I'm not followng. It currently has not been updated.

You should be concerned only if it wouldn't be updated for eternity.

It's a security processor built into the main CPU. The AMD and Intel concepts are going to be similar enough that this talk will do:

• https://www.youtube.com/watch?v=lR0nh-TdpVg
• https://www.bleepingcomputer.com/news/hardware/intels-secret-cpu-on-chip-management-engine-me-runs-on-minix-os/
• https://forum.osdev.org/viewtopic.php?t=32549

MINIX is likely the most used OS on earth because it's running inside the x86 processor. tl;dr the processor presented to your operating system isn't the real core of the computer; it's just a virtual machine.

EDIT: I knew there was more, but it's been so long I'd forgotten: https://www.youtube.com/watch?v=jmTwlEh8L7g

It's based on ARM TrustZone tech, and is (probably amongst other things) a tpm2 implementation within the SoC that also gates silicon initialisation (the x86 cores will not spin up without it).

I'm not sure it could be thought of as equivalent to Intel Management Engine in terms of it's overall capability, however.

Unless I missed it nothing is saying what PSP is and why its bad...

Why Posting Stupid Clickbait To Peddle Your Stupid Product Is Frowned Upon

This is not an advertising platform. If I find your advertising here, I will make an effort to not buy your stupid product, even if I was going to.

Would disk encryption not function similarly on Linux machines, aside from the extra features the T chips support?

It's a fingerprint that can be used to cross-reference and de-anonymize your online activity, either by your bank, or by the 298 unscrupulous partners who your bank has decided to share your information with. Kinda like cookies, but they don't need to ask for permission.

Probably a rudimentary device ban. Banks are usually pretty behind on these kinds of things, they'll follow some advice they were given 15 years ago, even if it doesnt make sense anymore.

Was your email verified? I’m confused because github never sent me anything by email after that step, and passkey being the highest security possible, your scenario should not happen.

MS does not get my IP address. I ensure every single login is over Tor. MS makes sure ~97% of logins require plaintext email 2FA. On a few very rare occasions over the past several years, I was able to login without the email bullshit. Maybe once per year I got lucky like that (which is perhaps comparable to the odds of getting a fresh new exit node that MS does not know about). I thought I was getting that shitty treatment for being on Tor but some non-Tor users told me they have to do the email verify every time as well, so I figured it was imposed on everyone not just Tor users.

Was your email verified? I'm confused because github never sent me anything by email after that step, and passkey being the highest security possible, your scenario should not happen.

Also a token by email is shit since forever. Email is not 2FA at all, only TOTP and Passkeys and they dont require any interaction with the email account. Also Codeberg has TOTP and Passkeys too.

The token via email was OVERLY secure in the case at hand

Overly secure for you only, not for all the other users. You lost your email verification and github then thinks you're a spammer. The world is filled with spammers stealing accounts and they have the right to secure their shitty web site a bit.

Passkeys and/or 2FA.

It’s unclear what you mean. I have my username and passkey (1FA). I did not setup any kind of 2FA (I have nothing I care to protect on their shit site), but MS imposes email verification as a forced-2FA.

But I agree that a token in one email is insecure.

Not at all. Security policy is designed for a purpose. You can never have absolute security. You can only have something that is secure enough for a task and for the assets under protection in light of threat risks. The token via email was OVERLY secure in the case at hand -- and as a consequence security was lost (specifically, availability was lost, which is part of security).

Anyway ure Codeberg next time.

Impossible to use Codeberg to submit a bug report or comment on existing bug reports that are MS Github hosted. I would never voluntarily use MS Github for any project that I control.

I only use GH to collaborate on other people’s projects. And even then, I simply do not report many bugs because I cannot be bothered to dance for Microsoft and deal with their garbage. But now it looks like I will not be reporting /any/ bugs to any GH projects.

BTW, it’s bizarre that you suggest using Codeberg just after saying email-based 2FA is “insecure”. Codeberg allows 1FA (and rightfully so).

Passkeys and/or 2FA. If you don't have either and GitHub becomes suspicious, you're no different than a hacker trying to take over accounts. But I agree that a token in one email is insecure.

Anyway use Codeberg next time.

I don't have an exhaustive list of all the models, but It's say that almost all mac without the T2 or secure enclave all have reached end of support and won't be able to run any OS they still receives security updates. Ventura (macOS 13) will be end of support very soon, so that leaves Sonoma (14), Sequoia (15) and the upcoming Tahoe 26).

I'm pretty sure that by the end of next year, all the Intel-based mac will no longer receive security updates, leaving only the M-based CPU with support.

Thanks! I would be installing linux instead of MacOS, but it does look like the hardware is compromised by this. The page you link specifically mentions these as having the feature:

• All Mac computers with Apple silicon
• MacBook Pro computers with Touch Bar (2016 and 2017) that contain the Apple T1 Chip

It does not say /all/ macbook pros. So I wonder which MacBook pros do not have that T1 chip.

I also somewhat distrust that /all/ mac computers w/Apple silicon. Surely the really old hardware like G3 wouldn’t?¹

The most interesting would be old 2nd-hand hardware that is free from this secure enclave, but still new enough to run recent MacOS if I want to occasionally boot MacOS for hardware testing purposes. I heard the next couple generations of MacOS will require at least an M1 chip. Guess I need to research where that stands w.r.t secure enclave.

(edit) The T2 chip page lists:

• MacBook Pro (13-inch, 2018, Four Thunderbolt 3 ports)

I think the macbook pros that feature non-x86 MacOS would run on were described as having Four Thunderbolt 3 ports, so I guess that rules out macbook pros. IOW, no macbook pro is spychip-free and simultaneously capable of supporting the next MacOS.

¹ I assumed Apple Silicon referred to Motorola chips, but the wikipedia page says Apple Silicon refers to arm chips.

Technically they do through the Secure Enclave and previously the Apple T2 chip, which is what allow them to lock the device when stolen, or associate a device to an Apple Business Manager account for remote management.

Thanks! That’s quite useful.

Before emailing someone or deciding whether they get my email address, I run a script that does an MX lookup which then looks for PRISM corps in the results. It also checks the PGP keyrings to see if they have a pubkey. I’ll have to expand the script to check the TXT records as well now.

Yeah it is fairly trivial to check. I called it a SPF record but technically in DNS it is a TXT record. TXT records are just a generic record type used for many different uses.

Here are a few common DNS commands to lookup TXT records:

host -t TXT domainname

nslookup -type=TXT domainname

dig -t TXT domainname

For your barracudanetworks example here we get a few TXT records back but we can see spf.protection.outlook.com is in their list and therefore allowed to send of behalf of the barracudanetworks.com domain. All of the other entries are allowed to send of their behalf too so your email isn't guaranteed to go through Microsoft.

Judging by the Salesforce/Zendesk stuff they probably have ticketing/customer management systems, which means it might be possible to contact them without going through Microsoft's email servers. Notifications from those systems would probably be sending email directly to you instead of routing it through Office365.

Thanks for the tip. I never studied the SPF stuff. Is that practical to check?

Well, in that case I guess I should target Barracuda, Proofpoint, and MX Logic in the same way, since 90+% of the world is on MS or Google platforms. That’s probably my practical answer.. to distrust any MX servers that are known to be proxies. So, I need a list of proxies like that.

I suppose that is a concern, but I think those are cloud IPs they move around occasionally and wouldn't want to make every user update their TXT records.

So for this use case I am pretty sure they would always be DNS names if the admins are following Microsoft's instructions.

It looks like they have you set your txt record to spf.protection.outlook.com which resolves to a txt record with a bunch of their IPs. So if you really wanted to make sure there weren't installs with IPs in their list you can use that txt record to get Microsoft's IP ranges and search for those as well.

This is mostly true but keep in mind SPF can have IP ranges (in different formats) and includes of other records, so you really have to write something to chase all those lookups, manage CIDR vs individual IPs vs A records, etc, and build a table to use for lookups , if you want it to be accurate.

You’re seeing that behavior because some companies may have mailboxes in M365 but use a different provider for message hygiene, such as Barracuda, Proofpoint, MX Logic, etc. The MX points to them, they forward to an M365 inbound connector (virtual MTA) after inspecting the email.

You should check for SPF records as well. If they have SPF records (and Microsoft walks them through setting up those records), they would need one for every mail server sending on their behalf.

So it appears that in your case here their MX records pointed at their own MTA that then routes at least some of that email to Microsoft. If they are using SPF records to prevent others from spoofing their email addresses, and if they are allowing Microsoft to send on their behalf there would have to be SPF records with Microsoft's domains in them.

Still no sure thing but a little more checking that you can do.

Barracuda provides email gateway security for any email server including Exchange Online.

There’s no way to tell unless you see the message route itself. To do that you’d need to see the headers of a message sent by you after it’s received by the recipient. This is simply the expected design of email transport.