Light

Episode #950 Quiz

Leo Turns 67
Date: 2023-11-28 | Length: 2 hrs | Episode page at twit.tv

About this episode

Security Now #950 covered lingering Adobe Flash Player updater services still phoning home after end-of-life, VeraCrypt’s deliberate irrecoverability and password backup practices, Firefox 120 privacy features, Germany’s court-backed Do Not Track enforcement, ownCloud’s CVE-2023-49103 credential disclosure, CrushFTP RCE, biometric sensor bypasses, ActiveMQ exploitation, and credit bureau lock recommendations.

Your name and email are stored only in your browser local storage for convenience. They are not retained server-side.

NameEmail

Question 1: In the discussion of Firefox 120, what specific change was described as helping enterprise compatibility by allowing Firefox to trust certificates installed via the host operating system?

Question 1

In the discussion of Firefox 120, what specific change was described as helping enterprise compatibility by allowing Firefox to trust certificates installed via the host operating system?

Require all third-party certificates to be pinned manually in settings Import TLS trust anchors from the operating system root store Replace TLS trust anchors with URL tracking protection rules Disable Firefox's built-in root store in private browsing mode

Question 2: What was the key security concern Steve raised about Adobe Flash Player Updater still running on his machine years after Flash EOL?

Question 2

What was the key security concern Steve raised about Adobe Flash Player Updater still running on his machine years after Flash EOL?

It might keep querying a legacy update domain indefinitely It could bypass Windows Task Scheduler by using a kernel driver It would automatically reinstall Flash content support in modern browsers It would decrypt old Flash SWF files using Adobe's current signing key

Question 3: According to the ownCloud discussion, what immediate remediation did Steve say was required after exploiting CVE-2023-49103?

Question 3

According to the ownCloud discussion, what immediate remediation did Steve say was required after exploiting CVE-2023-49103?

Patch only the OAuth2 app and leave graphapi unchanged Reinstall ownCloud from the latest container image only Delete the exposed phpinfo file and rotate affected secrets Disable WebDAV and change only the admin password

Question 4: What was the main technique described for abusing the Goodix fingerprint sensor weakness across Windows and Linux?

Question 4

What was the main technique described for abusing the Goodix fingerprint sensor weakness across Windows and Linux?

Clone the sensor's private key to make SDCP trust a fake device Exploit a BIOS password reset to disable fingerprint verification Enroll a fingerprint under Linux, then redirect Windows to that database Replay a stored fingerprint template directly to the host over USB

Question 5: What was Steve's bottom-line advice about storing Passkeys in relation to traditional passwords?

Question 5

What was Steve's bottom-line advice about storing Passkeys in relation to traditional passwords?

Keep Passkeys in the browser but passwords in the vault Store Passkeys only on a separate physical token Avoid password managers because Passkeys are weaker than passwords Keep Passkeys in the same vault as passwords

Cancel

My Data//Security & Privacy//Clear Local Data

© 2026 Ken ArmstrongSecurity Now™ is a trademark of TWiT LLC. All trademarks and copyrights of the Security Now podcast are respected and reserved to their respective holders.
This is a hobby project made with love and admiration for what Steve Gibson and Leo Laporte have built over 20 years.