John Elliott @withoutfire

Specialist in security directives. Very PCI, always GRC, sometimes GDPR. Authors courses for @pluralsight. Security Advisor at @Jscrambler. pci.rocks Granada and London Joined August 2008

Tweets

811
Followers

590
Following

239
Likes

1K

John Elliott @withoutfire

2 years ago

@VirginAtlantic Really? I've tried two browsers and it doesn't do anything when you click it.

0 0 0 28 0

View Details

John Elliott @withoutfire

2 years ago

Hey @VirginAtlantic is the "Need help, Chat to us" button on your site always broken?

2 0 0 181 0

View Details

John Elliott @withoutfire

3 years ago

Given the %ge of neurodiverse people in our community, why do keynote sessions have so much unnecessary loud music and flashing lights? #BlackHat2023

0 0 2 183 0

View Details

John Elliott @withoutfire

3 years ago

Great to meet new friends and many old colleagues this week at the PCI SSC BoA meeting.

We're excited to welcome our new expanded Board of Advisors at our first in person meeting in Washington DC this week! ICYMI: check out our recent release which includes all of the representatives ➡️bit.ly/44kd6fW

0 2 6 1K 1

0 0 0 215 0

View Details

John Elliott @withoutfire

3 years ago

@matthew_d_green It is often the other way around, that the liability shift is the only way of moving a market to adopt new safer technologies. Entities can stay on old, insecure tech as long as they are happy to hold the liability. See especially the roll out of EMV chip in the US.

0 0 0 32 0

View Details

John Elliott @withoutfire

3 years ago

@MarianSo99 @pluralsight That might be OK when they are all 1st party, but my research is that most sites have 50% of their JavaScript coming from 3rd parties. I wrote more on the Pluralsight blog. 2/2. pluralsight.com/blog/security-…

1 0 1 21 0

View Details

John Elliott @withoutfire

3 years ago

@MarianSo99 @pluralsight I’m sorry if I wasn’t clear. Each microservice typically wants a JavaScript library in the browser to communicate with it. Every single JavaScript file loaded by the browser increases the attack surface. 1/2.

1 1 2 19 0

View Details

John Elliott @withoutfire

3 years ago

@PrivacyMatters @ICOnews Surely they are a processor not a controller?

1 0 0 39 0

View Details

John Elliott @withoutfire

3 years ago

@AlecMuffett Well, I have seen lots of things that were half-encrypted. I mean they were not really encrypted but the people who developed the encryption thought they were. One was a revolutionary new technique I described as “fairly unique key per transaction”. You can work out the acronym.

0 0 1 36 0

View Details

Aaron Rosenmund @ARosenmund

3 years ago

For any of you attending @RSAConference #RSAC2023 I really excited to put on a hands on lab, working on easy emulation for blue teams. Should be a lot of fun! Becoming the Threat: Blue Team Friendly Attack Simulations | RSA Conference rsaconference.com/USA/agenda/ses…

2 1 1 363 0

View Details

John Elliott @withoutfire

3 years ago

@joftius @1Br0wn And airline safety is *highly regulated* - and before that happened, there were lots of crashes.

0 0 2 91 0

View Details

John Elliott @withoutfire

3 years ago

@EleanorDallaway @happygeek @Mike_at_LPDE A small UPS perhaps? Hard to tell from just a side view.

0 0 0 12 0

View Details

John Elliott @withoutfire

4 years ago

@Suw Probably ORG members. In some circles you are famous.

1 0 2 61 0

View Details

John Elliott @withoutfire

4 years ago

@theDPOdaily OMB A-130 circular which is often used as the definition in NIST publications obamawhitehouse.archives.gov/sites/default/… (p33) and/or CCPA leginfo.legislature.ca.gov/faces/codes_di… 1798.140 (o)

0 0 0 0 0

View Details

John Elliott @withoutfire

4 years ago

@riskybusiness Really looking forward to hearing your interview with her on the show. Please.

1 0 0 0 0

View Details

John Elliott @withoutfire

4 years ago

@ruskin147 Reboot ...

0 0 0 0 0

View Details

John Elliott @withoutfire

4 years ago

@oliviasolon It's also ignoring your opt-out with a marketing message disguised as a service message, once for @ICOnews because they do have strong views about this type of thing.

0 0 0 0 0

View Details

John Elliott @withoutfire

4 years ago

@javierruiz They are all pretty close to each other now, more so last week!

0 0 1 0 0

View Details

John Elliott @withoutfire

4 years ago

@AlecMuffett @futureidentity @mwfulk @profgalloway I love that someone called you a “crypto bro” without probably knowing how cryptography you actually are!