There are many online sites that accept reading input from remote locations. For example a site might try to extract all the text from a webpage, or show you the HTTP-headers a given server sends back in response to a request.
In a nutshell — they don't. This post describes my fruitless effort to convince Microsoft employees that their service is vulnerable, and the humiliation one has to go through should one's account be blocked by a hacker. This is a story of ignorance, pain, and despair.
The freedom to speak in private is essential to democracy. The less private your conversations, the more careful you are about what you say. And being careful leads to less candor, less criticism, and less innovation. Thought and private speech are the breeding ground for new, sometimes controversial ideas. They are…
Last week we got news of the Rosebutt data breach [http://motherboard.vice.com/read/rosebuttboard-ip-board]. This is a very particular class of site and like many others we've recently seen compromised, it's highly likely that members would have preferred to keep their identities secret. It
Overview A vulnerability and a separate logic error exist in the gstreamer 0.10.x player for NSF music files. Combined, they allow for ve...
Law Enforcement, Courts Need to Better Understand IP Addresses, Stop Misuse If police raided a home based only on an anonymous phone call claiming residents broke the law, it would be clearly unconstitutional. Yet EFF has found that police and courts are regularly conducting and approving raids...
I am fascinated by things that are simple on the surface and complex underneath! For example, consider the popular padlock icon that is used to signify that traffic to and from a web site is encrypted: How does the browser know that it should display the green padlock? Well, that’s quite the story! It all […]
Yesterday at the WWDC keynote, Apple announced a series of new security and privacy features, including one feature that’s drawn a bit of attention — and confusion. Specifically, Apple …
We help you acquire the perfect domain for your site. Affordable payment options. Quick and responsive customer support available.
Posted by Nicolas Lidzborski, Gmail Security Engineering Lead and Jonathan Pevarnek, Jigsaw Engineer Today, we’re announcing a variety of...
Update: This feature is now also enabled in Firefox Beta, starting with Firefox Beta 50. Pretty much everyone who uses the web has used a password to log into something. ...
A security blog focusing on Android, the Linux Kernel and everything nice.
*On August 10, 2017, we updated this post with additional National Security Letters (NSLs) we received where, either through litigation or legislation, we have been free…
Over the last few weeks we've seen DDoS attacks hitting our systems that show that attackers have switched to new, large methods of bringing down web applications.
San Francisco—The Electronic Frontier Foundation (EFF) is urging a federal appeals court to reinstate a lawsuit seeking to hold Cisco Systems accountable for aiding in human rights abuses by building the Chinese government a system that Cisco officials knew was intended to identify—and facilitate...
End-to-end encryption has just gone massively mainstream. In an update on March 31st, the Facebook-owned messaging platform WhatsApp quietly pushed an update adding end-to-end encryption enabled by default to its chat and call functionality. They announced the change publicly on Tuesday, allowing...
At Open Whisper Systems, our goal is to make private communication simple. The foundation of our technology is Signal Protocol, a modern, open source, strong encryption protocol for asynchronous messaging systems. It is built from the ground up to make seamless end-to-end encrypted messaging poss...
The San Francisco Chronicle has coverage of an issue that has been circulating on faculty email networks at UC Berkeley for a few days. ...
The Tor Browser Team is proud to announce the first stable release in the 6.0 series. This...
Earlier today, a federal judge ordered Apple to comply with the FBI’s request for technical assistance in the recovery of the San Bernadino gunmen’s iPhone 5C. Since then, many have argued whether these requests from the FBI are technically feasible given the support for strong encryption on iOS devices. Based on my…
This year (2016) I accepted as much incident response work as I could. I spent about 300 hours responding to security incidents and data…
In hope that public disclosure will encourage Google to fix this, despite refusing to, here goes...
