121
122
123
How to build (and how not to build) a secure “remember me” feature
This content is now available in the Pluralsight course "Secure Account Management Fundamentals" [http://www.pluralsight.com/courses/secure-account-management-fundamentals] Here’s the scenario – a user logs in to your website, comes back tomorrow and… has to log in again. The idea of the “remember me” feature – and
124
125
Cryptography is a science, not engineering
If we were still in the 1990s, I would agree with Thomas. 1990s cryptography was full of holes, and the best you could hope for was to know how your tools were broken so you could try to work around their deficiencies. This was a time when DES and RC4 were widely used, despite having well-known flaws. This was a time…
126
127
Sleepwalking into censorship
The essential detail is that they will assume you want filters enabled across a wide range of content, and unless you un-tick the option, network filters will be enabled.
128
129
130
Google Account Recovery Vulnerability
Global Main Authentication and Identification Library (GMAIL) was exposed to a security threat by Oren Hafif.
131
Restoring Trust in Government and the Internet
In July 2012, responding to allegations that the video-chat service Skype—owned by Microsoft—was changing its protocols to make it possible for the government to eavesdrop on users, Corporate Vice President Mark Gillett took to the company’s blog to deny it. Turns out that wasn’t quite true. Or at least he—or the…
132
133
Google Fiber Continues Awful ISP Tradition of Banning “Servers”
Update (10/16/2013): Google Fiber has made a change to their Acceptable Use Policy that clarifies that some non-commercial uses for running servers are permitted. We applaud Google for making this change, but note that there are still provisions to take issue with in the policy, such as the...
134
135
Google has indexed thousands of publicly accessible HP printers
A quick, well crafted Google search returns “About 86,800 results” for publically accessible HP printers.
136
EFF Has Lavabit’s Back in Contempt of Court Appeal
San Francisco - Federal law enforcement officers compromised the backbone of the Internet and violated the Fourth Amendment when they demanded private encryption keys from the email provider Lavabit, the Electronic Frontier Foundation (EFF) argues in a brief submitted Thursday afternoon to the US...
137
138
Facebook Releases Data, Including All National Security Requests
We’re pleased that we can now include in a transparency report all U.S. national security-related requests including FISA as well as National Security Letters.
139
Who's Selling Credit Cards From Target
The previous two posts on this blog have featured stories about banks buying back credit and debit card accounts stolen in the Target hack and that ended up for sale on rescator[dot]la , a popular underground store. Today’s post looks a bit closer at open-source information on a possible real-life identity for the…
140
The Battle for Power on the Internet
We’re in the middle of an epic battle for power in cyberspace. On one side are the traditional, organized, institutional powers such as governments and large multinational corporations. On the other are the distributed and nimble: grassroots movements, dissident groups, hackers, and criminals. Initially, the Internet…
141
Google confirms Java and OpenSSL crypto PRNG on Android are broken
News and insights on the Android platform, developer tools, and events.
142
143
How the US Government will Smear, Slight Whistleblower Edward Snowden
Edward Snowden said that he stepped forward because he came to realize that the US government is engaged in invasions of Americans' privacy on a vast and unprecedented scale, and was hiding its int...
144
The Strange Story of Dual_EC_DRBG – suspected NSA backdoor (2007)
Random numbers are critical for cryptography: for encryption keys, random authentication challenges, initialization vectors, nonces, key-agreement schemes, generating prime numbers and so on. Break the random-number generator, and most of the time you break the entire security system. Which is why you should worry…
145
146
SSL: Intercepted today, decrypted tomorrow
Explore thought leadership, industry insights, and other resources related to cybercrime detection, disruption, and takedowns.
147
Piercing Through WhatsApp’s Encryption
WhatsApp has been plagued by numerous issues in their security: easily stolen passwords, unencrypted messages and even a website that can change anyone’s status. But that streak is not yet over.
148
Can Snowden be targeted using the Adobe breach?
Note: As a professional courtesy to those at Adobe who are doing their absolute best to mitigate this breach, I have partially redacted all ...
149
Facebook reveals friends list even when it’s set to private
The Sophos Blog
150
