The Internet Archive has filed a federal challenge to a new Washington State law that intends to make online service providers criminally liable for providing access to third parties' offensive materials. There is a press release and an article about it.
Online payment processing for internet businesses. Stripe is a suite of payment APIs that powers commerce for businesses of all sizes.
Kaspersky Lab announces the discovery of ‘Gauss’, a new cyber-threat targeting users in the Middle East
The Fixed Bounty Bug Revealed Last month Google awarded our security analyst Luka Treiber a Chromium Security Reward for a high-severity ...
Earlier today, the Wall Street Journal published evidence that Google has been circumventing the privacy settings of Safari and iPhone users, tracking them on non-Google sites despite Apple's default settings, which were intended to prevent such tracking. This tracking, discovered by Stanford...
SSH keys are useful to login over ssh (secure shell) without typing a password. They are also used by Github and other version control systems for passwordless authentication. Here is some basic information from the software developer point of view how to use SSH keys for maximum comfort and security. These…
Suppose for a moment that you are running a web site that has a poorly implemented password database that stores password hashes using some...
"I can assure you that they would not be able to do that with the Bank of America security." The words of the Bank of America supervisor echoed in our
Late Friday afternoon , the government asked the Supreme Court to dismiss our lawsuit challenging the constitutionality of a 2008 law gives the government unprecedented authority to monitor Americans ’ international emails and phone calls.
This specification describes a JavaScript API for performing basic cryptographic operations in web applications, such as hashing, signature generation and verification, and encryption and decryption. Additionally, it describes an API for applications to generate and/or manage the keying material necessary to perform…
Way back in 1974, Paul Karger and Roger Schell discovered a devastating attack against computer systems. Ken Thompson described it in his classic 1984 speech, “Reflections on Trusting Trust.” Basically, an attacker changes a compiler binary to produce malicious versions of some programs, INCLUDING ITSELF. Once this is…
When Qwest refused the NSA’s illegal request that it hand over its customers’ data without a warrant, the NSA wasn’t happy. According to former Qwest CEO Joseph Nacchio, the government hit back for the telecom’s refusal by denying them lucrative contracts (log-in required) worth hundreds of...
When a browser connects to an HTTPS site it receives signed certificates which allow it to verify that it's really connecting to the domain that it should be connecting to. In those certificates are pointers to services, run by the Certificate Authorities (CAs) that issued the certificate, that allow the browser to…
Crypteto has a 49,152-bit symmetric key: The most important issue of any encryption product is the ‘bit key strength’. To date the strongest known algorithm has a 448-bit key. Crypteto now offers a 49,152-bit key. This means that for every extra 1 bit increase that Crypteto has over its competition makes it 100%…
See part 2 of Privacy in Ubuntu 12.10: Full Disk Encryption. Earlier this month the eagerly awaited free software operating system Ubuntu 12.10 was released, and it includes a slew of new features (YouTube link), some of which have infuriated users because of privacy concerns. Over the last couple...
This is a big deal: On May 13th, 2008 the Debian project announced that Luciano Bello found an interesting vulnerability in the OpenSSL package they were distributing. The bug in question was caused by the removal of the following line of code from md_rand.c MD_Update(&m,buf,j); [ .. ] MD_Update(&m,buf,j); /* purify…
