4951
New Tools for Detecting HTTPS Interception
The practice of HTTPS interception continues to be commonplace on the Internet. This blog post discusses types of monster-in-the-middle devices and software, and how to detect them.
New
The latest blog posts to take off on Hacker News. 8,772 posts.
4952
AMD products are not susceptible to SPOILER exploit
Download drivers and software for AMD products — includes Windows and Linux support, auto-detect tools & detailed guides for installation.
4953
Google’s Nest fiasco harms user trust and invades their privacy
Last month, Google announced that its Nest Secure would be updated to work with Google Assistant software. The problem? Google never told users its product had a microphone to begin with. Simple oversight or invasion of privacy? We break it down.
4954
2019 Guide to Cryptographic Key Sizes and Algorithm Recommendations
A simple, accessible recommendation for key sizes and recommended algorithms for various cryptographic algorithms.
4955
PrivateStorage.io: A secure and privacy-focused cloud storage solution
Announcing a cloud storage solution where you are in control of all your data with client-side encryption and no data or vendor lock-in.
4956
Extracting Bitlocker Keys from a TPM
Extracting BitLocker keys sealed with a TPM by sniffing the LPC bus
4957
4958
Researchers find trapdoor in SwissVote election system
A team of researchers have examined the source code published as part of the SwissPost e-voting system, provided by Scytl, and discovered a cryptographic trapdoor.
4959
Firefox Send: Free encrypted file transfer service
At Mozilla, we are always committed to people’s security and privacy. It’s part of our long-standing Mozilla Manifesto. We are continually looking for
4960
Cryptographic coin flipping, now in Keybase
You're reading the Keybase blog. There are more posts . When you're done, you can install Keybase .
4961
Using Let's Encrypt for Internal Servers (2018)
Let’s Encrypt is a revolutionary new certificate authority that provides free certificates in a completely automated process. These certificates are …
4962
Myequifax.com Bypasses Credit Freeze Pin
Most people who have frozen their credit files with Equifax have been issued a numeric Personal Identification Number (PIN) which is supposed to be required before a freeze can be lifted or thawed. Unfortunately, if you don’t already have an account at the credit bureau’s new myEquifax portal , it may be simple for…
4963
Investigating the 900GB “Collection #1-5” password leaks with R
This post shows how to process gigabytes of unstructured data with the Spark framework and using the R language.
4964
Facebook’s Privacy Cake
Mark Zuckerberg’s announcement of A Privacy-Focused Vision for Social Networking is not some dramatic pivot: it is a growth opportunity for Facebook and a challenge for regulators.
4965
800M Email Addresses Leaked Online by Email Verification Service
Our Biggest Data Breach Discovery of 2019 a massive 800 million emails leaked online. This data breach uncovered how an email verification service uses spam
4966
4967
Serious Chrome zero-day
The Sophos Blog
4968
4969
How to Spoof PDF Signatures
One year ago, we received a contract as a PDF file. It was digitally signed. We looked at the document - ignoring the "certificate is not tr...
4970
Facebook Doubles Down on Misusing Your Phone Number
When we publicly demanded that Facebook stop messing with users’ phone numbers last week, we weren’t expecting the social network to double down quite like this: By default, anyone can use the phone number that a user provides for two-factor authentication (2FA) to find that user’s profile. For...
4971
Facebook exploit – Confirm website visitor identities
I discovered a Facebook bug which allows me to identify whether a visitor is logged in to a specific Facebook account. It can check hundreds of identities per second.
4972
German Data Privacy Commissioner Says Article 13 Inevitably Leads to Filters
German Data Privacy Commissioner Ulrich Kelber is also a computer scientist, which makes him uniquely qualified to comment on the potential consequences of the proposed new EU Copyright Directive. The Directive will be voted on at the end of this month, and its Article 13 requires that online...
4973
The Supreme Backdoor Factory
Recently I was playing with VirusTotal Intelligence and while testing some dynamic behavior queries I stumbled upon this strange PE binary (MD5: …
4974
Millions of Binaries Later: A Look into Linux Hardening in the Wild
With Sophos Cloud Native Security, you can easily integrate protection across multiple environments while minimizing detection time and response.
4975
2FA on the command line
OTP: One-Time Password TOTP: Time-based One-time Password algorithm 2FA: Two-factor authentication There is no shortage of OTP 2FA apps availiable for your phone, such as Google Authenticator or Duo Mobile. These apps take an initial secret code, and create a TOTP anytime you need a 2FA code for login.… …
4976
4977
The most popular docker images each contain at least 30 vulnerabilities
we found that 44% of docker image scans had known vulnerabilities, and for which there were newer and more secure base image available. Most vulnerabilities originate in the base image you selected. For that reason, remediation should focus on base image fixes.
4978
ETS Isn't TLS and You Shouldn't Use It
The good news: TLS 1.3 is available, and the protocol, which powers HTTPS and many other encrypted communications, is better and more secure than its predecessors (including SSL). The bad news: Thanks to a financial industry group called BITS, there’s a look-alike protocol brewing called ETS (or...
4979
PureBoot, the High Security Boot Process
Purism makes premium phones, laptops, mini PCs and servers running free software on PureOS. Purism products respect people's privacy and freedom while protecting their security.
4980
ICANN Calls for DNSSEC for All Domains Following Domain Hijacking Attempts
Announcement that the Internet Corporation for Assigned Names and Numbers (ICANN) believes there is an ongoing and significant risk to key parts of the Domain Name System (DNS) infrastructure and is calling for the full deployment of the Domain Name System Security Extensions (DNSSEC) across all unsecured domain names.