1
The Modern Guide to OAuth
Learn how OAuth 2.0 works with this simplified explanation and guide. Learn what it is, why it's essential for secure authorization, and best practices for implementation.
New
The latest blog posts to take off on Hacker News. 366 posts.
2
Germany: Data retention to be abolished
According to the German Minister of Justice data retention or "the storage of telecommunications data without any reason" could soon come to an end.
3
Unusual login activity was due to bug
As part of our commitment to security, we regularly monitor our services for actual, suspected, or attempted malicious or unusual activity. We recently investigated reports of an uptick of users recei[..]
4
Implant.ARM.iLOBleed.a
HP servers provide a management module called iLO (a.k.a. Integrated Lights-Out), which turns on as soon as the power cable is connected, loading a full-blown proprietary operating system. This module has full access to all the firmware, hardware, software, and operating system installed on the server. In addition to…
5
6
Microsoft Teams: 1 feature, 4 vulnerabilities
Microsoft Team's link preview feature is susceptible to spoofing and vulnerable to Server-Side Request Forgery. Team's Android users can be DoS'ed and, in the past, their IP address could be leaked.
7
8
Faking a Positive Covid Test
True cyber security combines advanced technology and best practice. Get tips and read articles on how to take your online security even further.
9
The Belgian government has removed ‘backdoor requirement’ from new law
The Belgian government has removed 'backdoor requirement' from new law after international protest.
10
China issues new encryption import control
On November 2, 2021, Ministry of Commerce of China (“MOFCOM”) officially released the revised Catalogue of Technologies Subject to Import Prohibition and Restriction (“Technology Catalogue”), effective immediately, which identifies, among others, foreign “data encryption technology employing a key length greater than…
11
New EU data blockage as German court would ban many cookie management providers
Alston & Bird’s Dan Felz and Peter Swire look at the recent Wiesbaden Administrative Cou
12
A deep dive on a Facebook reseller of bikes stolen in Colorado
Bike Index tracks a Colorado-to-Mexico stolen bike pipeline - and learns things along the way
13
Third High Severity CVE in Log4j Is Published
The Logging Services Security Team takes security seriously. This allows our users to place their trust in Log4j for protecting their mission-critical data. On this page, we will help you find guidance on security-related issues and access to known vulnerabilities.
14
Pegasus vs. Predator
Two Egyptians—exiled politician Ayman Nour and the host of a popular news program (who wishes to remain anonymous)—were hacked with Predator spyware, built and sold by the previously little-known mercenary spyware developer Cytrox. The phone of Ayman Nour was simultaneously infected with both Cytrox’s Predator and NSO…
15
Cryptocurrency scams cost owners $7.7B in 2021, driven by DeFi-based “rug pulls”
Crypto scams were once again the largest form of crypto crime, with over $7.7 billion worth of cryptocurrency taken from victims worldwide.
16
Log4j 2.15.0 – Previously suggested mitigations may not be enough
Log4j 2.15.0 and previously suggested mitigations may not be enough, Author: Renato Marinho
17
Crypto wallet security as seen by security engineers
How to build secure crypto wallets, analysing issues found during crypto wallet security audits.
18
Preventing Pool-Party Attacks
Brave has identified a new category of tracking vulnerability, forms of which are present in all browsers. We call this category of attack “pool-party” attacks because the attack uses collections (or “pools”) of limited-but-shared resources to create side channels.
19
A deep dive into an NSO zero-click iMessage exploit: Remote Code Execution
Posted by Ian Beer & Samuel Groß of Google Project Zero We want to thank Citizen Lab ...
20
21
Hex-rays is moving to a subscription model
Hex-Rays is moving to a subscription model In 2022, we will update the catalogue of products available under our subscription model. Our new bundles are
22
23
24
Vivaldi: Violating CoC on forum may close your email account
We’re building a Community that is happy, kind, and constructive. Read our Code of Conduct for and find out how you can help us get there.
25
Managed by Bots: surveillance of gig economy workers
What if your boss was an algorithm? What would you do if your employer suddenly fired you or reduced your pay without telling you why? And without being willing to give you a reason when you ask for one?
26
Widespread exploitation of critical remote code execution in Apache Log4j
On December 10, 2021, Apache released a fix for CVE-2021-44228, a critical RCE vulnerability affecting Log4j that is being exploited in the wild.
27
0-Day Vulnerability on Log4j
Learn about the Log4j vulnerability and how you can combat it. Read this comprehensive guide to get actionable tips.
28
29
Chrome users beware: Manifest v3 is deceitful and threatening
Like FLoC and Privacy Sandbox before it, Google Chrome’s Manifest V3 is another example of the inherent conflict of interest that comes from Google controlling both the dominant web browser and one of the largest internet advertising networks.
30
Protected Content, Delete by Date, Device Management and more
Today's update brings tools to prevent others from saving content from groups and channels, the ability to delete messages for specific periods of time, new ways to manage your connected devices, post anonymously in public groups on behalf of your channel and more.