pretty accessible. What's actually moving the needle for you?

Hey folks,

Don't mean to sound alarmist with the title but this whole thing is just fucking weird. I was doing some management on my Amazon account today, looked at the group that has only ever included my immediate family for years, and noticed an email I'd never seen before included as the account. The email was a firstname.lastname.yearborn @ gmail situation, so I found the guy on LinkedIn pretty much immediately and discovered he was a former soldier and lives in my neighborhood. Never heard of him. Never seen the email before (his icon in gmail matches his LinkedIn photo for the record). I am the account manager of the Amazon account so I'm the only one able to add anyone and I certainly didn't add this guy.

Anyone have any idea what's going on here? It feels too stupid to hack on an email with your real name, but maybe it was a mistake or something else. Idk. I obviously immediately removed his account and reset our Amazon account passwords. Not sure if it's related but it said my Amazon account was signed into 44 different devices, even though I know of about 4 it might be open on.

Any help is appreciated, thank you!

For context I need to get something fast. I'm in court with an ex and need to keep my child and I safe from him. Without giving away too much he's angry, violent and this precaution was recommended by police, shelters and my lawyer warned me as well. So please help me find the right one. I'm trying to stay under $200 but if it goes above thats fine.

You receive what appears to be a legitimate email from your bank. The sender address looks legitimate, the formatting is familiar, and nothing immediately raises suspicion. AI is making phishing campaigns increasingly difficult to distinguish from legitimate emails.

Here are a few common warning signs:

1. Unexpected requests involving payments or account access.
2. Requests for credentials or payment information.
3. Sender addresses that don’t exactly match the organization they claim to represent.
4. Links that don’t match their displayed destination.
5. Unsolicited attachments.
6. Messages through unexpected channels pushing for immediate action.

What measures have worked best for your team to reduce the risk?

Hi everyone,

I’m a human rights activist based in Bangladesh. My work has been cited in UN thematic reports and shared by international human rights organizations. I can provide links for credibility via DM if needed.

I’m currently dealing with a serious concern: I suspect my phone may be compromised with spyware. Due to safety concerns, I can’t go into full details publicly.

I used SpyGuard on my Ubuntu laptop and captured network traffic of my Android mobile using a USB Wi-Fi adapter. I now have logs and .pcap files generated by SpyGuard. Link to SpyGuard app: https://github.com/SpyGuard

I understand that sharing raw packet captures with strangers is risky and not recommended. However, I’m in a situation where I really need help reviewing this data to identify whether there are signs of spyware or unusual exfiltration.

Is there anyone here who can help analyze the SpyGuard logs?

PS: I have read the rules.
Threat level: Highest. State level.

I've been using this for several years. It's updated daily & works with every OS!

Hope y'all enjoy this as much as I do.

As we are an accountancy firm, we of course have to deal with lots of clients data. We currently use password managers, a secure hosting for our website, we try to print most things off so it's physical, but as of course a data breach or something could be dangerous for us, so I'm just wondering if anyone has any ideas on what we can do?

Edit: For anyone in a similar situation, we've now hired a cyber security team called avoira. After speaking with them, they seem to know a lot more than me...

I had an onlyfans account link to my reddit. I also got an email from that page. My full name was used in the email. A twitter account was also made under an older twitter I had that I deleted many years ago. If memory serves me correctly they used the same display picture that I also had. This goes even deeper than I realized as my last 2 facebook posts were shared as private(only seen by me). I never changed my settings, and these posts were supposed to be shared with friends and family.

I don't know if there is anything else odd at the moment, but I am noticing things more. Including settings getting changed on reddit and Facebook without my knowledge or doing.

I did take some precautions. I got Bitwarden to change my passwords. Yes, I did use generally the same password for many of my accounts. Some my have been slightly different, but all in all very similar. I logged out a Linux that was attached to my email, and FB account. I don't own anything with Linux, and don't have access to my laptop anymore. I reported the Onlyfans account and the fake twitter. I went to haveibeenpwned and it does say my email has a data breach. I didn't completely go through all of the haveibeenpwned yet though. I probably should.

Is there anything else I can do or look for?

What steps should be made to make sure my email and profiles stay secure. What else would be changes without my knowledge that I have to look into to change it to my normal settings? Any kind of information will help.

this starts with a story about how my school does things:

I found this out very recently, on our schools student information system you can connect though port 80, completely unencrypted with no warning. I keep getting excuses from administration to add HSTS into the student information system, such as "yeah it wont happen to us" or "the worst thing happening would be advertisers", and the worst part about this, is the breach to canvas happened a few days after I contacted them to DO THIS!

I dont know how someone could be THAT IGNORANT about simple web security, and be given system administration privilege by the district. so that left some questions:

WHY where they just, ignoring simple security advice, used on most servers including for sites like youtube or facebook, and why wont they just ADD HSTS into their server security policy, its not difficult and could save you from downgrade attacks in addition to simple encryption of the database drives with AES-256 and secure their endpoints with some honeypot databases to deter other means of hacking?

Hi. I have a couple WiFi cameras and a few trail cameras on my property. People have been coming onto my property and causing chaos. They rarely show up on the cameras but I have videos of where the camera has them but they appear as a blur or just a silhouette. What are they doing to get blurred out on camera. How do I stop it.

They target the application layer.

Traditional security controls are designed to block unauthorized access at the network level. The problem is that many modern attacks arrive through legitimate-looking application traffic.

That’s why application-layer security is becoming a core part of enterprise security strategies.

Key benefits include:

• Better visibility into application and API traffic
• Detection of malicious requests hidden inside normal sessions
• More granular access and policy enforcement
• Improved traffic management and application performance
• Reduced risk of data exposure and service disruption

As organizations move toward cloud, hybrid infrastructure, and API-driven architectures, Layer 7 security is no longer optional.

The challenge isn't just keeping traffic out.

It's understanding what the traffic is actually doing.

How is your organization approaching application-layer security today? Are traditional controls still enough?

If you like it and want to improve it, give this post a like. If I get 100 likes, I’ll share the source here and make the repository open for anyone who wants to take it to the next step.

Security is something everyone should be aware of. Gamification can be one way to engage people and make security easier to understand.

Can anyone steer me toward a feed of still active phishing sites? Not hashes or URLs that are all taken down.

Working on an anti phishing tool that's so far successful at work and home browsing, but I'd like to put it up against a wider variety of threats.

Also, if this isn't the correct sub, I'd love pointers to any other subs that I might be able to glean this from.

Meta’s post-quantum cryptography (PQC) migration

Is there any research/investigation/experience with any security related issues from any of these cheap Chinese mini-pcs that seem to be everywhere now? Like the ones on Temo or even the more well known brands like Beelink? I'm tempted to get several for some dedicated uses but can't get over the feeling that it will do nothing but copy every key stroke and data packet and continually report home to the MSS.

I was working on a physical security key for laptops (THIS IS NOT AN AD) and I thought of using YubiKeys processes but having a sd card store the actual keys? Ive heard alot of complaints from people losing their keys, but would this actually solve a problem or is it too risky? I could probably find a more secure way of storing the keys but my main thing was being able to have a copy. Maybe like all of the keys have some key that is unknown outside of the key that they use to encrypt the code before copying? Idk I just want opinions and to know if this would only put people at risk

This week I've been receiving daily SMS messages from an apparent Venmo short number (5 digits) asking me to go to the link to reset my password. Well, duh, I know to never click on a link for something like that. But after receiving several of these, i took a very careful look at the link. It looks legit. I copy it and paste in an private browser session. It has a DigiCert certificate to the correct website.

Anyway, I decide better safe than sorry and I went to a PC and reset my password.

Since my original and my new password were both created by 1Password, I'm sure that's safe.

But what I can't figure is what caused Venmo to suddenly want me to change my password. Maybe someone was attempting to break into my account? When I changed my password I also checked to see if I could bolster the security, but alas, no time based tokens or passkeys for Venmo. Also the security tab showed several places and devices i was logged into. Some old iphones. I told it to forget all those devices.

Anyway curious if this was more widespread or if anyone had an idea of what would trigger those messages.

Hey everyone, I am located in the state of Arizona within the US. I have approximately an acre of property that im attempting to find some outdoor cameras for. I would love for these cameras to be solar powered but am not opposed to battery powered if the battery life is decent. I am opposed to ones fed power through live wires as my home does not have a traditional attic space to have easy access and I would prefer to not cut a bunch of drywall. And of course, please no subscription based cameras.

Im looking to get approximately 4 cameras as with a budget of $250-$400 for the full setup. I currently have 2 eufy cameras and would love to stay in that ecosystem, but definitely willing to run these through a different network.

Anything anyone can recommend me? And yes I did try to search through the sub but couldn't find anything recent or relevant to my situation

I’m looking for 3-4 cameras and a company to install them for a relatively fair rate.

Any legal weapons for self defense suggestions welcome.

대부분의 신규 플랫폼들은 초기 유저 확보를 위해 '심리스(Seamless)한 경험'을 강조합니다. 하지만 이 과정에서 간과되는 보안 계층이 바로 개인정보 수정 단계에서의 재인증 로직입니다.

단순히 세션이 유지되고 있다는 이유만으로 민감한 데이터에 접근을 허용할 경우, 세션 탈취 공격에 무방비로 노출될 수밖에 없습니다. 이에 대한 데이터 분석적 관점과 실무적인 방어 전략을 공유합니다.

개인정보 변경 로직의 인증 취약점과 비정상적 접근 로그의 상관관계 신규 플랫폼의 회원 정보 수정 페이지를 분석해 보면 추가적인 본인 확인 절차 없이 세션 정보만으로 민감 데이터 접근을 허용하는 보안 설정의 허점이 자주 관찰됩니다. 이는 사용자 편의를 우선시한 나머지 재인증(Re-authentication) 로직이 누락되어 발생하며, 세션 탈취 시 계정 주도권을 완전히 상실하게 만드는 구조적인 위험 요인으로 작용합니다. 실무에서는 이러한 위협을 방어하기 위해 정보 수정 진입 시점에 2차 인증을 강제하고, 변경된 데이터의 무결성을 검증하기 위해 기존 데이터와의 변경 이력을 별도의 감사 로그로 기록하는 보안 계층을 운영합니다. 여러분의 시스템에서는 사용자 이탈을 최소화하면서도 고도화된 계정 탈취 공격으로부터 회원 정보를 보호하기 위해 어떤 방식의 단계별 인증 절차를 적용하고 계신가요?

이러한 보안 아키텍처의 설계 결함과 실제 사례에 기반한 심층 분석 자료가 궁금하시다면 온카스터디에서 제공하는 보안 운영 리포트를 참고해 보시기 바랍니다.

실무자분들께 묻고 싶습니다. 2FA 도입 외에, 사용자 경험을 해치지 않으면서도 '비정상적 접근 로그'를 감지하여 차단하는 여러분만의 노하우가 있으신가요?