security engineering @brave / helped build Let's Encrypt, Privacy Badger, and HTTPS Everywhere @eff / physics alum @mit / rabbit enthusiast
- Tweets 20,245
- Following 337
- Followers 73,597
- Likes 25,899
Day 2 of voting on randomly-selected songs on SoundCloud until we collectively find the best one: tracks with 37 plays are outperforming ones with 15k+! azuki.vip/bse/
4
11
2,580
HELP NEEDED: please vote at azuki.vip/bse/ so we can determine the best song ever uploaded to soundcloud (songs are picked completely at random)
3
3
9
2,511
target.com prices delivery items based on your local store setting, not your delivery address, so if you live in SF just set your local store to Missouri or something lol
5
15
217
14,967
between this and the two “hide my email” buttons on this form (one of which loads the email hiding feature, the other of which autofills the string “hide my email”), apple has been killing it lately!
1
4
39
4,887
i need to know more about the 38 pics classified as “rabbit” but not “Rabbit” by the apple AI
6
2
71
7,158
actually i noticed they are using the mobile client. indeed on mobile gmail does not show the `via` indicator for dmarc failures!
1
3
785
yes, there is a completely separate issue where lack of DMARC allows anyone (not just mit.edu authenticated accounts!) to send emails that look like this. but fixing DMARC wouldn't fix the original issue from this thread.
many universities have this issue too
3
14
5,232
turns out i can just test this :). here's an email sent via emkei.cz spoofing yan@mit.edu. it makes it into the inbox without any warnings, but it shows the "via" message and a dmarc fail upon opening the original
1
2
943
a lot of ppl have been saying (1) so i finally just tested it. yes the email goes to my inbox (gmail) but it's clearly marked as suspicious, even though mit.edu's DMARC policy is none, because it fails SPF and DKIM.
5
1,134
DMARC passes anyway so it shows no warnings of any kind; i'm not sure though if gmail would do something if DMARC is none but dkim/spf don't pass, maybe mark as suspicious but not move to spam?
760
no idea how many other legacy SMTP setups have the same issue but it's easy to detect in this case; just inspect the email headers and check if the "authenticated as" user is the same as the address in the "from" field.
11
29
1,150
139,335
PSA i can spoof any mit.edu email and it will pass all DKIM/SPF/etc. checks. here's an email i sent to myself pretending to be a famous MIT-affiliated podcaster - thanks gmail for auto-inserting the profile pic :)
MIT may fix this someday but in the meantime beware that it's trivial for any mit.edu account to send mail as any other mit.edu account!
178
683
11,563
1,391,033
ROFL at andrew huberman saying that if you have a 20% chance of pregnancy in any given month, the chance of being pregnant after 6 months is 120% piped.video/watch?v=O1YRwWmu…
251
239
5,267
2,031,038
in january 2023, i had a simple ultrasound done at SimonMed. they sent me 4 bills totaling $5137 for it.
after a year of emails and phone calls, they finally admitted today that i only owed $140.53 and are mailing me a refund check!
here's how i did it 🧵
163
3,108
32,892
4,282,183
my bunny had to take benzos for his molar trim today and afterwards he rolled over in the car and couldn’t flip back on his own
5
1
74
12,110
fyi homebrew had the backdoored version of xz utils; updating now will downgrade it duo.com/decipher/red-hat-war…
17
401
1,647
274,155
hey if you’re going to @NFT_NYC just a heads up that someone is sending unsolicited emails offering to sell your personal data #NFTNYC2024
1
5
15
6,672
why i hate in-app webviews: this is a x.com webpage loaded in a webview embedded in the X app, with a banner prompting me to open it in X
4
1
68
8,275
“As a result of increased demand, it mixed up device ID and user ID mapping and connected some data to incorrect accounts.” lol wat
11
23
218
31,875
i think i've found the publication that is most relevant to my interests among all publications in the world
4
2
73
9,295
this dog bolted out of my friends' house in Berkeley on Saturday night and has been missing since :(. if you see a 12lb brown chihuahua mix named Toaster, please lmk.
15
29
18,812
cannot praise tim cook and the team at apple highly enough for making my rabbit’s ear go over the clock on the latest update
9
38
1,134
96,154
bomb squad is here, several blocks are closed
ALERTSF: Avoid the area of Oak St and Broderick St due to Police Activity. Emergency crews are on scene.
Expect traffic delays, consider alternate routes, and allow for additional travel time. For live traffic information visit 511.org/. manager.everbridge.net/pub/1…
1
2
20
13,782
