1
Instagram's Million Dollar Bug
How participation in Facebook's bug bounty not only led to the complete compromise of Instagram, but also legal threats and intimidation
2
Let's Encrypt is Trusted
We’re pleased to announce that we’ve received cross-signatures from IdenTrust, which means that our certificates are now trusted by all major browsers. This is a significant milestone since it means that visitors to websites using Let’s Encrypt certificates can enjoy a secure browsing experience with no special…
3
Entering Public Beta
We’re happy to announce that Let’s Encrypt has entered Public Beta. Invitations are no longer needed in order to get free certificates from Let’s Encrypt. It’s time for the Web to take a big step forward in terms of security and privacy. We want to see HTTPS become the default. Let’s Encrypt was built to enable that…
4
Our First Certificate Is Now Live
Let’s Encrypt passed another major milestone by issuing our first certificate. You can see it in action here. Our cross signature is not yet in place, however this certificate is fully functional for clients with the ISRG root in their trust store. When we are cross signed, approximately a month from now, our…
5
How is NSA breaking so much crypto?
There have been rumors for years that the NSA can decrypt a significant fraction of encrypted Internet traffic. In 2012, James Bamford published an article quoting anonymous former NSA officials stating that the agency had achieved a “computing breakthrough” that gave them “the ability to crack current public…
6
I noticed some disturbing privacy defaults in Windows 10
Adventures in diy, electronics, programming, remote control and anything else.
7
Hidden backdoor API to root privileges in Apple OS X
TL;DR The Admin framework in Apple OS X contains a hidden backdoor API to root privileges. It’s been there for several years (at least since 2011), I found it in October 2014 and it can be exploite…
8
Extracting the SuperFish certificate
I extracted the certificate from the SuperFish adware and cracked the password (" komodia ") that encrypted it. I discuss how down below. T...
9
10
We are under attack
Fighting censorship with technology since 2011. We use AI to monitor censorship and expand free speech worldwide.
11
12
13
Britons: You Have 72 Hours to Stop the Snooper's Charter
Update: You did it! After a forceful debate on Monday 26 January, in which many peers protested the introduction of these amendments, Lord Blair withdrew them from consideration. Directly after the Charlie Hebdo massacre, we cautioned the public and politicians to be "wary of any attempt to rush...
14
China's Man-On-the-Side Attack on GitHub
On March 27 The following message was posted on the official GitHub blog: We are currently experiencing the largest DDoS (distributed denial of service) attack in github.coms history. The attack began around 2AM UTC on Thursday, March 26, and involves a wide combination of attack vectors. These incl[...]
15
EFF’s Game Plan for Ending Global Mass Surveillance
We have a problem when it comes to stopping mass surveillance. The entity that’s conducting the most extreme and far-reaching surveillance against most of the world’s communications—the National Security Agency—is bound by United States law. That’s good news for Americans. U.S. law and the...
16
If you've nothing to hide, you've got nothing to fear
Since 1851 Amsterdam had a registry that recorded the following innocent pieces of data about the residents: Name, Date of birth, Address, Marital Status, Parents, Profession, Religion, Previous Addresses and Date of Death if deceased. For many years this system served well and was kept meticulously up to date.
17
Researchers Could Have Uncovered Volkswagen’s Emissions Cheat If Not for DMCA
Automakers argue that it’s unlawful for independent researchers to look at the code that controls vehicles without the manufacturer’s permission. We’ve explained before how this allows manufacturers to prevent competition in the markets for add-on technologies and repair tools. It also makes it harder for watchdogs to…
18
It's Time to Break Up the NSA (2014)
The NSA has become too big and too powerful. What was supposed to be a single agency with a dual mission—protecting the security of U.S. communications and eavesdropping on the communications of our enemies—has become unbalanced in the post-Cold War, all-terrorism-all-the-time era. Putting the U.S. Cyber Command, the…
19
20
21
22
23
Wikimedia v. NSA: Wikimedia Foundation files suit against NSA
Today, the Wikimedia Foundation is filing suit against the National Security Agency (NSA) and the Department of Justice (DOJ) of the United States. The lawsuit challenges the NSA’s mass surveillanc…
24
EFF Wins Battle Over Secret Legal Opinions on Government Spying
San Francisco - The Electronic Frontier Foundation (EFF) has won its four-year Freedom of Information Act lawsuit over secret legal interpretations of a controversial section of the Patriot Act, including legal analysis of law enforcement and intelligence agency access to census records. The U.S....
25
Signal Desktop
Today we’re making the Signal Desktop beta available. Signal Desktop brings the trusted private messaging experience of Signal to the desktop, with a simplicity that allows you to seamlessly continue conversations back and forth between your mobile device and your desktop computer.
26
LastPass Security Notice
error
27
28
29
30
Deleting any Facebook album
What if your photos get deleted without your knowledge? That would be pretty upsetting, wouldn’t it? This post is about a vulnerability I found that allowed malicious users to delete any photo album on Facebook. Any photo album owned by a user, a page, or a group could be deleted. Graph API is the primary […]