61
Patronizing Passwords
Passwords suck. Let’s make them better.
New
The latest blog posts to take off on Hacker News. 473 posts.
62
Even the LastPass Will Be Stolen
How to obtain encryption keys to decrypt the LastPass vault in different scenarios
63
California’s DNA Law Violates Privacy Protections Guaranteed by State
San Francisco—Californians who’ve merely been arrested and not charged, much less convicted of a crime, have a right to privacy when it comes to their genetic material, EFF said in an amicus brief filed Nov. 13 with the state’s highest court. EFF is urging the California Supreme Court to hold that...
64
The most popular curl download – by a malware
During October 2015 the curl web site sent out 1127 gigabytes of data. This was the first time we crossed the terabyte limit within a single month. Looking at the stats a little closer, I noticed that in July 2015 a particular single package started to get very popular. The exact URL was…
65
CoreOS Introduces Clair: Open Source Vulnerability Analysis for Your Containers
No single cloud fits all. Explore how we build a more flexible future with hybrid cloud.
66
Teensy weensy crypto
As the UK's politicians continue to fail to understand what "strong cryptography" or "banning" even mean, I thought I would have a look at how simple strong cryptography can be.
67
The CA's Role in Fighting Phishing and Malware
Since we announced Let’s Encrypt we’ve often been asked how we’ll ensure that we don’t issue certificates for phishing and malware sites. The concern most commonly expressed is that having valid HTTPS certificates helps these sites look more legitimate, making people more likely to trust them. Deciding what to do here…
68
Why ninety-day lifetimes for certificates?
This is a historic blog post at this point. Please see our certificate lifetime documentation for the current status of certificate lifetimes. We’re sometimes asked why we only offer certificates with ninety-day lifetimes. People who ask this are usually concerned that ninety days is too short and wish we would offer…
69
Public Beta: December 3, 2015
Let’s Encrypt will enter Public Beta on December 3, 2015. Once we’ve entered Public Beta our systems will be open to anyone who would like to request a certificate. There will no longer be a requirement to sign up and wait for an invitation. Our Limited Beta started on September 12, 2015. We’ve issued over 11,000…
70
ImperialViolet
Thomas Ptacek laid out a number of arguments against DNSSEC recently (and in a follow up ). We don't fully agree on everything, but it did prompt me to write why, even if you assume DNSSEC, DANE (the standard for speaking about the intersection of TLS and DNSSEC) is not a foregone conclusion in web browsers.
71
Why the Tor attack matters
Earlier today, Motherboard posted a court document filed in a prosecution against a Silk Road 2.0 user, indicating that the user had been de-anonymized on the Tor network thanks to research conduct…
72
Did the FBI Pay a University to Attack Tor Users?
The Tor Project has learned more about last year's attack by Carnegie Mellon researchers on the...
73
How the new Gmail image proxy works and what this means for you
Google recently announced that images in emails will be displayed automatically by default to Gmail users, thanks to an anonymizing proxy operated by them.
74
The sad state of SMTP encryption
This is a quick recap of why I’m sad about SMTP encryption. It explains how TLS certificate verification in SMTP is useless even if you force it.
75
76
Universal DNSSEC: Secure DNS for Every Domain
CloudFlare launched just five years ago with the goal of building a better Internet. That’s why we are excited to announce that beginning today, anyone on CloudFlare can secure their traffic with DNSSEC in just one simple step.
77
78
79
80
The Government Uses Zero Days for “Offense”
Little by little, the government is opening up about its use of computer security vulnerabilities. Last month, the NSA disclosed that it has historically “released more than 91% of vulnerabilities discovered in products that have gone through our internal review process and that are made and used...
81
82
PuTTY 0.66 fixes security vulnerability
Home | FAQ | Feedback | Licence | Updates | Mirrors | Keys | Links | Team Download: Stable · Snapshot | Docs | Privacy | Changes | Wishlist
83
FBI Returns Seized Devices to EFF Client
EFF is pleased to announce that our client, Chris Roberts, is now in the possession of all of his digital devices that had been held by the FBI since April 2015. Earlier this year, Mr. Roberts was detained for tweeting about airplane network security. When he landed in Syracuse, the FBI escorted...
84
85
A vulnerability in WebLogic, WebSphere, JBoss, Jenkins, OpenNMS and others
By @breenmachine What? The most underrated, underhyped vulnerability of 2015 has recently come to my attention, and I’m about to bring it to yours. No one gave it a fancy name, there were no …
86
Hidden in plain sight: Brute-forcing Slack private files
Van Pathé tot KLM en de Rijksoverheid: ontdek hoe Dawn Technology met maatwerk software alledaagse ervaringen slimmer, sneller en beter maakt.
87
88
89
Firefox Now Offers a More Private Browsing Experience
We’re releasing a powerful new feature in Firefox Private Browsing called Tracking Protection. We created this feature because we believe in giving you m
90
