In May last year, a new attack on the Diffie Hellman algorithm was released, called Logjam . At the time, I was working on a security team, so it was our responsiblity to check that none of our servers would be affected. We ran through our TLS config and decided it was safe, but also needed to check that our SSH…
The Tor Project makes a browser that allows anyone to surf the Internet anonymously. Tor stands for "the onion router" and that describes how the service works. Traffic is routed through a number of relays where each relay only knows the next hop, not the ultimate destination.
The FBI has successfully accessed data on an iPhone that has been the subject of a legal battle between the Justice Department and Apple, according to a court filing. EFF is pleased that the Justice Department has retreated from its dangerous and unconstitutional attempt to force Apple to subvert...
Update: Added clarification that only the Let’s Encrypt client software is changing its name and host. The Let’s Encrypt certificate authority and associated services are not changing names or relocating. Over the next few months the Let’s Encrypt client software will transition to a new name, soon to be announced…
Thursday, September 22nd 2016. An email popped up in my inbox. Subject: ares_create_query OOB write As one of the maintainers of the c-ares project I'm receiving mails for suspected security problems in c-ares and this was such a one. In this case, the email with said subject came from an individual who had reported a…
In Saturday’s edition of the New York Times, Matt Apuzzo reports that the Department of Justice is locked in a “prolonged standoff” with WhatsApp. The government is frustrated by its lack of real-time access to messages protected by the company’s end-to-end encryption. The story may represent a...
The vulnerability — which has since been fixed, or else I would not be writing about it publicly — was in Stripe's bitcoin payment functionality . Some background for readers not familiar with this: Stripe provides payment processing services, originally for credit cards but now also supporting ACH, Apple Pay, Alipay…
Search IETF mail list archives
This is my belated obligatory post about the entire "Apple vs the FBI" episode and whether it should help decrypt the San Bernardino shooter's iPhone. People have commented that I should write something, and I've been reluctant in case I go off in full-rant-mode. I wrote the entire post and…
This week we released our authorisation flow making it possible for you to go from building apps that talk to your bank account, to building apps that can talk to any bank account. This is huge. Check out this SMS bot (how on trend) I hacked up yesterday morning. (and don’t forget to join the beta wait list ).
Country: Belarus Probed ISPs: Beltelecom (AS 6697) Censorship method: TCP injections We have recently heard of network anomalies in Belarus. Tor has been finally blocked in December 2016, although it had been explicitly declared that Tor should be blocked since February 2015. An anonymous cypherpunk has helped to…
Bug Bounty & Application Security
This story starts with Sidney Crosby. A professional hockey player and Canadian icon. I can neither confirm nor deny that I welled up like…
Posted by Neel Mehta and Billy Leonard, Threat Analysis Group On Friday, October 21st, we reported 0-day vulnerabilities — previously publi...
During the months I worked in Let's Encrypt's operations team I got fairly used to being the go-to man for any question that a database query could solve.…
This morning I discovered some rather anomalous 1-star reviews on Amazon for the Apple iPhone 6s 128 GB. About 17% of the reviews for that product are 1-star...
Good Obscurity vs. Bad Obscurity Camouflage OPSEC An SSH Example Reducing Impact or Probability Summary Many of us are familiar with a concept know as Security
The Internet is a diverse ecosystem of private and public stakeholders. By excluding a large sector of communities—like security researchers, artists, libraries, and user rights groups—trade negotiators skewed the priorities of the Trans-Pacific Partnership (TPP) towards major tech companies and...
Summary Your phone probably contains banking, payment and personal information that can be remotely stolen via numerous known and unknown bugs in the Android software. This is attractive to criminals. Vendors (LG, Samsung, Xiaomi, etc.), after selling you their phone, have no incentive to keep your phone’s software up…
The FBI wants strong encryption without key escrow, which is insecure at scale, to be illegal or impractical. Data breach risks rise as devices get less secure.
We show that modern cryptographic software on mobile phones, implementing the ECDSA digital signature algorithm, may inadvertently expose its secret keys through physical side channels: electromagnetic radiation and power consumption which fluctuate in a way that depends on secret information during the cryptographic…
