331
PayPal does not know how to detect fraud
Contact with an owner of tooltrainer.com domain name.
332
How Heartbleed could've been found
This blog is written by Hanno Böck. Unless noted otherwise, its content is licensed as CC0 .
333
334
Magento eCommerce PHP Remote Code Execution
Critical remote code execution vulnerability in Magento (SUPEE-5344). Patch immediately. Affects 200,000 stores. Includes patch download and analysis.
335
Buenos Aires Censors and Raids the Technologists Fixing Its E-Voting System
Buenos Aires is currently in the middle of electing its mayor and city council. With a first round that took place on July 5th, and a second round due on July 19th, the election is the first time Argentina's capital city has used an electronic voting system called Vot.ar, created by local company...
336
337
338
The Collapse of the US-EU Safe Harbor
When people who care about technology look back at the year 2015, they will remember October as the month when the EU-U.S. Safe Harbor collapsed. An international legal agreement that has been in place for 15 years was invalidated in a single day. On Oct. 6, the Court of Justice of the European Union struck...
339
FBI Returns Seized Devices to EFF Client
EFF is pleased to announce that our client, Chris Roberts, is now in the possession of all of his digital devices that had been held by the FBI since April 2015. Earlier this year, Mr. Roberts was detained for tweeting about airplane network security. When he landed in Syracuse, the FBI escorted...
340
CoreOS Introduces Clair: Open Source Vulnerability Analysis for Your Containers
No single cloud fits all. Explore how we build a more flexible future with hybrid cloud.
341
Safe Native Code
Joe Duffy's Blog | Adventures in the high-tech underbelly
342
Tarsnap email confirmation bypass
One consequence of these unsolicited security scans is that — since they feed a variety of inputs to forms, including the account creation form — I see a lot of obviously fake signup attempts (alas, none yet from the world's most obviously fake domain name ). These are harmless, since the signup code sends out a…
343
Improved Digital Certificate Security
Posted by Stephan Somogyi, Security & Privacy PM, and Adam Eijdenberg, Certificate Transparency PM On September 14, around 19:20 GMT, Syma...
344
345
Signify: Securing OpenBSD from Us to You
I'm going to talk today about signify, a tool I wrote for the OpenBSD project that cryptographically signs and verifies. This allows us to ensure that the releases we ship arrive on your computer in their original, intended form, without tampering.
346
347
The Web Authentication Arms Race – A Tale of Two Security Experts
Web authentication systems have evolved over the past ten years to counter a growing variety of threats. This post will present a fictional arms race between a web application developer and an attacker, showing how different threats can be countered with the latest security technologies.
348
The End of Safe Harbor and a Scary Path Forward
Some in detail analysis about what the end of safe harbor means for small companies, especially in Europe.
349
Why your 'A' grade SSL is 'outdated cryptography' on Chrome
Get EV SSL certificates in hours, not days. Prechecks before you pay. We do the hard work for you.
350
351
OAuth1, OAuth2, OAuth..? (2013)
TL;DR OAuth2 sucks. Please don't think about OAuth2 as about the next generation of OAuth1. They are completely different like colors: O...
352
353
Komodia SSL certificates are in many products
So, as people have started turning over stones, looking to see how common these Komodia certificates are, some surprising (and depressing) things are beginning to surface. It does appear that Komod…
354
The Most Dangerous Code in the Web Browser
Personal website of Stefan Heule
355
TPP Threatens Security and Safety by Locking Down US Policy on Source Code Audit
Multiple recent reports on serious security vulnerabilities in cable modems and routers paint a dire picture of the state of security of the devices that millions of users depend upon to connect to the Internet. Such vulnerabilities can be exploited to disable our access, snoop on our personal...
356
357
Google, the Wassenaar arrangement, and vulnerability research
Posted by Neil Martin, Export Compliance Counsel, Google Legal Tim Willis, Hacker Philanthropist, Chrome Security Team Cross-posted on...
358
Telegram stalking
Update 20151216: This quick post got far more attention than expected. I regret not mentioning that the leakage can easily be prevented via a setting. In practice the problem remains, users in general will have no idea about this being a relevant setting to change and will stay with the default. The best discussion on…
359
Volkswagen and Cheating Software
Portuguese translation by Ricardo R Hashimoto For the past six years, Volkswagen has been cheating on the emissions testing for its diesel cars. The cars’ computers were able to detect when they were being tested, and temporarily alter how their engines worked so they looked much cleaner than they actually were. When…
360
The Problem with Mobile Phones
Mobile phones have become ubiquitous and basic communications tools—now used not only for phone calls, but also for accessing the Internet, sending text messages, and documenting the world. Unfortunately, mobile phones were not designed for privacy and security. Not only do they do a poor job of protecting your…