DNS Still Points to My Server, but the Domain Shows Someone Else’s Site
My domain is hosted on my own Debian bare-metal server at IONOS and uses Nginx. A few months ago, changes to this site stopped appearing: uploading, editing, or…
Security
Is It Safe to Keep HTTP Enabled While Using HSTS for a Custom curl Response?
I want to show a custom response when I run `curl mydomain.tld`, so I have HSTS enabled but have not enabled the server's Force HTTPS option. This lets…
RFID Login for Windows: Advice Needed!
Hey everyone! I'm exploring the idea of implementing RFID-based logins for Windows computers, specifically for our setup with Windows 10 and 11 Pro/Enterprise. The goal is to allow…
How Can I Transfer MFA Codes from Microsoft Authenticator?
We've just taken over a small family-run company, and the IT person currently has all the MFA (Multi-Factor Authentication) codes linked to Microsoft Authenticator on her phone. Is…
How Can I Rapidly Cut Off Access for a Malicious User in Entra/Intune?
Hey folks, we're using Entra for identity management and Intune for mobile device management. Recently, we had a user who was terminated unexpectedly. After their termination call with…
What Should I Do After Getting Hacked by a Fake Game Scam on Discord?
I recently fell victim to a malware attack that originated from a fake game on Discord. This is my first experience with hacking, and I'm unsure about the…
Unrecognized MacBook Appeared on My Device List—What Should I Do?
I noticed a MacBook Pro showing up on my account's device list, but I've never owned a MacBook or logged into one. I've only used my Apple ID…
I Received an Email Claiming They Recorded Me – Should I Be Worried?
I often get spam emails, but I received one that felt different. It included my password and coincided with a notification about a login attempt on my Epic…
Why Are My Emails Being Blocked by DMARC?
I've been using a custom email domain for my professional correspondence, but after my domain got transferred from Google Domains to Squarespace last year, I started experiencing issues.…
How to Make Security Policies Work at a Small SaaS Startup?
I'm the accidental security point person at our small SaaS startup with about 20 employees, and right now, our security policy is pretty much just wishful thinking. I…
How Can I Enforce Stronger Passwords in Entra ID?
Hey everyone, I'm working on enforcing password policies for a user base that's completely managed through Entra ID. The issue I'm facing is that Entra seems to have…
How Can I Find Out Someone's Location from Their Phone Number or Telegram?
Hey everyone, I'm looking for advice on how to track someone's location using their cell number. I've recently been hacked, and they stole some private photos from my…
Need Help Accessing My External Hard Drive After Forgot Password
I've forgotten the password for my external hard drive, and I really need to access it. It's been years since I last used it, and I have some…
Is SSHing into the Kubernetes Master Node the Best Way to Access the Cluster?
I'm currently doing an internship in devsecops, and I've been given access to our company's Kubernetes cluster. The process involves connecting to the company's VPN first, then SSHing…
How can I set up a whitelist for Docker pulls from ghcr.io?
I'm on the IT Security team at my company and I need to allow developers to pull specific images from ghcr.io, but I want to restrict them from…
Managing SSH Access at Scale: Certificates vs. Keys
I'm really curious about how others are handling SSH access for large teams. We recently published a blog post discussing the limitations of using SSH public key authentication,…
Considering a Switch to Linux: Do I Need Antivirus and What's the Firewall Situation?
I'm contemplating making the switch to Linux, but I have a couple of concerns. First, I've heard that while Windows Defender isn't the strongest, it does provide decent…
Should I Remove 'admin' and 'edit' Roles in My K8s Cluster?
I've come across a security finding that recommends not assigning 'bind', 'escalate', or 'impersonate' permissions to principals. The highlighted roles here are 'admin' and 'edit.' I'm considering removing…
Is a BIOS HDD Boot Password Enough for Data Protection?
I'm wondering if using a BIOS HDD boot password provides adequate data protection, or if it's just not effective at all. Is it really worth implementing, or is…
Is Passkey More Secure Than Phone Sign-in with Microsoft Authenticator?
I'm trying to understand the differences between using phone sign-in and passkeys with the Microsoft Authenticator app. Both methods leverage the app, but I'm curious if one is…