481
Formal GDPR complaint against Google’s internal data free-for-all
Brave filed a GDPR complaint v Google for infringing the GDPR “purpose limitation” principle. Enforcement would be tantamount to a functional separation of Google’s business.
New
The latest blog posts to take off on Hacker News. 612 posts.
482
Why Not WireGuard
The latest thing that is getting a lot of attention is WireGuard - the new shooting star in terms of VPN. But is it as great as it sounds? I would like to discuss some thoughts, have a look at the implementation and tell you why WireGuard is not a solution that will replace IPsec or OpenVPN.
483
Finding McAfee: a case study on geoprofiling and imagery analysis
Identify past, current, and possible future locations through the geolocation and chronolocation of media provided by a specific user.
484
Zero Trust Networks
I am leery of jargon. I am as guilty of using it as the next engineer, but there comes a point where there are just too many precise, narrowly-understood terms polluting your vocabulary. The circle of people you can talk to shrinks until going to the store to buy milk feels like an exercise in speaking a foreign…
485
486
Popular iPhone and iPad Apps Snooping on the Pasteboard
This article provides an investigation of some popular apps that frequently access the pasteboard without user consent. These apps range from popular games and social networking apps, to news apps of major news organizations. We found that many apps quietly read any text found in the pasteboard every time the app is…
487
United Kingdom to introduce security labelling on connected devices
In a press release from the UK government on January 27th 2020 called “Government to strengthen security of internet-connected products”, the new law and i
488
489
Signs you're following a fake Twitter account
Nixintel Open Source Intelligence & Investigations2020277 points149 commentsSociety, Policy & Culture details
The challenge of dealing with fake accounts that spread disinformation is probably one of the greatest challenges facing the large social media companies. Most methods used to detect fake Twitter a…
490
SeL4 Design Principles
seL4 has been our team’s greatest achievement, but it didn’t fall out of the sky: it was the result of 15 years of research, and has evolved further for the past 10 years. From the begi…
491
Zero Trust Information
Zero Trust Networking is security with Internet assumptions; there is tremendous value if we apply the same approach to information.
492
TRRespass: Rowhammer against DDR4
Project Description Rowhammer haunted us for the better part of the past decade. Most DDR3 modules were found to be susceptible to this vulnerability which can compromise data directly inside the memory cells. What made it so scary was the fact that it could be exploited from software on PCs, clouds, smartphones, over…
493
Open-sourcing Riskquant, a library for quantifying risk
Netflix has a program in our Information Security department for quantifying the risk of deliberate (attacker-driven) and accidental…
494
The unexpected Google wide domain check bypass
David Schütz's bug bounty writeups
495
The browsers are probably running the TLS show now
You're probably reading this page because you've attempted to access some part of my blog (Wandering Thoughts) or CSpace , the wiki thing it's part of. Unfortunately you're using a browser version that my anti-crawler precautions consider suspicious, most often because it's too old (most often this applies to versions…
496
497
The EARN IT act is an attack on end-to-end encryption
Yesterday a bipartisan group of U.S. Senators introduced a new bill called the EARN IT act. On its face, the bill seems like a bit of inside baseball having to do with legal liability for informati…
498
Who is Facebook's mysterious “Lan Tim 2”?
Facebook has an interesting feature. It will let you see which companies have associated your off-Facebook activity with your Facebook account. If you visit: https://www.facebook.com/off_facebook_activity/ you'll see what companies are snitching on you to Facebook. Alice St⭕️llmeyer@StollmeyerEU#AirBnB shares your…
499
Facebook sues Namecheap
We don’t want people to be deceived, so we take legal action against misleading domains.
500
Beer Drinkers Guide to SAML
Learn about SAML authentication and the mechanics behind some of the most common SAML use cases, all through the fictional BaaS (Beer-as-a-Service).
501
502
Project Svalbard, Have I Been Pwned and its ongoing independence
This is going to be a lengthy blog post so let me use this opening paragraph as a summary of where Project Svalbard is at: Have I Been Pwned is no longer being sold and I will continue running it independently. After 11 months of a very intensive process culminating
503
Remote access to production infrastructure (death to the VPN)
A little over a year ago, my employer threw away our VPNs in production and production-like server environments and moved towards a set of new, cutting-edge technologies that make remote access sim…
504
505
‘Re-education’, forced labour and surveillance beyond Xinjiang
Australian Strategic Policy Institute2020255 points106 commentscited by 11Society, Policy & Culture details
‘Re-education’, forced labour and surveillance beyond Xinjiang. What’s the problem? The Chinese government has facilitated the mass transfer of Uyghur and other ethnic minority1 citizens from the far west region of Xinjiang to factories across the country. Under conditions that strongly suggest forced labour, Uyghurs…
506
How many users block Google analytics? (2017)
Comparing Google Analytics with server logs
507
A mysterious bug in the firmware of Google's Titan M chip
Starting with the release of the Pixel 3, all of Google's Pixel Android smartphones come with the Titan M security chip on board. When I realized the Pixel 3a XL I purchased also had it, I decided to try to take advantage of it in an app I work on. It turned out that using the Titan M chip through the Android Keystore…
508
FCC Proposes to Fine Wireless Carriers $200M for Selling Customer Location Data
The U.S. Federal Communications Commission (FCC) today proposed fines of more than $200 million against the nation’s four largest wireless carriers for selling access to their customers’ location information without taking adequate precautions to prevent unauthorized access to that data. While the fines would be among…
509
510
Using BPF to Transform SSH Sessions into Structured Events
Teleport’s Enhanced Session Recording feature can add vital extra visibility into commands being run on your systems.