271
272
Canary Watch, One Year Later
We announced Canary Watch a year ago as a coalition project to list Warrant Canaries and monitor them for changes or removal. Canary Watch was a joint project, with EFF, Freedom of the Press Foundation, NYU Law, Calyx and the Berkman Center.Along the way, the project has been part of the massive...
273
Android Full Disk Encryption Cold Boot Attack (2012)
At the end of 2011, Google released version 4.0 of its Android operating system for smartphones. For the first time, Android smartphone owners were supplied with a disk encryption feature that…
274
ProtonMail now the maintainer of OpenPGPjs email encryption library
OpenPGPjs is the world's most popular JavaScript PGP email encryption library and is used by millions of end users and hundreds of developers.
275
Signal: Safety number updates
The latest Signal release includes some changes to the way safety numbers work. Safety numbers allow Signal users to verify the privacy of their communication with a contact, either by comparing a number or by scanning a single QR code. We recently introduced this new design as an update to Sign...
276
A tale of a DNS exploit: CVE-2015-7547
A buffer overflow error in GNU libc DNS stub resolver code was announced last week as CVE-2015-7547. While it doesn't have any nickname yet (last year's Ghost was more catchy), it is potentially disastrous.
277
The Million-Key Question: Investigating the Origins of RSA Public Keys
Petr Švenda, Matúš Nemec, Peter Sekan, Rudolf Kvašňovský, David Formánek, David Komárek, and Vashek Matyáš, Masaryk University
278
Reproducible Signal builds for Android
As of our latest Android release, Signal builds are reproducible. Reproducible builds help to verify that the source code in our GitHub repository is the exact source code used to build the compiled Signal APK being distributed through Google Play.
279
Don't Panic: Seeking Points of Agreement on the “Going Dark” Debate
Don't Panic: Seeking Points of Agreement on the
280
281
Viking Horde: A New Type of Android Malware on Google Play
Viking Horde Android malware conducts ad fraud, but can also be used for other attack purposes such as DDoS attacks, spam messages, and more.
282
Windows Hello face recognition is vulnerable to the Jedi mind trick
Practical development throughout the evolution of Windows.
283
A Statement from The Tor Project on Software Integrity and Apple
The Tor Project exists to provide privacy and anonymity for millions of people, including human...
284
Race you to the kernel
Posted by Ian Beer of Google Project ZeroThe OS X and iOS kernel code responsible for loading a s...
285
Changes to Trusted Certificate Authorities in Android Nougat
News and insights on the Android platform, developer tools, and events.
286
287
Insecure by design: protocols for encrypted phone calls
The MIKEY-SAKKE protocol is being promoted by the UK government as a better way to secure phone calls. The reality is that MIKEY-SAKKE is designed to offer minimal security while allowing undetectable mass surveillance, through the introduction a backdoor based around mandatory key-escrow. This weakness has…
288
EFF Sues for Court Orders Requiring Tech Cos to Decrypt Users’ Communications
San Francisco—The Electronic Frontier Foundation (EFF) filed a Freedom of Information (FOIA) lawsuit today against the Justice Department to shed light on whether the government has ever used secret court orders to force technology companies to decrypt their customers’ private communications, a...
289
290
Investigating a malware sample which sometimes fails to behave maliciously
SentinelOne's blog offers the latest news around cybersecurity, risk reduction, threat intelligence, and more. Sign up for our weekly digest to stay updated.
291
292
DRM Non-Aggression on the Table at W3C
The World Wide Web Consortium (W3C) will consider adopting a DRM non-aggression covenant at its Advisory Committee meeting in Boston next week. EFF has attended several of these meetings before as a W3C member, always with the intent to persuade the W3C that supporting DRM is a bad idea for the Web...
293
Breaking the Chain
Posted by James Forshaw, Wielder of Bolt Cutters.Much as we’d like it to be true, it seems ...
294
Apple Fight Could Lead to “Virtually Limitless” Surveillance Powers, Judge Warns
At stake in Apple's fight against government orders to break open locked iPhones could be the legal authorization for “virtually limitless” surveillance under the Internet of Things, according to a federal judge's order rejecting a government request in a New York drug case yesterday. Midway...
295
Threat Group 4127 Targets Hillary Clinton Presidential Campaign
Learn how Sophos CTU researchers tracked the activities of a Russian-based threat group targeting the Hillary Clinton Presidential Campaign.
296
CrowdStrike’s work with the Democratic National Committee: Setting the record straight
Get the key facts about CrowdStrike's work with the Democratic Natiional Committee in 2016 and debunk the false claims that have been made about our work.
297
The Linux Kernel, CDDL and Related Issues
The Software Freedom Law Center provides legal representation and other law related services to protect and advance Free and Open Source Software.
298
Is curl|bash insecure?
Take control of your web by running your own personal cloud server with Sandstorm.
299
Sustaining Digital Certificate Security
Posted by Ryan Sleevi, Software Engineer This post updates our previous notification of a misissued certificate for google.com Followin...